首页|融合Transformer和MSCNN双分支架构的工控网络入侵检测研究

融合Transformer和MSCNN双分支架构的工控网络入侵检测研究

扫码查看
针对现有的工控网络入侵检测方法中存在对工控流量的多空间特征和长距离时序特征的提取能力不足等问题,提出了 一种融合Transformer和MSCNN双分支架构的工控网络入侵检测模型.该模型利用多尺度卷积(MSCNN)中多个不同大小卷积核,对工控流量中多个空间特征进行抽取,扩大了对工控流量特征范围的学习.同时引入Transformer增强了模型对工控流量中长距离时序特征的提取能力,进一步提高了模型的性能.通过UNSW-NB15和NSL-KDD数据集进行了实验,结果表明:该模型与其他方法相比能够提取更加全面有效的特征,具有很好的检测性能和泛化能力.
Integrating transformer and MSCNN dual-branch architecture research on intrusion detection in industrial control networks
In response to the existing intrusion detection methods for industrial control networks,there are problems such as insufficient extraction capabilities for multi spatial features and long-distance temporal features of industrial control traffic.A dual branch architecture of Transformer and MSCNN is proposed for intrusion detection in industrial control networks.This model utilizes multiple convolution kernels of different sizes in multi-scale convolution(MSCNN)to extract multiple spatial features from industrial control traffic,expanding the learning range of industrial control traffic features.At the same time,the introduction of Transformer enhances the model's ability to extract long-distance temporal features in industrial control flow,further improving the performance of the model.Conduct experiments using the UNSW-NB15 and NSL-KDD datasets.The results show that compared with other methods,this model can extract more comprehensive and effective features,and has good detection performance and generalization ability.

industrial control networkintrusion detectionspatial characteristicslong distance temporal featuresMSCNNtransformer

李井龙、刘胜全、马宇航、陈洋洋、刘博

展开 >

新疆大学信息科学与工程学院,新疆乌鲁木齐 830017

工控网络 入侵检测 空间特征 长距离时序特征 MSCNN Transformer

工信部新疆工业互联网态势感知平台项目

TZXD-S-P-xjtszh01

2024

东北师大学报(自然科学版)
东北师范大学

东北师大学报(自然科学版)

CSTPCD北大核心
影响因子:0.612
ISSN:1000-1832
年,卷(期):2024.56(3)