基于特征组合优化的工业互联网恶意行为实时检测方法

扫码查看

原文链接

万方数据
维普

中文摘要：工业互联网中节点数据具有高维、冗余和海量等特性,传统的恶意行为检测模型无法对工业互联网恶意攻击行为做出快速且准确的判断,提出基于特征组合优化的工业互联网恶意行为实时检测方法.采用改进的相关性快速过滤算法和基于奇异值分解的主成分分析算法对工业互联网恶意行为样本数据进行特征组合优化,基于对称不确定性信息度量指标和近似马尔科夫毯准则进行特征相关性计算、冗余特征识别与排除,通过参数特征维度的不同配置得到若干候选特征组合;利用决策树评估器筛选出准确率最高的候选特征组合;通过奇异值分解的主成分分析进一步进行特征降维,得到低维高信息量的最优特征组合;结合极端梯度提升算法和优化的特征组合对工业互联网恶意行为样本进行分类,基于密西西比州立大学多分类电力系统攻击样本数据对本文方法进行了验证;实验结果表明,特征组合优化检测模型训练时间可缩减57.53%,单个样本的平均检测时间为0.002 ms,可减少23.99%,基于特征组合优化的检测模型的准确率、召回率和F1值较特征优化前分别提升了1.11%、1.25%和1.01%.本文方法的突出优势表现为在提升模型检测效果的同时可明显降低模型检测时间,能更好适应工业互联网的实时性要求.

外文标题：Real-Time Detection Method of Malicious Behaviors in Industrial Internet Based on Feature Combination Optimization

外文摘要：The data of nodes in industrial Internet have characteristics of high dimensionality,redundancy and mass and traditional malicious behaviors detection model cannot make a fast and accurate judgment on the malicious behaviors of industrial Internet.A real-time detection method of malicious behaviors in industrial Internet based on feature combination optimization is proposed.The feature combination of industrial Internet malicious behaviors sample data are optimized by improved fast correlation filtering algorithm and principal component analysis algorithm based on singular value decomposi-tion.Based on symmetric uncertainty information measurement index and approximate Markov blanket criterion,feature correlation calculation,redundant feature identification and exclusion are performed.Several candidate feature combina-tions are obtained from different configurations of feature dimensions;Use decision tree evaluator to select the feature com-bination with the highest accuracy;To acquire the optimal feature combination of lower dimension and higher valuable in-formation,the principal component analysis of singular value decomposition is used for further reduce dimension of feature;To classify malicious behaviors samples in industrial Internet through combing extreme gradient boosting algorithm and the optimized feature combination.The proposed method is verified based on Mississippi State University's multi-class power system attack sample data;The experiment demonstrate that training time of the feature combination optimization detection model can be reduced by 57.53%,and the average detection time of a single sample is 0.002 ms,which can be reduced by 23.99%.The accuracy,recall and F1 value of the detection model based on feature combination optimization are improved by 1.11%,1.25%and 1.01%,respectively compared with those before feature optimization.The outstanding advantage of method in this paper is that it can significantly reduce model detection time while improving model detection effect,and can better adapt to the real-time requirements of industrial Internet.

外文关键词：

industrial Internetimproved fast correlation filtering algorithmprincipal component analysis algorithm based on singular value decompositionfeature combination optimizationextreme gradient boostingreal-time detection of malicious behaviors

作者：

胡向东、张琴

展开 >

作者单位：

重庆邮电大学现代邮政学院,重庆 400065

重庆邮电大学自动化学院/工业互联网学院,重庆 400065

关键词：

工业互联网改进的相关性快速过滤算法奇异值分解的主成分分析特征组合优化极端梯度提升恶意行为实时检测

基金：

重庆市级人才计划项目

项目编号：

cstc204ycjhbgzxm0088

出版年：

2024

DOI：

10.12263/DZXB.20221394

电子学报

中国电子学会

电子学报

CSTPCD北大核心

影响因子：1.237

ISSN：0372-2112

年,卷(期)：2024.52(9)