电子学报 ›› 2022, Vol. 50 ›› Issue (6): 1457-1465.DOI: 10.12263/DZXB.20201275

所属专题: 网络空间及网络通信中的安全问题

• 学术论文 • 上一篇    下一篇

基于胶囊网络的工业互联网入侵检测方法

胡向东, 李之涵   

  1. 重庆邮电大学自动化学院/工业互联网学院,重庆 400065
  • 收稿日期:2020-11-12 修回日期:2021-04-21 出版日期:2022-06-25
    • 作者简介:
    • 胡向东 男,1971年生,四川武胜人.博士,重庆邮电大学教授,博士生导师.主要研究方向为智能感知、网络化测量及工业互联网安全等.E-mail: huxd@cqupt.edu.cn
      李之涵 男,1993年生,安徽淮北人.硕士研究生.主要研究方向为工业互联网安全.E-mail: lizhihan_cn@foxmail.com
    • 基金资助:
    • 教育部-中国移动科研基金 (MCM20150202)

Intrusion Detection Method Based on Capsule Network for Industrial Internet

HU Xiang-dong, LI Zhi-han   

  1. School of Automation/School of Industrial Internet, Chongqing University of Posts and Telecommunications, Chongqing 400065, China
  • Received:2020-11-12 Revised:2021-04-21 Online:2022-06-25 Published:2022-06-25
    • Supported by:
    • Research Fund of Ministry of Education of China and China Mobile (MCM20150202)

摘要:

工业互联网在快速发展的同时,面临着严峻的信息安全风险.针对传统入侵检测方法准确性低、难以适应工业互联网海量不平衡数据的问题,提出一种基于胶囊网络的工业互联网入侵检测方法.首先,基于残差块构建特征提取模块,引入全局平均池化层得到高质量的数据特征;其次,使用动态路由算法,通过迭代的方式对入侵数据特征进行聚类,在胶囊网络模块完成数据分类.基于Modbus/TCP协议的气体管道传感器网络数据集的测试结果表明,该方法可以在隐性提取特征的同时改善检测准确率.与所列算法对比,本文方法提高了检测指标,对不平衡数据有更强的鲁棒性,更接近工业互联网入侵检测技术需求.

关键词: 工业互联网, 入侵检测, 胶囊网络, 残差网络

Abstract:

Industrial internet is rapidly growing up while encountering severe information security risks at the same time. Aiming at the problem that traditional intrusion detection methods are low in accuracy and difficult to adapt to the massive unbalanced data of industrial Internet, an industrial Internet intrusion detection method based on capsule network is proposed. Firstly, a module involved feature extraction module is constructed based on the residual block, and a global average pooling layer is introduced to get high-quality data features. Secondly, the dynamic routing algorithm is introduced. The intrusion data features are clustered through iteration, and classification are completed in the module based on capsule network. The test results out of the data set from sensor network with Modbus/TCP protocol used in gas pipeline show that the method can improve the accuracy rate while extracting features implicitly. Compared to the listed algorithms, the proposed method in this paper performs better in test indexes with stronger robustness to unbalanced data and is closer to meet the needs of intrusion detection from industrial Internet.

Key words: industrial Internet, intrusion detection, capsule network, residual network

中图分类号: