基于IDM-GAN-APLSTM的数据修复及入侵检测方法

DATA REPAIR AND INTRUSION DETECTION METHOD BASED ON IDM-GAN-APLSTM

  • 摘要: 在电网工控系统入侵检测中,常见的基于人工智能算法都需要数据完整,而数据的缺失显著影响入侵检测的准确率。针对上述问题,提出一种将生成对抗网络(GAN)与长短期记忆网络(LSTM)分别改进并结合的入侵检测模型。通过改进的GAN解决上游数据缺失问题,生成器结合多头自注意力机制和用于插补的门控循环单元神经网络(GRUI)处理不完整时序特征间的潜在相关性并生成填充数据。此外,引入时间提示矩阵,辅助判别器识别伪造数据。改进损失函数用以进一步提高数据生成的质量。最后,通过改进的多孔长短期记忆网络(PLSTM)结合注意力机制提高攻击样本的检测率。实验结果表明,该方法有效解决了电网工控系统入侵检测中的数据缺失及修复后数据偏移带来的分类不精问题,在修复缺失率为50%的数据后,准确度仍能达到94.4%,误报率低至5.9%。

     

    Abstract: In the intrusion detection of power grid industrial control system, common artificial intelligence-based algorithms require complete data, and the lack of data significantly affects the accuracy of intrusion detection. Aimed at the above problems, an intrusion detection model that improves and combines generative adversarial network (GAN) and long short-term memory network (LSTM) is proposed. The upstream data missing problem was addressed by an improved GAN. The generator combined multi-head self-attention mechanism and gated recurrent unit neural network for imputation (GRUI) to handle potential correlations among incomplete temporal features and generate imputed data. In addition, a temporal prompt matrix was introduced to assist the discriminator to identify fake data. The improved loss function was used to further improve the quality of data generation. The detection rate of attack samples was improved through the improved porous long short-term memory network (PLSTM) combined with the attention mechanism. The experimental results show that the proposed method effectively solves the problem of inaccurate classification caused by missing data in the intrusion detection of the power grid industrial control system and data offset after repair. After repairing the data with a missing rate of 50%, the accuracy can still reach 94.4%, the false positive rate is as low as 5.9%.

     

/

返回文章
返回