Ren Yi, Feng Kanghui, Hu Fei, Chen Liangyin, Chen Yanru
School of Computer Science, Sichuan University, Chengdu 610065, China.
Institute for Industrial Internet Research, Sichuan University, Chengdu 610065, China.
Sensors (Basel). 2023 Oct 12;23(20):8407. doi: 10.3390/s23208407.
With the gradual integration of internet technology and the industrial control field, industrial control systems (ICSs) have begun to access public networks on a large scale. Attackers use these public network interfaces to launch frequent invasions of industrial control systems, thus resulting in equipment failure and downtime, production data leakage, and other serious harm. To ensure security, ICSs urgently need a mature intrusion detection mechanism. Most of the existing research on intrusion detection in ICSs focuses on improving the accuracy of intrusion detection, thereby ignoring the problem of limited equipment resources in industrial control environments, which makes it difficult to apply excellent intrusion detection algorithms in practice. In this study, we first use the spectral residual (SR) algorithm to process the data; we then propose the improved lightweight variational autoencoder (LVA) with autoregression to reconstruct the data, and we finally perform anomaly determination based on the permutation entropy (PE) algorithm. We construct a lightweight unsupervised intrusion detection model named LVA-SP. The model as a whole adopts a lightweight design with a simpler network structure and fewer parameters, which achieves a balance between the detection accuracy and the system resource overhead. Experimental results on the ICSs dataset show that our proposed LVA-SP model achieved an F1-score of 84.81% and has advantages in terms of time and memory overhead.
随着互联网技术与工业控制领域的逐步融合，工业控制系统（ICS）已开始大规模接入公共网络。攻击者利用这些公共网络接口频繁入侵工业控制系统，从而导致设备故障和停机、生产数据泄露等严重危害。为确保安全，工业控制系统迫切需要一种成熟的入侵检测机制。现有的大多数关于工业控制系统入侵检测的研究都集中在提高入侵检测的准确性上，从而忽略了工业控制环境中设备资源有限的问题，这使得优秀的入侵检测算法在实际中难以应用。在本研究中，我们首先使用频谱残差（SR）算法处理数据；然后提出带有自回归的改进型轻量级变分自编码器（LVA）来重构数据，最后基于排列熵（PE）算法进行异常判定。我们构建了一个名为LVA-SP的轻量级无监督入侵检测模型。该模型整体采用轻量级设计，网络结构更简单，参数更少，在检测准确率和系统资源开销之间实现了平衡。在工业控制系统数据集上的实验结果表明，我们提出的LVA-SP模型的F1分数达到了84.81%，并且在时间和内存开销方面具有优势。
