基于深度学习的水利工控网络流量异常检测方法

Network traffic anomaly detection method for water conservancy industrial control systems based on deep learning

摘要

【目的】针对水利工控网络流量数据集不平衡、特征维数多和检测效率低等问题，提出一种结合改进条件生成对抗网络(ICGAN)、深度残差收缩网络(DRSN)、长短期记忆网络(LSTM)的流量异常检测方法。【方法】利用ICGAN构建了网络流量平衡数据集，利用DRSN-LSTM混合深度学习模型对网络异常流量数据进行检测，其中DRSN负责提取数据的空间特征，其残差连接可以解决网络退化与过拟合问题，压缩和激励网络可自动为每个特征图分配权重系数以提高检测效果，LSTM负责提取数据的时间特征。【结果】以秦淮河武定门闸站为应用场景对该方法进行测试，结果表明采用ICGAN优化后的数据集训练的各类检测模型，其流量分类精度高于原始数据集。DRSN-LSTM的网络流量异常检测的总体准确率达到了98.76%,其中正常数据分类的P、R和F1值，分别达到了99.22%、99.69%和99.46%,在评价指标上优于比较模型。【结论】融合ICGAN、DRSN和LSTM算法优势的水利工控网络流量异常检测方法，能够有效改善原始数据集中的类别不平衡性问题，提高对异常工控网络流量的检测能力，保障水利工程安全稳定运行。

Abstract

[Objective] This study proposes a network traffic anomaly detection method that addresses the issues of data imbalance, high feature dimensionality, and low detection efficiency in water conservancy industrial control networks. The method integrates an improved Conditional Generative Adversarial Network(ICGAN), Deep Residual Shrinking Network(DRSN), and Long Short-Term Memory Network(LSTM). [Methods] ICGAN was used to construct a balanced network traffic dataset, and a DRSN-LSTM hybrid deep learning model was employed for anomaly detection in network traffic. DRSN was responsible for extracting spatial features, with residual connections addressing network degradation and overfitting issues. The compression and excitation network automatically assigned weight coefficients to each feature map to improve detection performance. Lastly, LSTM extracted temporal features from the data. [Results] The method was tested in the application scenario of the Qinhuai River Wudingmen Sluice Station. The result showed that models trained on the ICGAN-optimized dataset achieved higher traffic classification accuracy than those trained on the original dataset. Overall, DRSN-LSTM achieved an accuracy of 98.76% in detecting network traffic anomalies. P, R, and F1 values for normal data classification were 99.22%, 99.69%, and 99.46%, respectively, which outperformed the comparison models in terms of these evaluation indicators. [Conclusion] By integrating the advantages of ICGAN, DRSN, and LSTM algorithms, the anomaly detection method for water conservancy industrial network traffic effectively alleviates the type imbalance in the original dataset, improves the detection ability of abnormal industrial control network traffic, and ensures the safe and stable operation of water conservancy projects.

关键词

水利工控 / 网络流量异常检测 / 深度学习 / 条件生成对抗网络 / 深度残差收缩网络 / 长短期记忆网络 / 评价指标

Key words

water conservancy industrial control / network traffic anomaly detection / deep learning / conditional generative adversarial networks / deep residual shrinkage network / long short-term memory network / evaluation indicator

基金资助

国家重点研发计划(2023YFC3006500)

江苏省水利科技项目(2022052)

江苏省水利科技项目(2022064)