摘要
工业环境中正常与异常样本间的不平衡特点导致入侵检测模型在进行分类时对少数异常样本识别率较低。然而,工控入侵检测模型尤其注重对异常样本的检测成功率,因此文章引入具有自适应思想的边界SMOTE算法,在边界区域根据样本分布情况合理生成少数样本以降低样本的不平衡性。UCI不平衡数据集上的结果证明了该算法的有效性。然后改进边界SMOTE对原始不平衡工控入侵检测数据集SWaT进行数据预处理,在合成合理攻击数据后使用孪生支持向量机(TWSVM)作为分类器构建入侵检测模型。实验结果表明,该方法提高了对攻击样本的识别能力。
In the actual industrial environment,the imbalance between normal and abnormal samples results in the low recognition rate of a few abnormal samples.However,intrusion detection model of industrial control system(ICS)pays special attention to the detection success rate of abnormal samples.Therefore,this paper proposed a Border-SMOTE algorithm based on the introduction of adaptive idea,which generated a small number of samples reasonably according to the sample distribution in the border area.The results on the UCI unbalanced data set show the effectiveness of the improved algorithm.In the process of constructing intrusion detection model of ICS,the original data was preprocessed with improved Border-SMOTE,and TWSVM was used as classifier to identify the attack data after synthesizing reasonable attack data.The experimental results on the unbalanced industrial control data set SWaT show that the proposed model improves the ability of identifying attack samples.
作者
张晓宇
王华忠
ZHANG Xiaoyu;WANG Huazhong(Key Laboratory of Advanced Control and Optimization for Chemical Processes of Ministry of Education,East China University of Science and Technology,Shanghai 200237,China)
出处
《信息网络安全》
CSCD
北大核心
2020年第7期70-76,共7页
Netinfo Security
基金
国家自然科学基金[61973119]
中央高校基本科研业务费专项资金[222201917006]。
