Abstract:Network anomaly detection technology has become the focus of research in the field of intrusion detection. However, because most of the current network anomaly detection remains at a single point of network anomaly detection, it cannot respond quickly and timely to joint anomaly attacks and malware that are constantly updated. In this study, a industrial control network anomaly detection algorithm based on graph neural network is proposed, which combines the network node’s own attributes and the information of neighbor nodes in the network topology to realize the network anomaly detection. First, each network node obtains a state vector that contains the feature information of the connected nodes and the interaction information between the nodes. Second, each node uses the fixed point theory to iteratively update the network. Thirdly, according to the node’s own information and neighbor node’s information, extract higher-level features through the neural network as the representation of the node. Finally, clustering is used to detect the abnormal behavior of industrial control network nodes. Experimental results show that the algorithm proposed in this study has high detection rate and high robustness.