Research On Industrial Control Intrusion Detection Algorithm Based On Variational Auto Encoder And Spectral Clustering

With the gradual integration of Internet technology and industrial control systems,these systems have started to connect to public networks on a large scale.Attackers frequently exploit these public network interfaces to launch intrusions against industrial control systems,causing severe harm such as equipment failure and production data leaks.Therefore,industrial control systems urgently need a mature intrusion detection mechanism to ensure their security,and research on industrial intrusion detection has become a fervent topic in the industry and academia.Existing research on intrusion detection still has some unresolved issues.On the one hand,research on intrusion detection has been largely focused on improving precision,ignoring the limited device resources in industrial environments,making it challenging to apply excellent intrusion detection algorithms in practice.On the other hand,monitoring and maintaining industrial control systems requires a large amount of high-dimensional sensor data,which can burden system resources.However,current research on data dimensionality reduction in industrial control systems is not comprehensive.These issues can be categorized as balancing intrusion detection precision and system resource overhead.Therefore,this thesis addresses the problem from two aspects: model overhead and data overhead,and proposes two innovative solutions,as follows:To address the issue of limited device resources in industrial control system environments,this the proposes a lightweight unsupervised intrusion detection model,LVA-SR-PE,based on a variational auto encoder.Firstly,this thesis proposes using spectral residuals for data processing to increase the reconstruction difficulty of intrusion samples.Secondly,this thesis proposes a lightweight,improved variational auto encoder to reconstruct data and calculate reconstruction errors.Finally,this thesis proposes an improved anomaly score based on permutation entropy for intrusion detection.Experimental results show that the F1-score of the LVA-SR-PE model reaches 84.81%,which is 3% higher than the best-performing comparative model,with advantages in time and memory overhead.To address the issue of excessive data volume in industrial control systems,this thiesis proposes an unsupervised intrusion detection model,PSI-ISC-VAE,based on spectral clustering.Firstly,this thesis proposes using PSI testing to address concept drift in industrial control system’s data.Secondly,this thesis proposes an improved spectral clustering to reduce the dimensionality of industrial control system’s data,and designs a key sensor selection algorithm based on the minimum average Siamese distance.Finally,this thesis uses a variational auto encoder to detect intrusions in data from critical sensors.Experimental results show that the PSI-ISC-VAE model can achieve the same F1-score as the best-performing comparative model,with a 70% reduction in the amount of sensor data used.Finally,this thesis combines the two proposed models and designs an intrusion detection system,Unsupervised Detection Sys,based on the characteristics of actual industrial control systems environments to realize the application of intrusion detection algorithms.