摘要： 在工业控制系统（工控）与互联网技术深度融合的背景下，有效检测系统是否受到入侵威胁成为保障工控安全的关键。根据工控网络数据高维性和非线性的特点，应用Fisher分值和核主成分分析法对网络数据进行预处理，针对支持向量机参数寻优过程中标准粒子群优化算法易陷入局部最优的问题，提出基于自适应变异的粒子群优化算法SVPSO，进而构建系统入侵检测模型。在标准数据集上的仿真结果表明，与BP神经网络、K最近邻、随机森林和朴素贝叶斯算法相比，基于SVPSO算法构建的检测模型性能较优，检测精度达到98.75%，而误报率仅为1.22%。

关键词: 工业控制系统, 入侵检测, 核主成分分析, Fisher分值, 粒子群优化算法, 支持向量机

Abstract: With the deep integration of Industrial Control System(ICS) and Internet technologies,it is important to detect system intrusion effectively for secure ICS.As network data of industrial control systems is high-dimensional and nonlinear,this paper applies Fisher score and kernel Principal Component Analysis(PCA) in preprocessing of network data.The standard Particle Swarm Optimization(PSO) algorithm tend to fall into local optimization in optimization of Support Vector Machine(SVM) parameters.To address the problem,a PSO algorithm based on Self-adaptive Mutation(SVPSO),is proposed to build a detection model for system intrusions.Simulation results on the standard dataset show that the detection model comstructed by SVPSO algorithm outperforms BPANN,KNN,random tree and naive Bayes algorithms in terms of detection performance,with the detection accuracy reaching 98.75% while the false alarm rate reduced to 1.22%.

Key words: Industrial Control System(ICS), intrusion detection, Kernel Principal Component Analysis(KPCA), Fisher score, Particle Swarm Optimization(PSO) algorithm, Support Vector Machine(SVM)

中图分类号: 

• TP309