Deep Learning Detection Modeling With Enhancing The Detection Performance Of Rare Attack For Industrial Cyber-physical System

With the advent of the era of Industry 4.0,advanced information and network communication technologies have been integrated into the traditional industrial production environment to form Industrial Cyber-Physical System(ICPS).ICPS seamlessly integrates computer and communication technology into the control system to comprehensively monitor and control the industrial production process,which greatly increases production efficiency and is widely used in industrial core infrastructure.However,the large number of devices connected through a variety of communication protocols results in the ICPS structure being complex and heterogeneous,which increasing the threat of network attacks on ICPS.In order to enhance the ability of ICPS to resist network attacks,an attack detection model is designed based on deep learning to improve the detection performance of rare attacks,aiming at the problems of high data dimension and imbalance in ICPS.The main research contents are as follows:(1)This thesis studies the composition architecture of ICPS and its existing security problems,and proposes a detection scheme based on deep learning theory to solve the problem that ICPS attacks with high data dimensions are difficult to detect.Based on the natural gas pipeline ICPS system,the security problems existing in ICPS and the characteristics of network attack data are analyzed,and the relevant data processing methods are introduced.The structure principle of deep learning neural network based on Multilayer Perceptron(MLP)is presented,and the index to evaluate the detection performance of attack detection model is presented.(2)The rare attack data rebalance model based on generative adversarial network is studied to improve the detection performance of rare attack from the point of view of increasing the training number of rare attack samples.The attack samples with a small number in the data set are defined as rare attack samples.The Wasserstein Generative Adversarial Network with Gradient Penalty(WGAN-GP)was used to expand the number of rare attack samples and to implement data rebalancing.The attack detection model was established by MLP and Softmax classifier,and the improvement of rare attack detection performance by WGAN-GP data rebalancing was verified.Python experimental results show that,compared with other data rebalancing methods,the data rebalancing model proposed in this thesis can significantly improve the performance of rare attack detection.(3)The multi-agent adversarial attack detection model based on double deep Q network is studied to improve the rare attack detection performance from the perspective of increasing the training times of the detection model on the samples with high detection difficulty.The detection agent(detector)and the selection agent(selector)are constructed by the Double Deep Q Network(DDQN).The adversarial training mechanism is established by setting the opposite reward function,and the selector is used to increase the training times of the detector for rare attack samples.Based on the Temporal Difference(TD)error,the detection difficulty priority is set,and the priority training mechanism is established for improve the detection performance of samples with high detection difficult.The Python experimental results show that,compared with other attack detection methods,the attack detection model designed in this thesis has a significant improvement in the detection performance of rare attack.(4)A natural gas pipeline ICPS attack monitoring and management system based on MAAD is designed.The MA-AD model is used to judge whether the data in the communication network is an attack data in real time,and displays the attack detection results through a graphical interface.When an attack is detected,the system interface alerts the technician through the pop-up window,and records the values of each sensor during the attack for analysis and query after the attack.The system uses graphical interface to simplify the related operations in the training process of WGAN-GP and MA-AD,which is convenient to update the model in time.