IIoT (Industrial Internet of Things) has gained considerable attention and has been increasingly applied due to its ubiquitous sensing and communication. However, the sparse characteristic of sensing data in distributed IIoT networks may bring out tremendous challenges to implement the security protection measures. Based on the design of centralized data gathering and forwarding, this paper proposes a novel anomaly detection approach for IIoT sparse data, which can successfully collaborate the adaptive CEEMDAN (Complete Ensemble Empirical Mode Decomposition with Adaptive Noise) feature exploitation with one intelligent optimizing classification. Furthermore, in the adaptive CEEMDAN feature exploitation, the CEEMDAN energy entropy based on adaptive IMF (Intrinsic Mode Function) selection is designed to extract the sensing features from IIoT sparse data; in the intelligent optimizing classification, one effective OCSVM (One-Class Support Vector Machine) classifier optimized by the IABC (Improved Artificial Bee Colony) swarm intelligence algorithm is introduced to detect various abnormal sensing features. The experimental results show that, not only does the CEEMDAN energy entropy based on adaptive IMF selection accurately describe the change of industrial production by analyzing the probability distribution and energy distribution of sparse sensing data, but also the proposed IABC-OCSVM classifier has higher detection efficiency compared with the OCSVM classifiers optimized by other swarm intelligence algorithms.

In process industries, the characteristics of industrial activities focus on the integrality and continuity of production process, which can contribute to excavating the appropriate features for industrial anomaly detection. From this perspective, this paper proposes a novel state-based control feature extraction approach, which regards the finite control operations as different states. Furthermore, the procedure of state transition can adequately express the change of successive control operations, and the statistical information between different states can be used to calculate the feature values. Additionally, OCSVM (One Class Support Vector Machine) and BPNN (BP Neural Network), which are optimized by PSO (Particle Swarm Optimization) and GA (Genetic Algorithm) respectively, are introduced as alternative detection engines to match with our feature extraction approach. All experimental results clearly show that the proposed feature extraction approach can effectively coordinate with the optimized classification algorithms, and the optimized GA-BPNN classifier is suggested as a more applicable detection engine by comparing its average detection accuracies with the ones of PSO-OCSVM classifier.

Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has achieved modest accomplishments in industrial cyber security. However, a significant issue is how to effectively extract industrial control features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to establish a serviceable detection engine, a dynamic adjusting ABC-SVM (Artificial Bee Colony - Support Vector Machine) anomaly detection model is also developed. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of functional control behavior in process operations, and the improved ABC-SVM anomaly detection model can improve the detection ability by comparing with other anomaly detection engines.

Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has won significant accomplishments in industrial cyber security. However, a crucial issue is how to effectively extract industrial communication features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to design a serviceable detection engine, a dynamic adjusting ABC–SVM (Artificial Bee Colony–Support Vector Machine) anomaly detection model based on double mutations is also developed to identify abnormal behaviors in industrial control communications. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of function control behavior in industrial control communications, and the improved ABC–SVM anomaly detection model can strengthen the detection performance by comparing with other anomaly detection engines.

工业互联网正保持着活跃地创新发展态势,其强调以物理网络为基础的万物互联互通,因此在这种新模式下,工业信息安全将面临严峻的挑战.本文首先以历年代表性的工业安全事件为例,说明了现阶段工业控制系统所面临的安全问题以及威胁形式,并在此基础上给出了工业互联网建设时所应重点考虑的安全脆弱性,然后重点论述了人工智能(AI,Artificial Intel igence)算法在工业入侵检测中的应用以及分类,分析了每类方法的优势与不足,并提出了全互联互通模式下工业AI入侵检测方法的研究重点.