中图分类号：TP393
文献标识码：A
DOI：10.19358/j.issn.2096-5133.2022.06.002
引用格式： 王晨，张迪明，韩斌. 基于变分自编码器和三支决策的工控入侵检测算法[J].信息技术与网络安全，2022，41(6)：10-17.

An industrial intrusion detection algorithm based on variational autoencoder and three-way decisions

Abstract：In order to extract the characteristics of industrial control intrusion data set and classify malicious data more accurately, make the intrusion detection methods meet the security needs of the current industrial control network, a novel VAE-TWD algorithm based on variational auto-encoders(VAE) and three-way decisions theory(TWD) is proposed. The algorithm uses the powerful perceptive ability of variational autoencoder to reduce dimension mapping and extract feature for high-dimensional data, and then makes instant decision for normal and malicious data by using three-way decision theory, divides them into positive decision domain and negative decision domain. For the uncertain data in the boundary region, the new training set will be constructed by selecting appropriate data with different granularity features and then extended to the original data set. Then the decision-making process is repeated until the data in the decision-making domain is empty to avoid the risk of blind decision-making. The experimental results show that VAE-TWD algorithm improves feature extraction ability and classification ability of industrial control intrusion detection, is superior to the comparison algorithms in accuracy, detection rate, false positive rate, F1 score and other indicators, and effectively improves the performance of industrial control intrusion detection.

Key words :variational autoencoder；three-way decisions；feature extraction；industrial control intrusion detection