关键词: 工业控制系统, 网络安全, 迁移学习, 门控循环单元, 异常检测

Abstract: With the continuous improvement of the informatization of industrial control networks， industrial control networks have gradually become more open， which on the one hand provides convenience for industrial production， but also brings security risks on the other hand. As an important infrastructure， the industrial control network will cause serious damage once it is attacked. In recent years， scholars have used network anomaly detection technology to discover potential security risks in industrial control networks， and have achieved great results. However， the data in the industrial control network often lack labels， which limits the application of traditional supervised learning algorithms in the field of industrial control network security. Algorithms based on unsupervised learning can detect anomalies in scenarios of lacking labels， but there is often a problem of poor algorithm performance， while transfer learning algorithms can get a better result by migrating to the target domain with only a few labels after learning on the source domain. In order to further improve the performance of anomaly detection in industrial control networks with few labels， this paper proposes a dynamic transfer method based on sensitivity in industrial control network anomaly detection. First of all， the algorithm is based on the idea of  transfer learning， which is trained in the labeled source domain and then migrated to the target domain with a small number of labels， which can detect anomalies in the industrial control network environment with only a few labels. Secondly， benefits from the memory effect of the GRU structure， the algorithm can effectively utilize the inherent time-series correlation of industrial control network data， which further improves the ability of algorithm anomaly detection. At the same time， the method of dynamic transfer of parameters based on parameter sensitivity factor in the algorithm improves the insufficiency of the traditional transfer learning fine-tuning method for the unbalanced learning of the underlying features of the source domain and target domain data. The comparative experiments on the KDD99 dataset and the Kyoto2016 dataset show that the dynamic transfer learning method based on the sensitivity factor adopted by the algorithm has a better effect than the traditional fine-tuning method. In comparison with the latest series of unsupervised and transfer learning algorithms， the algorithm outperforms the comparison methods in precision， recall， and comprehensive F1 score， achieving excellent performances of 0.97， 0.95， and 0.96.

Key words: industrial control system, network security, transfer learning, gated recurrent unit, anomaly detection