中圖分類號： TP393
文獻標識碼： A
DOI： 10.19358/j.issn.2096-5133.2022.06.002
引用格式： 王晨，張迪明，韓斌. 基于變分自編碼器和三支決策的工控入侵檢測算法[J].信息技術與網絡安全，2022，41(6)：10-17.

An industrial intrusion detection algorithm based on variational autoencoder and three-way decisions

Abstract： In order to extract the characteristics of industrial control intrusion data set and classify malicious data more accurately, make the intrusion detection methods meet the security needs of the current industrial control network, a novel VAE-TWD algorithm based on variational auto-encoders(VAE) and three-way decisions theory(TWD) is proposed. The algorithm uses the powerful perceptive ability of variational autoencoder to reduce dimension mapping and extract feature for high-dimensional data, and then makes instant decision for normal and malicious data by using three-way decision theory, divides them into positive decision domain and negative decision domain. For the uncertain data in the boundary region, the new training set will be constructed by selecting appropriate data with different granularity features and then extended to the original data set. Then the decision-making process is repeated until the data in the decision-making domain is empty to avoid the risk of blind decision-making. The experimental results show that VAE-TWD algorithm improves feature extraction ability and classification ability of industrial control intrusion detection, is superior to the comparison algorithms in accuracy, detection rate, false positive rate, F1 score and other indicators, and effectively improves the performance of industrial control intrusion detection.

Key words : variational autoencoder；three-way decisions；feature extraction；industrial control intrusion detection