Abstract: In the era of industrial Internet,different manufacturers hope to get a more perfect security detection model by sharing local data.However,after accessing the Internet,local data is more vulnerable to theft,and federated learning can achieve the purpose of data privacy protection and sharing by exchanging model parameters.To solve the defects in the existing methods for industrial computer security detection,a distributed security detection method for industrial personal computer service behavior based on federated learning was proposed,including industrial personal computer service behavior feature detection method,federated learning model aggregation method based on information entropy distribution weight and data transmission reconstruction method based on forwarding hardware.The above method could improve the attack identification accuracy of industrial control application protocol and solve the problem of model deviation caused by internal data pollution of industrial personal computer.The prototype system was implemented and experimentally verified in the coiling device control system.Compared with the industrial control security detection paper using non-business behavior modeling,the detection accuracy of man-in-the-middle attack and remote attack was improved by 17% and 24% respectively.The validation results on two datasets showed that the accuracy of the proposed method was more than 5% higher than that of the existing FedAvg aggregation algorithm,and the accuracy was 8% higher than that of the existing FedAvg aggregation algorithm in the case of data poisoning attack.Moreover,it could prevent attackers from using the management network to detect background vulnerabilities to launch remote attacks on the control network and reduce the attack surface.

Key words: industrial control systems, business behavior detection, federal learning, data poisoning, attack filtering

摘要： 工业互联网时代,不同厂商希望通过共享本地数据得到更完善的安全检测模型,但接入互联网后本地数据更易遭到窃取,而联邦学习可以通过交换模型参数的方式达到数据隐私保护和共享的目的。现有针对工业计算机的安全检测方法还存在一些缺陷:①很少考虑从业务行为方面提取特征模型;②难以解决本地数据被篡改而导致的模型偏移问题;③检测系统前端检测、后端分析的网络结构会增加从后端管理网到前端控制网之间的通信通道,从而给管理网引入新的攻击路径。针对上述问题,提出基于联邦学习的工控机业务行为分布式安全检测方法,包括工控机业务行为特征检测方法、基于信息熵分配权重的联邦学习模型聚合方法、基于转发硬件的数据传输重构方法;能够提高针对工控应用协议的攻击识别准确率,减轻工业控制计算机数据污染导致的模型偏移,防止攻击者利用管理网的分析后台进行远程攻击;实现了原型系统,并在卷接设备控制系统中进行了实验验证,与采用非业务行为建模的相关方法相比,所提方法对中间人攻击和远程攻击检测准确率分别提高了17%和24%;在自有和公开数据集上的验证结果表明,方法比常用的3种聚合算法的准确率提高了0.6%~2.4%,遭到数据毒化攻击后,所提方法准确率下降为0.6%和1.1%,而其他算法下降了1.1%~7.5%和1.5%~4.5%;并能够防止攻击者利用管理网检测后台漏洞发起向控制网的远程攻击,减小攻击面。

关键词: 工业控制系统, 业务行为检测, 联邦学习, 数据毒化, 攻击过滤