ISSN 1000-1239 CN 11-1777/TP

Journal of Computer Research and Development ›› 2019, Vol. 56 ›› Issue (11): 2330-2338.doi: 10.7544/issn1000-1239.2019.20190376

Special Issue: 2019密码学与智能安全研究专题

Previous Articles     Next Articles

Intrusion Detection of Industrial Control System Based on Correlation Information Entropy and CNN-BiLSTM

Shi Leyi, Zhu Hongqiang, Liu Yihao, Liu Jia   

  1. (College of Computer Science and Technology, China University of Petroleum, Qingdao, Shandong 266580)
  • Online:2019-11-12

Abstract: Intrusion detection aims to effectively detect abnormal attacks in the network, which is critical for cyber security. Considering the problem that traditional intrusion detection methods are difficult to extract effective data features from industrial control system communication data, a intrusion detection model based on correlation information entropy and CNN-BiLSTM is proposed. It combines feature selection based on correlation information entropy with fused deep learning algorithms, and thus it can effectively remove noise redundancy, reduce computation and improve detection accuracy. Firstly, the corresponding pre-processing is carried out for the imbalanced samples, and the algorithm based on correlation information entropy is implied to select the features of the samples to achieve the purposes of removing noise data and redundant features. Then, convolutional neural network (CNN) and bidirectional long short-term memory (BiLSTM) network are applied respectively to extract data features from time and space dimensions, and realize feature fusion through multi-head attention mechanism to obtain the final test results. Finally, the optimal model is obtained by the single variable principle and cross-validation method. Compared with other traditional intrusion detection methods, the model has higher accuracy (99.21%) and lower false negative rate (0.77%).

Key words: industrial control system (ICS), intrusion detection, correlation information entropy, CNN-BiLSTM, multi-head attention

CLC Number: