Study On ICS Anomaly Data Detection Based On CGAN And Deep Forest

Industrial control systems play an important role in key national infrastructure,which can control and operate industrial production processes.With the deep integration of industrialization and information technology,the data communication between industrial control system and traditional information system is more and more frequent.However,the industrial control system is initially designed as an independent isolation system that does not communicate information with the outside world,so the lack of security considerations.The security of the industrial control system is closely related to the security of the national infrastructure,and its vulnerability is used by the attackers,which will bring huge losses to the country and bring serious panic to the society.In recent years,the number of network attacks on industrial control systems worldwide has increased significantly,and the types of attacks are becoming more and more complex.As one of the many methods to prevent network attacks,the intrusion detection system has become a hotspot of academic research.As an important part of intrusion detection,anomaly data detection in traditional systems has become the focus of attention.However,the abnormal data detection model of traditional intrusion detection system is only suitable for specific network attacks,the detection effect is limited,and it is difficult to give full play to its performance in the face of the complex situation of industrial control system.For the complex situation of industrial control system,and the low accuracy,long classification time and poor unbalanced data detection effect of the existing abnormal data detection model.After introducing CGAN and deep forest into the field of anomalous data detection in ICS,the following research:1.Improve deep forests using Light GBM and use the improved deep forest for anomalous data detection in industrial control systems.It takes a lot of time to regularize the complete random forest at the bottom of the deep forest.In this paper,we replace the underlying random forest with Light GBM with regularization to improve the deep forest,and thus reduce the time consumption of data classification.2.Use the convolutional neural networks to improve the CGAN,and use the improved CGAN to solve the data imbalance problems.CGAN can complete the directional expansion of the data,but reaching the equilibrium state is unpredictable.Therefore,this paper introduces the convolutional neural network to improve CGAN,with the help of convolutional neural network expression power rich characteristics,so that it can reach the equilibrium state faster and more stable.The improved CGAN and deep forest were applied to the field of anomaly data detection in ICS to create a CGAN-Deep Forest anomaly data detection model.The experimental results show that the improved deep forest relative to the original deep forest time consumption reduces by 46%,the improved CGAN has faster and more stable data expansion ability compared with the original CGAN,and expands the small sample data to more than 35% of the large sample data size has good detection effect.