基于数据增强的DBN-ELM入侵检测方法

随着工业4.0时代的到来，工控安全事件频发，工控信息安全问题已经备受关注。由于工控环境较为复杂，导致传统机器学习方法在分类大量工控数据时存在收敛速度慢、泛化性较差以及数据分布不均衡等问题。为了解决此类问题，本研究采用一种基于WGAN-GP数据增强并运用深度信念网络和极限学习机相结合的深度学习入侵检测方法，本方法基于一种梯度惩罚的生成对抗网络数据增强并将深度信念网络（deep belief network，DBN）自动提取特征的能力与极限学习机（extreme learning machine, ELM）快速学习的能力相结合。采用加拿大网络安全研究所公布的 CICIDS2017 数据集对所提出的算法进行测试，经过对比实验证明了该方法精度更高，收敛速度更快。为了验证所提出算法在工控环境中的适用性，本研究同时采用密西西比州立大学天然气管道数据集进行验证，证明了该算法在工业环境中具有高精度、误报率低等优点，为工业入侵检测的研究提供了一种新的研究思路。

DBN-ELM Intrusion Detection Method Based on Data Augmentation

Industrial control security incidents occur frequently with the advent of industry 4.0 era. Meanwhile, industrial control information security has received great attention. Traditional machine learning methods have some problems when classifying a large amount of industrial control data due to the complexity of industrial control environment. The problems include slow convergence, poor generalization and uneven data distribution. To solve such problems, a deep learning intrusion detection method based on WGAN-GP data enhancement is adopted in this study. It also combines deep belief network with extreme learning machine. This method is based on a data augmentation generative adversarial network of a gradient penalty. The ability of DBN to extract features automatically is combined with the ability of ELM to learn quickly. The proposed algorithm is tested on the CICIDS2017 data set published by the Canadian Network Security Research Institute. Comparative experiment proves that the method has higher accuracy and faster convergence rate. To verify the applicability of the proposed algorithm in the industrial control environment, the Mississippi State University natural gas pipeline dataset was also used in this study for verification. The algorithm was proved to have the advantages of high accuracy and low false alarm rate in industrial environment. This research provided a new research idea for the research of industrial intrusion detection.