Network traffic anomaly detection method for water conservancy industrial control systems based on deep learning

Abstract

[Objective] This study proposes a network traffic anomaly detection method that addresses the issues of data imbalance, high feature dimensionality, and low detection efficiency in water conservancy industrial control networks. The method integrates an improved Conditional Generative Adversarial Network(ICGAN), Deep Residual Shrinking Network(DRSN), and Long Short-Term Memory Network(LSTM). [Methods] ICGAN was used to construct a balanced network traffic dataset, and a DRSN-LSTM hybrid deep learning model was employed for anomaly detection in network traffic. DRSN was responsible for extracting spatial features, with residual connections addressing network degradation and overfitting issues. The compression and excitation network automatically assigned weight coefficients to each feature map to improve detection performance. Lastly, LSTM extracted temporal features from the data. [Results] The method was tested in the application scenario of the Qinhuai River Wudingmen Sluice Station. The result showed that models trained on the ICGAN-optimized dataset achieved higher traffic classification accuracy than those trained on the original dataset. Overall, DRSN-LSTM achieved an accuracy of 98.76% in detecting network traffic anomalies. P, R, and F1 values for normal data classification were 99.22%, 99.69%, and 99.46%, respectively, which outperformed the comparison models in terms of these evaluation indicators. [Conclusion] By integrating the advantages of ICGAN, DRSN, and LSTM algorithms, the anomaly detection method for water conservancy industrial network traffic effectively alleviates the type imbalance in the original dataset, improves the detection ability of abnormal industrial control network traffic, and ensures the safe and stable operation of water conservancy projects.

Keywords

water conservancy industrial control / network traffic anomaly detection / deep learning / conditional generative adversarial networks / deep residual shrinkage network / long short-term memory network / evaluation indicator