结合优化支持向量机与K-means++的工控系统入侵检测方法

针对工业控制系统传统单一检测算法模型对不同攻击类型检测率和检测速度不佳的问题,提出一种优化支持向量机和K-means++算法结合的入侵检测模型。首先利用主成分分析法(PCA)对原始数据集进行预处理,消除其相关性;其次在粒子群优化(PSO)算法的基础上加入自适应变异过程避免在训练的过程中陷入局部最优解;然后利用自适应变异粒子群优化(AMPSO)算法优化支持向量机的核函数和惩罚参数;最后利用密度中心法改进K-means算法与优化后的支持向量机组合成入侵检测模型,从而实现工业控制系统的异常检测。实验结果表明,所提方法在检测速度和对各类攻击的检测率上得到明显提升。

Intrusion detection method for industrial control system with optimized support vector machine and K-means++

Aiming at the problem that traditional single detection algorithm models have low detection rate and slow detection speed on different types of attacks in industrial control system, an intrusion detection model combining optimized Support Vector Machine (SVM) and K-means++algorithm was proposed. Firstly, the original dataset was preprocessed by Principal Component Analysis (PCA) to eliminate its correlation. Secondly, an adaptive mutation process was added to Particle Swarm Optimization (PSO) algorithm to avoid falling into local optimal solution during the training process. Thirdly, the PSO with Adaptive Mutation (AMPSO) algorithm was used to optimize the kernel function and penalty parameters of the SVM. Finally, a K-means algorithm improved by density center method was united with the optimized support vector machine to form the intrusion detection model, achieving anomaly detection of industrial control system. The experimental results show that the proposed method can significantly improve the detection speed and the detection rate of various attacks.