Research On Anomaly Detection Algorithm Of Industrial Control System Based On Graph Neural Network

As an important infrastructure of the "new infrastructure",the industrial Internet,while promoting the "integration of industrialization and informatization",has also broken the isolation boundary of the industrial control network.The industrial network has moved from closed to open,which also makes the security protection system of the industrial control system face a huge security threat.As the core of industrial field,industrial control system has been widely used in key basic industries such as power,petrochemical,environmental protection,etc.In recent years,industrial control security incidents have occurred frequently,major infrastructure has been damaged due to the intrusion of industrial control systems,and normal production and life have been greatly affected.Governments and industries at home and abroad have accelerated the research on industrial control security.Based on graph neural network in deep learning,this paper uses the data collected by sensors/actuators of industrial control system to construct an anomaly detector to detect whether the system is abnormal.The specific research contents are as follows:1)Feature extraction based on cyber-physical data of industrial control system.The data preprocessing methods of existing anomaly detection algorithms are not designed for the characteristics of the dataset.Therefore,this paper analyzes the attack mechanism and abnormal data of the collected cyber-physical data of the industrial control system,and studies its attack intention and attack classification;according to the characteristics of the time domain and frequency domain of the cyber-physical data of the industrial control system,the corresponding data preprocessing is carried out,including: identifying and eliminating abnormal data based on data distribution characteristics.Based on the process analysis of industrial data reaching a steady state,process unsteady data;construct time window data,extract the timing characteristics of data,and construct an adjacency matrix based on the physical connection structure of industrial control system sensor/actuator data,and extract graph structure features,together as the data input of the subsequent graph neural network model.2)Study the anomaly detection algorithm of graph neural network based on spectrum selection.Existing anomaly detection algorithms ignore the spatial correlation between different features.Therefore,this paper improves the graph attention network: apply the spectral analysis method to the graph neural network,use Fourier transform to convert the time domain data to the frequency domain,apply the frequency domain component selection mechanism,and retain the important information of the original data.In the above,noise reduction is performed on the input data;the data before and after spectrum selection are fused as the data input of the improved graph attention network,and the attention coefficients are calculated for the two data,and the weighted summation is obtained to obtain the model timing prediction output;the experimental results show that,the precision rate of the graph neural network anomaly detection algorithm based on spectrum selection on the SWa T dataset is 93.34%,compared with the existing anomaly detection algorithm,the F1 score has increased by 22.95%3)Research on anomaly detection algorithms based on multimodal neural networks.In order to obtain frequency domain information in industrial data and provide more prior knowledge for time series prediction models,this paper designs a frequency domain graph neural network,constructs frequency domain data and frequency domain adjacency structure as model input,and designs all The required frequency domain calculation module realizes the calculation of frequency domain data and obtains the output of spectrum prediction;in order to realize the fusion of multimodal data,this paper designs a multimodal neural network,which integrates the frequency domain information captured by the frequency domain graph neural network and the timedomain information captured by the stacked long-short-term memory network is used to realize time series prediction and anomaly detection based on multi-modal input.The experimental results show that the precision rate of the anomaly detection algorithm based on the multimodal neural network on the WADI dataset is 91.24%.Compared with the existing anomaly detection algorithm,the recall rate has increased by 14.00%.