Multi-stage ARSVAE-based Detection Framework for DDoS Attack of Cyber-Energy System in Industrial Park

The informatization of industrial parks increases the risk of the cyber-energy system (CES) attacked by hackers, which affects the security and stability of the production process. Among all kinds of the network attacks, distributed denial of service (DDoS) attack is one of the main threats to the CES, which may occupy the bandwidth and the memory resources a lot so as to destroy the normal running mode of the local host. In this study, a detection framework based on multi-stage adaptive recycling skip variational auto-encoder (MARSVAE) is proposed for CES under the condition of unbalanced data. To extract the probabilistic feature in the first stage, an improved variational auto-encoder based on skip structure with adaptive parameters and recycling structure (ARSVAE) is designed to improve the convergence speed. Then, ARSVAE is presented to solve the problem of imbalanced features representation for identifying anomalies at the second stage. Experiments by employing four public datasets indicate that the proposed MARSVAE is capable of reducing false alarm rate and achieving a detection precision of more than 99%.