Mining safety event in industrial control network based on the Long-Short Term Memory Networks

With the development of the Internet, there are more and more security incidents in the current industrial control network environment. These network security events are often stored in log, which play a significant role on early warning and mining loophole. The diversity of the industrial network make anomaly detection become more complicated. In the current research, few studies have been focused on the context information in the industrial network containing normal data as well as abnormal. When normal data contains abnormal pattern, there will be a higher reconstruction error causing higher false negative rate and higher false positive rate. In order to solve this problem, we propose a multilayer Long-Short Term Memory Networks (LSTM) is used to learn the representations of sequence logs from the context, which can take the past and the future into account and incorporate syntactical and semantical constraints. Firstly, an encoder LSTM try to get the fixed length representations of data. Secondly, a decoder LSTM is used to reconstruct the input sequence based on the fixed length features. Finally, a classification model called Linear Discriminant Analysis (LDA) can detect anomalies using those fixed length features. The experimental results show that sequence feature can effectively distinguish normal data and abnormal data, which can be applied in industrial system.