Power Encoding Transmission Intrusion Detection Method Based on Convolutional Autoencoders-XGBoost

The traditional rule-based and signature-based methods for detecting malicious files face significant challenges in modern cybersecurity, especially when attackers encode or encrypt transmitted files, thus evading most machine learning detection techniques. To address security threats in scenarios involving encoded transmissions in power industrial control systems, this paper proposes an intrusion detection method based on Convolutional Autoencoders (CAE) and Extreme Gradient Boosting (XGBoost). First, a CAE network structure is unsupervisedly trained using a large number of normal business-encoded files, solidifying the encoder model of the CAE. Subsequently, the encoder automatically extracts deep features from all samples. Data augmentation techniques are then employed to rebalance the feature vectors, enhancing the classification model's ability to recognize minority class samples. Finally, the XGBoost model is utilized for classification training, solidifying the detection model. During the detection phase, this method accurately and efficiently identifies high-risk objects hidden within normal encoded files, such as binary executable files, scripts, and dynamic link libraries. Experimental results indicate that the proposed method achieves a detection accuracy of 98.7% in complex encoded transmission scenarios, with a macro-average recall rate of 95.2%, outperforming all comparison algorithms and effectively enhancing network security capabilities.