摘要
因工业通信网带宽不断扩大,全链路承载的数据也越来越多,受不同属性数据关联关系影响,导致数据异常检测结果不精准。为此,提出了基于决策树的工业通信网全链路数据异常检测方法。根据决策树信息熵理论,选择信息增益最大属性作为分类特征,计算信息增益率。利用最小距离分割决策树计算理想划分结果与实际划分的范式距离,获取由范式距离组成的序列,以此构建异常数据检测模型。集中决策树各个特征节点,构建异常数据检测矩阵,计算目标加权关联平均值,实现对决策数据集预处理。采用标准化的处理算法训练基于决策树的检测数据,利用特征量的改变来控制通信网络波动,以此检测异常数据。由实验结果可知,该方法 IP熵值最大为0.6,与实际异常数据检测结果一致,能够有效实现数据异常精准检测。
Due to the continuous expansion of industrial communication network bandwidth,the full link carries more and more data,which is affected by the association of different attribute data,resulting in inaccurate data anomaly detection results.For this reason,a decision tree based data anomaly detection method for industrial communication network is proposed.According to the information entropy theory of decision tree,the maximum information gain attribute is selected as the classification feature to calculate the information gain rate.The minimum distance is used to partition the decision tree,calculate the normal distance between the ideal partition result and the actual partition,and obtain the sequence composed of normal distance,so as to build the anomaly data detection model.Centralize each feature node of the decision tree,construct the anomaly data detection matrix,calculate the weighted correlation average of the target,and achieve the pre-processing of the decision data set.The standardized processing algorithm is used to train the detection data based on the decision tree,and the change of the characteristic quantity is used to control the fluctuation of the communication network,so as to detect abnormal data.The experimental results show that the maximum IP entropy value of this method is 0.6,which is consistent with the actual abnormal data detection results,and can effectively achieve accurate data anomaly detection.
作者
武永强
刘正刚
WU Yongqiang;LIU Zhenggang(Xinxing Ductile Iron Pipes Co.,Ltd.,Handan 056300,China)
出处
《电子设计工程》
2024年第9期138-141,146,共5页
Electronic Design Engineering
基金
新兴铸管股份有限公司武安本级工控网网络安全建设项目(ZZCY-2022-01-01-040)。
关键词
决策树
工业通信网
全链路数据
异常检测
decision tree
industrial communication network
full-link data
anomaly detection
