In industrial control systems, industrial infrastructure is often attacked by hackers. Due to the serious sample imbalance in industrial control data, the traditional machine learning method has poor performance in anomaly detection. In this paper, TrAdaboost algorithm is applied to industrial control anomaly detection. The samples that are easy to classify are taken as the source domain data, and the samples with poor classification effect are taken as the target domain. The source domain data is used to guide the target domain data training. Then, we improve the traditional TrAdaboost algorithm from two aspects of initial weight and final classifier, and apply it to industrial control anomaly detection. Finally, the performance of the algorithm on two different industrial control data sets is verified. And the improved algorithm is compared with other traditional algorithms. The experimental results show that the improved TrAdaboost algorithm has a significant advantage in predicting categories with a small sample size. This algorithm can accurately identify a few abnormal samples. Moreover, the F1 value, recall and precision value of the improved TrAdaboost algorithm on the two data sets have been significantly improved. This indicates that the improved TrAdaboost algorithm greatly improves the overall prediction accuracy of the model.

在工业控制系统中，工业基础设施经常受到黑客的攻击。由于工控数据样本严重不平衡，传统的机器学习方法在异常检测方面表现不佳。本文将TrAdaboost算法应用于工控异常检测。将易于分类的样本作为源域数据，将分类效果较差的样本作为目标域。源域数据用于指导目标域数据训练。然后，我们从初始权重和最终分类器两个方面对传统的 TrAdaboost 算法进行改进，并将其应用于工业控制异常检测。最后，验证了算法在两个不同的工控数据集上的性能。并将改进后的算法与其他传统算法进行比较。实验结果表明，改进的TrAdaboost算法在小样本量的类别预测中具有显着优势。该算法可以准确识别少数异常样本。而且，改进后的TrAdaboost算法在两个数据集上的F1值、召回率和精度值都得到了显着提升。这表明改进后的 TrAdaboost 算法大大提高了模型的整体预测精度。改进后的 TrAdaboost 算法在两个数据集上的召回率和准确率值得到了显着提高。这表明改进后的 TrAdaboost 算法大大提高了模型的整体预测精度。改进后的 TrAdaboost 算法在两个数据集上的召回率和准确率值得到了显着提高。这表明改进后的 TrAdaboost 算法大大提高了模型的整体预测精度。