Method for detecting malicious attacks based on deep learning in traffic cyber physical system

A method for detecting a malicious attack based on deep learning in a transportation cyber-physical system (TCPS), comprising:

• 1) extraction of features of data flow from a TCPS
• collecting malicious data flow and normal data flow from a TCPS, organizing the collected malicious data flow and the normal data flow into a general network frame format, removing irrelevant data, extracting features related to malicious attacks, and dividing the features, according to a frame structure, into bytes as original feature data;
• 2) cleaning and encoding of the original feature data obtained in step 1
• cleaning the original feature data in step 1 to remove meaningless data and process missing data;
• encoding the cleaned feature data into classification values using one-hot encoding to construct a feature vector table;
• 3) selection of key features from the feature data obtained in step 2
• according to feature importance in a random forest model, selecting key features that distinguish a malicious attack behavior from a normal behavior;
• dividing the selected key features into labeled data and unlabeled data to serve as training data of a deep learning model;
• 4) learning of the key features obtained in step 3 to establish the deep learning model
• i) performing a pre-training process without supervision of a Restriction Boltzmann Machine (RBM):
• initializing RBM layers according to the number of layers or neurons of the RBM;
• inputting the unlabeled data obtained in step 3 into the RBM;
• individually training the RBM layer by layer without supervision;
• after fully trained, outputting a trained RBM layer as an input of a next RBM layer, and then training the next RBM layer;
• repeating the training until all training data are fully learned;
• wherein the training process without supervision is as follows:
• feature vectors are sampled using Contrastive Divergence with k steps (CD-k) without supervision, and RBM parameters are updated;
• an RBM training error is evaluated using mean square error (MSE);
• gradient descent algorithm (SGD) is used to perform multiple iteration until RBM training meets a requirement or a training period ends;
• and
• ii) performing a fine-tuning process using back propagation (BP) algorithm with supervision:
• inputting an output of a last layer of RBM to a BP fine-tuning network;
• inputting the labeled data obtained in step 3, and fine-tuning the deep learning model using the BP algorithm, reversely adjusting a weight of the BP fine-tuning network by a feedback mechanism of the BP fine-tuning network until an optimal model is obtained;
• wherein
• each of hidden layers is calculated using the BP algorithm to obtain an output of each of the hidden layers;
• an error of the BP algorithm is calculated by taking a Softmax layer as an output layer and Cross-Entropy as a cost function, if there is an error, the error is reversely transmitted from the output layer to an input layer, and a weight of the neurons is adjusted;
• a total error is repeatedly iterated using gradient descent algorithm (SGD) until the total error meets a requirement or a training period ends;
• 5) inputting unknown behavior data to be identified into the deep learning model trained in step 4 to perform feature recognition, finally mapping the output of the deep learning model into an interval of 0-1 using a Softmax classifier of the output layer to obtain various types of probabilities, determining whether a category with a maximum probability is a malicious sample or a normal sample, and if the number of the malicious samples predicted is greater than 1, indicating that the malicious attack exists in the unknown behavior data.