An Intrusion Detection Method Combining Coarse and Fine Classification for Industrial Internet

With the popularization of applications, the industrial internet is facing increasingly serious security threats. In the complex data scenario of the industrial internet, machine learning algorithms are difficult to adapt to the problems of massive imbalanced data and low detection time efficiency. An intrusion detection method combining coarse and fine classification is proposed in this paper. Firstly, all samples are roughly classified into benign data or attack data using the Light Gradient Boosting Machine (LightGBM). Secondly, Variational Auto-Encoder is used to balance the training samples of attack data, and the Tree-structured Parzen Estimator is used to optimize the parameters of LightGBM. Finally, the optimized LightGBM is used to subdivide the attack data into specific attacks. The experimental results show that the proposed method achieves a detection accuracy of 99.92% on the CIC-IDS2017 dataset, which is 1.04% higher than that obtained by directly using LightGBM, and testing time is reduced by 69.12%.