A new intrusion detection model for industrial control system based on hierarchical interval-based BRB

Abstract

Because the flow data generated by industrial control networks have the characteristics of large quantity, large feature dimension, and obvious class imbalance, the traditional industrial control intrusion detection model has difficulty accurately identifying attack flow. To solve the above problems, a hierarchical interval-based belief rule base (HIBRB) model has been proposed in this paper, which can improve the detection rate of attack flow while maintaining high accuracy. First, interval-based BRB (IBRB) model is used as the basic model to solve the problem that too many antecedent attributes will lead to combinatorial explosion. By changing reference points into reference intervals and conjunctive to disjunctive in IF-THEN rules, the number of rules can be effectively reduced, and expert knowledge can be involved. Second, to solve the problem of class imbalance, a two-layer BRB structure is used for modeling. In the first layer, a main model (main-IBRB) is used for multiclassification to determine the possible class of samples. In the second layer, the sub model (sub-IBRB) is used for binary classification to obtain the final class. To improve the performance of the whole model, XGBoost is used to select the optimal feature subset for main-IBRB and each sub-IBRB according to the different classification targets. Through two-layer BRB structure and XGBoost feature selection, HIBRB can effectively alleviate the class imbalance problem and improve the detection rate of attack flow. Finally, the intrusion detection model is established by using the data set of the natural gas pipeline control system, and the validity of this model is verified.