针对工控系统入侵检测数据不平衡及特征冗余的问题，提出一种融合代价敏感神经网络和集成算法的新型入侵检测模型。通过结合卷积神经网络（convolutional neural network, CNN）与长短期记忆网络（long short-term memory, LSTM）提取最优时空特征子集，避免在大量不必要数据中失焦；提出一种引入双重交叉熵的代价敏感深度神经网络（cost-sensitive deep neural network, CSEDNN）识别异常流量，通过自适应增强（AdaBoost）算法将其分为正常类、不同的多数攻击类和所有少数攻击类的单一类，减少类别之间固有的不平衡，使用逻辑回归（logistic regression, LR）算法将以上识别出的少数攻击进行多分类。在UNSW-NB15和NSL-KDD进行实验，其准确率和误报率分别为96.1%和5.90%。在辽宁省石油化工行业信息安全重点实验室攻防演练平台采集的数据集上进行验证，准确率和误报率均优于其他入侵检测方法，结果表明该模型在识别网络入侵并进行分类方面具有科学性和有效性。

A novel intrusion detection model combining cost sensitive neural networks and ensemble algorithms was proposed to address the issue of poor performance in identifying rare minority attacks in industrial control systems, with an excessive focus on accuracy and neglecting false alarms. The model was divided into three layers. In the first layer, the optimal spatiotemporal feature subset was extracted by combining convolutional neural network (CNN) and long short-term memory (LSTM) to avoid defocusing in a large amount of unnecessary data. A dual cross entropy cost sensitive deep neural network (CSEDNN) was proposed to divide samples into normal traffic and abnormal traffic. In the second layer, the AdaBoost algorithm was used to classify the abnormal traffic identified in the first layer into normal classes, different majority attack classes, and a single class of all minority attack classes, reducing the inherent imbalance between categories. In the third layer, logistic regression (LR) was used to classify the identified few attacks into multiple categories. Its accuracy and false alarm rate reaches 96.1% and 5.90%, respectively. By comparing the performance with other existing models on the UNSW-NB15 dataset, it was found that the model optimizes both false positive and false negative rates while ensuring accuracy. The results show that the model can accurately and efficiently identify network intrusions and classify them.