基于无监督学习的智能电网入侵检测

智能电网通过引入信息和通信技术服务,带来了传统电网的技术演变,与此同时在安全方面也带来了严重的挑战.本文提出了一种智能电网入侵检测系统安全架构和一种基于无监督学习的新型入侵检测系统(intrusion detection system, IDS).我们设计了区域式训练(block-training)架构,不仅可以减轻数据中心的计算压力,还可以对本地流量进行特征训练.我们还提出了一种基于交叉验证的递归特征消除的差分自编码器算法(RFECV-VAE).RFECV-VAE综合了RFECV和VAE模型,在特征选择过程使用递归特征消除交叉验证法(recursive feature elimination cross-validation, RFECV),异常检测采用差分自编码器(variational autoencoders, VAE),它可以对大规模高维数据进行高精度异常检测.最后,本文选择深度自编码器、深度自编码器高斯混合模型、单类支持向量机、隔离森林、差分自编码器作为对比算法,采用准确率、ROC＿AUC、F1＿score和训练时间等指标来进行性能评估.实验结果表明,RFECV-VAE算法...

Intrusion Detection in Smart Grid Based on Unsupervised Learning

The smart grid (SG) constitutes a technological evolution of the traditional grid by introducing information and communication technology (ICT) services. Although using of ICT has advantages, it poses some serious challenges to security. In this study, we propose a security architecture of the smart grid intrusion detection system and a novel intrusion detection system (IDS) based on unsupervised learning. We design block-training architecture which can not only reduce the computing burden in the data center but also train the characteristics of local traffic. We also propose a variational autoencoder based on recursive feature elimination with cross-validation (RFECV-VAE). The RFECV-VAE is a combination of RFECV (for feature selection) and VAE model (for anomaly detection) and can detect large-scale and high-dimensional data with high accuracy. Finally, we choose deep autoencoder (DAE), deep autoencoding Gaussian mixture model (DAGMM), one-class support vector machine (OCSVM), isolation forest (IF), and VAE as comparison algorithms and accuracy, ROC_AUC, F1_score, and training duration for performance evaluation. The experimental results show that RFECV-VAE outperforms the comparison algorithms.