融合注意力机制和BSRU的工业互联网安全态势预测方法

doi:10.11959/j.issn.2096-109x.2021092

摘要/Abstract

摘要：

安全态势预测对确保工业互联网平稳可靠运行至关重要。传统的预测模型在面对工业生产过程中产生的海量、高维和时间序列数据时，难以准确、高效地对网络安全态势进行预测，因此提出一种融合注意力机制和双向简单循环单元（BSRU，bi-directional simple recurrent unit）的工业互联网安全态势预测方法，以满足工业生产的实时性和准确性要求。对各安全要素进行分析和处理，使其能反映当前网络状态，便于态势值的求取。使用一维卷积网络提取各安全要素之间的空间维度特征，保留特征间的时间相关性。利用BSRU网络提取信息之间的时间维度特征，减少历史信息的丢失，同时借助 SRU 网络强大的并行能力，减少模型的训练时间。引入注意力机制优化 BSRU 隐含状态中的相关性权重，以突出强相关性因素，减少弱相关性因素的影响，实现融合注意力机制和BSRU的工业互联网安全态势预测。对比实验结果显示，该模型较使用双向长短期记忆网络和双向门控循环单元的预测模型，在训练时间和训练误差上分别减少了 13.1%和 28.5%；相比于没有使用注意力机制的卷积和BSRU网络融合模型，训练时间虽增加了2%，但预测误差降低了28.8%；在不同预测时长下该模型的预测效果优于其他模型，实现了在时间性能上的优化，使用注意力机制在增加少量时间成本的前提下，提升了模型的预测精度，能够较好地拟合网络安全态势发展，且模型在多步预测上存在一定的优势。

关键词: 工业互联网, 注意力机制, 简单循环单元, 安全态势

Abstract:

The security situation prediction plays an important role in balanced and reliable work for industrial internet.In the face of massive, high-dimensional and time-series data generated in the industrial production process, traditional prediction models are difficult to accurately and efficiently predict the network security situation.Therefore, the methods of security situation prediction for industrial internet fused attention mechanism and bi-directional simple recurrent unit (BSRU) were proposed to meet the real-time and accuracy requirements of industrial production.Each security element was analyzed and processed, so that it could reflect the current network state and facilitate the calculation of the situation value.One-dimensional convolutional network was used to extract the spatial dimension features between each security element and preserve the temporal correlation between features.The BSRU network was used to extract the time dimension features between the data information and reduced the loss of historical information.Meanwhile, with the powerful parallel capability of SRU network, the training time of model was reduced.Attention mechanism was introduced to optimize the correlation weight of BSRU hidden state to highlight strong correlation factors, reduced the influence of weak correlation factors, and realized the prediction of industrial internet security situation combining attention mechanism and BSRU.The comparative experimental results show that the model reduces the training time and training error by 13.1% and 28.5% than the model using bidirectional long short-term memory network and bidirectional gated recurrent unit.Compared with the convolutional and BSRU network fusion model without attention mechanism, the prediction error is reduced by 28.8% despite the training time increased by 2%.The prediction effect under different prediction time is better than other models.Compared with other prediction network models, this model achieves the optimization of time performance and uses the attention mechanism to improve the prediction accuracy of the model under the premise of increasing a small amount of time cost.The proposed model can well fit the trend of network security situation, meanwhile, it has some advantages in multistep prediction.

Key words: industrial internet, attention mechanism, simple recurrent unit, security situation

中图分类号:

TP391

胡向东, 田正国. 融合注意力机制和BSRU的工业互联网安全态势预测方法[J]. 网络与信息安全学报, 2022, 8(1): 41-51.

Xiangdong HU, Zhengguo TIAN. Methods of security situation prediction for industrial internet fused attention mechanism and BSRU[J]. Chinese Journal of Network and Information Security, 2022, 8(1): 41-51.

