文献类型：期刊文献

中文题名：基于改进Border-SMOTE的不平衡数据工业控制系统入侵检测

英文题名：Intrusion Detection of ICS Based on Improved Border-SMOTE for Unbalance Data

作者：张晓宇[1];王华忠[1]

机构：[1]华东理工大学化工过程先进控制和优化技术教育部重点实验室,上海200237

年份：2020

期号：7

起止页码：70

中文期刊名：信息网络安全

外文期刊名：Netinfo Security

收录：CSTPCD;;北大核心:【北大核心2017】；CSCD:【CSCD_E2019_2020】；

基金：国家自然科学基金[61973119];中央高校基本科研业务费专项资金[222201917006]。

语种：中文

中文关键词：工业控制系统;入侵检测;不平衡数据;Border-SMOTE

外文关键词：ICS;intrusion detection;unbalance data;Border-SMOTE

摘要：工业环境中正常与异常样本间的不平衡特点导致入侵检测模型在进行分类时对少数异常样本识别率较低。然而,工控入侵检测模型尤其注重对异常样本的检测成功率,因此文章引入具有自适应思想的边界SMOTE算法,在边界区域根据样本分布情况合理生成少数样本以降低样本的不平衡性。UCI不平衡数据集上的结果证明了该算法的有效性。然后改进边界SMOTE对原始不平衡工控入侵检测数据集SWaT进行数据预处理,在合成合理攻击数据后使用孪生支持向量机(TWSVM)作为分类器构建入侵检测模型。实验结果表明,该方法提高了对攻击样本的识别能力。
In the actual industrial environment,the imbalance between normal and abnormal samples results in the low recognition rate of a few abnormal samples.However,intrusion detection model of industrial control system(ICS)pays special attention to the detection success rate of abnormal samples.Therefore,this paper proposed a Border-SMOTE algorithm based on the introduction of adaptive idea,which generated a small number of samples reasonably according to the sample distribution in the border area.The results on the UCI unbalanced data set show the effectiveness of the improved algorithm.In the process of constructing intrusion detection model of ICS,the original data was preprocessed with improved Border-SMOTE,and TWSVM was used as classifier to identify the attack data after synthesizing reasonable attack data.The experimental results on the unbalanced industrial control data set SWaT show that the proposed model improves the ability of identifying attack samples.