张艳升 李喜旺 李丹 杨华

摘 要：针对工控系统中传统的异常流量检测模型在识别异常上准确率不高的问题，提出一种基于卷积神经网络（CNN）的异常流量检测模型。该模型以卷积神经网络算法为核心，主要由1个卷积层、1个全连接层、1个dropout层以及1个输出层构成。首先，将实际采集的网络流量特征数值规约到与灰度图像素值相对应的范围内，生成网络流量灰度图;然后，将生成好的网络流量灰度图输入到设计好的卷积神经网络结构中进行训练和模型调优;最后，将训练好的模型用于工控网络异常流量检测。实验结果表明，所提模型识别精度达到97.88%，且与已有的精度最高反向传播（BP）神经网络测精度提高了5个百分点。这充分说明该模型能够有效检测出异常流量，作出安全预警，方便技术人员做出安全应对措施，极大地提高工控网络的安全性能。

关键词：卷积神经网络;异常流量监测;工控网络;特征提优;深度学习

中图分类号：TP301.6

文献标志码：A

Abstract： Aiming at the inaccuracy of traditional abnormal flow detection model in the industrial control system， an abnormal flow detection model based on Convolutional Neural Network （CNN） was proposed. The proposed model was based on CNN algorithm and consisted of a convolutional layer， a full connection layer， a dropout layer and an output layer. Firstly， the actual collected network flow characteristic values were scaled to a range corresponding to the grayscale pixel values， and the network flow grayscale map was generated. Secondly， the generated network traffic grayscale image was put into the designed convolutional neural network structure for training and model tuning. Finally， the trained model was used to the abnormal flow detection of the industrial control network. The experimental results show that the proposed model has a recognition accuracy of 97.88%， which is 5 percentage points higher than that of Back Propagation （BP） neural network with the existing highest accuracy. These fully demonstrate that the model can effectively detect abnormal flow， make safety warnings， and facilitate technicians to make security countermeasures， greatly improving the safety performance of industrial control network.

英文關键词Key words： Convolutional Neural Network （CNN）; abnormal flow monitoring; industrial control network; feature optimization; deep learning

0 引言

随着两化融合的不断深入，越来越多的信息技术应用到了工业领域。工业控制系统已广泛应用于电力、水利、石油化工、汽车、航空和食品制药等工业领域， 其中大多数的基础设施实现自动化作业时依赖工业控制系统， 可见，工业控制系统已经成为国家关键基础设施的不可或缺的组成部分，因此工业控制系统和国家的战略安全密不可分。一般情况下，由通用的软件和网络设施组成工业控制系统，并集成到企业网和互联网等开放的网络环境中。……