计算机与现代化

• 信息安全 • 上一篇    下一篇

基于深度Q网络的电力工控网络异常检测系统

  

  1. (华北电力大学,北京102206)
  • 收稿日期:2019-04-30 出版日期:2019-12-11 发布日期:2019-12-11
  • 作者简介:王竹晓(1981-),男,四川自贡人,讲师,博士,研究方向:自治愈技术,智能电网Cyber-Physical系统安全,E-mail: wzx@ncepu.edu.cn; 张彭彭(1994-),男,河南商丘人,硕士研究生,研究方向:网络信息安全,E-mail: 1069789277@qq.com; 李为(1967-),女,教授,硕士,研究方向:智能电网软件技术,电力信息安全; 吴克河(1962-),男,教授,博士,研究方向:智能电网软件技术,电力信息安全; 崔文超(1983-),男,讲师,博士,研究方向:信息安全和电力信息化; 程瑞(1989-),男,博士研究生,研究方向:信息安全和电力信息化。
  • 基金资助:
    国家电网公司科技项目(521304190004)

Electric Power Industrial Control Network Anomaly Detection #br# System Based on Deep Q Network

  1. (North China Electric Power University, Beijing 102206, China)
  • Received:2019-04-30 Online:2019-12-11 Published:2019-12-11

摘要: 电力是指以电能作为动力的能源,完整的电力系统包括发电、输电、变电、配电和用电等环节。电力是关系国计民生的基础产业,电力供应和安全事关国家安全战略,事关经济社会发展全局。工业自动化和控制系统(简称“工控”)作为电力的感官和中枢神经系统,确保其网络安全,使其始终处于稳定可靠运行状态,对于保障电力安全运营至关重要。由于大部分网络都是高度互联的,因此都易受到网络攻击的威胁。虽然基于网络的入侵检测系统可以将入侵警告和安全响应进行很好的结合,但是随着技术的不断发展,攻击变得越来越普遍且难以检测,其中逃逸技术就是这类技术的一个代表,它可以通过伪装修改网络数据流以此来逃避入侵检测系统的检测。结合所学知识和电力工控网络的特点,提出一种基于深度强化学习的电力工控网络入侵检测系统,深度强化学习的算法融合神经网络和Q-learning的方法来对网络中的异常现象进行训练,通过训练使系统能及时地检测出入侵行为并发出警告。

关键词: 电力工控网络, 网络入侵, 神经网络, DQN

Abstract: Electricity refers to energy powered by electrical energy. The complete power system includes power generation, transmission, substation, power distribution and power consumption. Electricity is a basic industry that affects the national economy and the people’s livelihood. Power supply and security are related to national security strategies and are related to the overall situation of economic and social development. Industrial automation and control systems (referred to as “industrial control”) as the sensory and central nervous system of electricity, to ensure their network security, so that it is always in a stable and reliable state of operation, is essential to ensure safe operation of electricity. Because most networks are highly interconnected, they are vulnerable to cyber attacks. Although network-based intrusion detection systems can combine intrusion warnings and security responses well, as technology continues to evolve, attacks become more common and difficult to detect, and escape technology is a representative of such technologies. It can evade detection by the intrusion detection system by masquerading the network data stream. Combining with the knowledge and the characteristics of the power industrial control network, a power industrial network intrusion detection system based on deep reinforcement learning is proposed. The deep reinforcement learning algorithm combines the neural network and Q-learning methods into the network. The anomaly is trained to enable the system to detect intrusions and issue warnings in a timely manner.

Key words: electric power industrial control network, network intrusion, neural network, DQN

中图分类号: