Globally, the external Internet is increasingly being connected to the contemporary industrial control system. As a result, there is an immediate need to protect the network from several threats. The key infrastructure of industrial activity may be protected from harm by using an intrusion detection system (IDS), a preventive measure mechanism, to recognize new kinds of dangerous threats and hostile activities. The most recent artificial intelligence (AI) techniques used to create IDS in many kinds of industrial control networks are examined in this study, with a particular emphasis on IDS-based deep transfer learning (DTL). This latter can be seen as a type of information fusion that merge, and/or adapt knowledge from multiple domains to enhance the performance of the target task, particularly when the labeled data in the target domain is scarce. Publications issued after 2015 were taken into account. These selected publications were divided into three categories: DTL-only and IDS-only are involved in the introduction and background, and DTL-based IDS papers are involved in the core papers of this review. Researchers will be able to have a better grasp of the current state of DTL approaches used in IDS in many different types of networks by reading this review paper. Other useful information, such as the datasets used, the sort of DTL employed, the pre-trained network, IDS techniques, the evaluation metrics including accuracy/F-score and false alarm rate (FAR), and the improvement gained, were also covered. The algorithms, and methods used in several studies, or illustrate deeply and clearly the principle in any DTL-based IDS subcategory are presented to the reader.
翻译:全球范围内,外部互联网正日益连接至现代工业控制系统。因此,亟待保护网络免受多种威胁侵害。工业活动的关键基础设施可通过部署入侵检测系统这一预防性机制来规避风险,该系统能够识别新型危险威胁与恶意行为。本研究重点考察了近年应用于各类工业控制网络中的最先进人工智能技术,尤其聚焦于基于深度迁移学习的入侵检测系统。深度迁移学习可视为一种信息融合方式,通过整合和/或适配多领域知识提升目标任务性能,尤其在目标域标注数据稀缺时效果显著。本研究纳入2015年之后发表的文献,将所选文献划分为三类:深度迁移学习专用与入侵检测系统专用文献归入引言与背景部分,而基于深度迁移学习的入侵检测系统相关论文则作为本综述的核心文献。通过本文,研究者可更全面掌握当前不同网络类型中深度迁移学习方法在入侵检测系统中的应用现状。此外,本文还综述了数据集类型、所用深度迁移学习范式、预训练网络架构、入侵检测技术、评估指标(包括准确率/F值及误报率)以及性能提升幅度等实用信息。针对多项研究采用的算法与方法,或对任一基于深度迁移学习的入侵检测系统子类别的原理进行深入清晰的阐释,本文均予以详细呈现。