Abstract: Industrial control systems are faced with severe security threats. Machine learning-based intrusion detection technology relies on a large amount of labeled data. However, industrial control systems lack labeled data and have many communication protocols. Data under different communication protocols are not universal. To solve the above problems, a timing-sensitive cross-protocol domain confusion industrial control intrusion detection model（TCPDC） is proposed. The model uses the domain confusion technique of transfer learning to minimize the distribution difference of traffic data under different communication protocols, transfer the knowledge learned under the old communication protocol to the new communication protocol, and only use a small amount of unknown information under the new communication protocol. By labeling the data, a high-accuracy intrusion detection model can be constructed. In addition, in order to achieve fine-grained identification of attack data, the model uses the long short-term memory（LSTM） algorithm to extract the time-series features of traffic data to detect more stealthy attacks. TCPDC evaluates the performance on the Electra dataset, and the experimental results demonstrate the feasibility and effectiveness of transfer learning in building intrusion detection models across protocols.

Key words: transfer learning, intrusion detection, industrial control system, long short-term memory network

摘要： 工业控制系统面临着严峻的安全威胁，基于机器学习的入侵检测技术依赖大量的标注数据，但工业控制系统标注数据匮乏且通信协议众多，不同通信协议下的数据不通用。为了解决上述问题，提出了一种时序敏感的跨协议域混淆工控入侵检测模型（timing-sensitive cross-protocol domain confusion industrial control intrusion detection model，TCPDC）。该模型利用迁移学习的域混淆技术最小化不同通信协议下流量数据的分布差异，把在旧的通信协议下学习到的知识迁移到新的通信协议下，仅利用新的通信协议下的少量未标注数据，即可构建出高准确率的入侵检测模型。除此之外，为了实现攻击数据的细粒度识别，该模型利用长短期记忆网络（long short-term memory，LSTM）算法提取流量数据的时间序列特征，以检测更加隐蔽的攻击。TCPDC在Electra数据集上评估性能，实验结果证明了迁移学习在跨协议构建入侵检测模型方面的可行性和有效性。

关键词: 迁移学习, 入侵检测, 工业控制系统, 长短期记忆网络