图/表 15

图1

表1

表2

图2

图3

图4

图5

图6

表3

图7

图8

图9

表4

图10

图11

参考文献 22

[1]	LIU X , YU J , LV W ,et al. Network security situation:from awareness to awareness-control[J]. Journal of Network and Computer Applications, 2019,139: 15-30.
[2]	WU J , OTA K , DONG M ,et al. Big data analysis-based security situational awareness for smart grid[J]. IEEE Transactions on Big Data, 2016,4(3): 408-417.
[3]	LIANG W , LONG J , CHEN Z ,et al. A security situation prediction algorithm based on HMM in mobile network[J]. Wireless Communications ＆ Mobile Computing, 2018,2018: 1-11.
[4]	HU J , Ma D , LIU C ,et al. Network security situation prediction based on MR-SVM[J]. IEEE Access, 2019,7: 130937-130945.
[5]	谢丽霞, 王亚超, 于巾博 . 基于神经网络的网络安全态势感知[J]. 清华大学学报(自然科学版), 2013,53(12): 1750-1760.
	XIE L X , WANG Y C , YU J B . Network security situation awareness based on neural networks[J]. Journal of Tsinghua University(Science and Technology), 2013,53(12): 1750-1760.
[6]	ZHANG H , HUANG Q , LI F ,et al. A network security situation prediction model based on wavelet neural network with optimized parameters[J]. Digital Communications and Networks, 2016,2(3): 139-144.
[7]	XIAO P , XIAN M , WANG H . Network security situation prediction method based on MEA-BP[C]// 2017 3rd International Conference on Computational Intelligence ＆ Communication Technology (CICT). IEEE, 2017: 1-5.
[8]	杨宏宇, 张旭高 . 基于自修正系数修匀法的网络安全态势预测[J]. 通信学报, 2020,41(5): 196-204.
	YANG H Y , ZHANG X G . Self-corrected coefficient smoothing method based network security situation prediction[J]. Journal on Communications, 2020,41(5): 196-204.
[9]	张任川, 张玉臣, 刘璟 ,等. 应用改进卷积神经网络的网络安全态势预测方法[J]. 计算机工程与应用, 2019,55(6): 86-93.
	ZHANG R C , ZHANG Y C , LIU J ,et al. Network security situation prediction method using improved convolution neural network[J]. Computer Engineering and Applications, 2019,55(6): 86-93.
[10]	LI Y , LIU B , ZHANG L ,et al. Fast trajectory prediction method with attention enhanced SRU[J]. IEEE Access, 2020,8: 206614-206621.
[11]	LUONG M T , PHAM H , MANNING C D . Effective approaches to attention-based neural machine translation[J]. arXiv preprint arXiv:1508.04025, 2015.
[12]	丁华东, 许华虎, 段然 ,等. 基于贝叶斯方法的网络安全态势感知模型[J]. 计算机工程, 2020,46(6): 130-135.
	DING H D , XU H H , DUAN R ,et al. Network security situation awareness model based on bayesian method[J]. Computer Engineering, 2020,46(6): 130-135.
[13]	程家根 . 基于机器学习的网络安全态势感知模型研究与实现[D]. 南京邮电大学, 2020.
	CHENG J G . Research and implementation of network security situation awareness model based on machine learning[D]. Nanjing:Nanjing University of Posts and Telecommunications, 2020.
[14]	CHERDANTSEVA Y , BURNAP P , BLYTH A ,et al. A review of cyber security risk assessment methods for SCADA systems[J]. Computers ＆ security, 2016,56: 1-27.
[15]	HUANG K , ZHOU C , TIAN Y C ,et al. Assessing the physical impact of cyberattacks on industrial cyber-physical systems[J]. IEEE Transactions on Industrial Electronics, 2018,65(10): 8153-8162.
[16]	LEI T , ZHANG Y , WANG S I ,et al. Simple recurrent units for highly parallelizable recurrence[J]. arXiv preprint arXiv:1709.02755, 2017.
[17]	ZILLY J G , SRIVASTAVA R K , KOUTNIK J ,et al. Recurrent highway networks[C]// International Conference on Machine Learning. 2017: 4189-4198.
[18]	CNCERT. 2017年至2020年网络安全信息与动态周报[EB].
	CNCERT. Network security information and trends weekly report from 2017 to 2020[EB].
[19]	BOCK S , WEI? M ,, . A proof of local convergence for the Adam optimizer[C]// 2019 International Joint Conference on Neural Networks (IJCNN). IEEE, 2019: 1-8.
[20]	KHWAJA A , ZHANG X , ANPALAGAN A ,et al. Boosted neural networks for improved short-term electric load forecasting[J]. Electric Power Systems Research, 2017,143: 431-437.
[21]	ZENG L , REN W , SHAN L J N . Attention-based bidirectional gated recurrent unit neural networks for well logs prediction and lithology identification[J]. Neuro Computing, 2020,414: 153-171.
[22]	MUNKHDALAI L , MUNKHDALAI T , PARK K H ,et al. An end-to-end adaptive input selection with dynamic weights for forecasting multivariate time series[J]. IEEE Access, 2019,7: 99099-99114.

一级指标	二级指标
	攻击事件的数量
威胁性	攻击事件的等级
	攻击事件发生频率
	系统安全漏洞数量、级别
脆弱性	设备安全漏洞数量、级别
	是否存在补丁
	受攻击设备数量
资产价值	设备提供的服务、运行信息
	系统信息资产的评估价值

态势值	危险级别	说明

(0,0.2]	1（安全）	运行正常，网络中没有严重的安全威胁
(0.2,0.4]	2（轻度危险）	受轻微影响，安全威胁增加，损失较小
(0.4,0.5]	3（危险）	受较大影响，出现重大故障的可能性较高
(0.5,0.6]	4（中度危险）	受到攻击比较严重，关键基础设施受影响
(0.6,0.75]	5（高度危险）	存在大量网络威胁，会导致重大危险
(0.75,1.0]	6（红色警报）	威胁危险等级高，数量多，会导致严重事件

预测模型	MAE	RMSE	MAPE
Attention-BSRU	0.018 3	0.022 1	3.780 1%
CNN	0.032 1	0.036 3	6.524 8%
SRU	0.030 9	0.033 2	6.376 6%
BLSTM	0.028 9	0.034 9	6.108 6%
BP	0.033 8	0.039 3	6.978 5%
SVM	0.058 3	0.072 4	12.895 5%

预测模型	MAE	RMSE	MAPE	时间/s
Attention-BLSTM	0.026 6	0.030 2	5.610 3%	510.913 6
Attention-BGRU	0.025 6	0.030 2	5.354 9%	462.312
Attention-BSRU	0.018 3	0.022 1	3.780 1%	401.663 7
CNN-BSRU	0.025 7	0.032 7	5.185 3%	393.638 9
AIS-LSTM	0.037 8	0.044 6	7.553 3%	864.448 2