基于深度学习的工控网络异常检测研究和实现

发布时间：2018-11-06 08:10

【摘要】：随着网络技术的发展,工业控制网络在逐步与互联网加深联系的同时,垃圾信息、网络攻击、以及企业网络犯罪等这类网络威胁也进一步危害工控网络。然而传统的网络异常检测技术仍主要依赖于“特征匹配”来识别危险网络行为,不仅识别率有限、维护成本高,而且对于0-Day漏洞的识别效果一直受人垢病。本文结合当前热门的深度学习技术与传统的异常检测机器学习技术,并针对现有工业网络环境下异常检测中存在的问题进行研究和优化。提出了两套工业控制网络环境下的异常检测方法,利用深度神经网络对原始数据进行特征提取或处理,然后采用机器学习的算法来对特征进行分类和判定。与此同时,针对提出的模型,对相应的训练算法也提出了改进和优化。本论文研究成果如下:1.对异常检测中的特征提取问题进行深入分析,提出了一种全新的基于“循环神经网络-高斯伯努利分布限制玻尔兹曼机”的特征译码器。通过训练特征译码器,来学习原始特征数据中正常行为的模式,一旦分类器判定某网络数据的特征偏离这个模式过大,则可以认定该数据属于异常行为;同时提出了一种半监督的增量式更新算法,来对译码器和分类器进行自动地迭代训练,使模型具有一定的成长性。2.提出一种基于主题提取的异常行为检测方法。将工业控制网络中的流量数据类比为语料库中的文档,采用文档主题模型来提取网络数据中隐藏的“主题”信息。同时,利用自动编码器来对原始特征数据进行降维处理,处理后的特征向量在不丢失重要的信息基础上,其表达较原始特征向量更“紧凑”(用于主题提取的特征空间规模更小,冗余数据更少),实验结果其有效地提高了模型的准确率和训练效率。3.选取两种传统的异常检测系统与本文提出的两种方法进行对比实验,通过使用不同规模的实验数据来分析这四种方法的执行效率和识别效果。仿真实验结果证明,本文提出的两种方法在数据量较大的情况下对异常数据有更好的识别能力,尤其是较为隐蔽的异常行为有着极高的识别率。4.设计和实现了一套工控网络环境下的网络流量监控和异常检测系统。将上述本文提出的基于深度学习的异常检测算法作为插件应用到该系统中,形成一套功能完整、性能优越的网络行为监控和异常检测系统。其检测准确性和检测性能较传统方法均有大幅提升。
[Abstract]:With the development of the network technology, the industrial control network is gradually connected with the Internet, while the spam information, network attack, and enterprise network crime are also further harmful to the industrial control network. However, the traditional network anomaly detection technology still mainly relies on "feature matching" to identify dangerous network behavior. Not only the recognition rate is limited, the maintenance cost is high, but also the recognition effect of 0-Day vulnerability is always tainted. This paper combines the current popular depth learning technology with the traditional anomaly detection machine learning technology, and studies and optimizes the problems existing in anomaly detection under the existing industrial network environment. In this paper, two sets of anomaly detection methods in industrial control network environment are proposed. The features are extracted or processed by depth neural network, and then machine learning algorithm is used to classify and judge the features. At the same time, for the proposed model, the corresponding training algorithm is also proposed to improve and optimize. The research results of this paper are as follows: 1. Based on the analysis of feature extraction in anomaly detection, a new feature decoder based on "Gao Si Bernoulli Distribution restricted Boltzmann Machine" is proposed. By training the feature decoder, we can learn the normal behavior pattern in the original feature data. Once the classifier determines that the feature of a network data deviates from this pattern too much, the data can be regarded as abnormal behavior. At the same time, a semi-supervised incremental updating algorithm is proposed to train the decoder and classifier automatically, so that the model has a certain growth. 2. An anomaly detection method based on topic extraction is proposed. The traffic data in the industrial control network is compared to the document in the corpus, and the document subject model is used to extract the "topic" information hidden in the network data. At the same time, the automatic encoder is used to reduce the dimension of the original feature data. Its expression is more compact than the original feature vector (the size of feature space for topic extraction is smaller and the redundant data is less). The experimental results show that the accuracy and training efficiency of the model are improved effectively. Two traditional anomaly detection systems are selected to compare with the two methods proposed in this paper. The efficiency and recognition effect of these four methods are analyzed by using different scale experimental data. The simulation results show that the two methods proposed in this paper have a better ability to identify abnormal data under the condition of large amount of data, especially the hidden abnormal behavior has a very high recognition rate. 4. A set of network traffic monitoring and anomaly detection system under industrial control network environment is designed and implemented. The anomaly detection algorithm based on depth learning proposed in this paper is applied to the system as a plug-in to form a set of network behavior monitoring and anomaly detection system with complete function and superior performance. The accuracy and performance of the method are greatly improved compared with the traditional methods.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP18;TP393.08

【相似文献】