Industrial equipment event detection method and equipment based on hierarchical network representation learning

Abstract

The present invention relates to a method and device for detecting industrial equipment events based on hierarchical network representation learning. The method comprises: obtaining event data to be detected, obtaining attribute representations and mapping relationships through a pre-trained hierarchical network representation learning model, thereby obtaining an event representation corresponding to the event to be detected; calculating the Euclidean distance between the obtained event representation and the cluster centers of all normal and abnormal events, and classifying the event to be detected into the cluster with the smallest distance. Compared with existing technologies, the present invention has stronger anomaly detection capabilities and robustness.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal event detection for industrial equipment, and in particular to an industrial equipment event detection method and device based on hierarchical network representation learning. Background Art

[0002] 5G and IoT technologies provide real-time data recording and collection for industrial equipment. This data is a potential source of intelligent information services. In recent years, behavioral model-based anomaly detection for industrial equipment events has become an effective approach for addressing security challenges such as network intrusion detection. Behavioral model-based anomaly detection for industrial equipment events examines the degree to which detected events match the normal behavior patterns of the equipment. This model places more stringent requirements on behavioral data than other network services. Therefore, the quality of industrial data significantly impacts the performance of subsequent models.

[0003] Unfortunately, in reality, due to unavoidable limitations such as data collection technology, privacy protection, and business characteristics, the available behavioral data for industrial devices is often of limited quality, sparse, and fragmented. This data cannot directly meet the stability and saliency requirements of behavioral models. To ensure the event security of industrial devices in Industrial Internet scenarios, it is necessary to establish effective and reliable industrial device event detection methods, especially for industrial scenarios with only low-quality behavioral data.

[0004] To enhance behavioral data, there are two common approaches: internal and external. In external augmentation, the key issue is how to leverage external knowledge from business features and expert rules. In internal augmentation, the key issue is exploring hidden associations within the data. In reality, external knowledge is often limited by the usefulness and credibility of experience. Currently, some research aims to achieve self-enhancement of data by leveraging internal associations. An inevitable challenge is how to extract essential information from high-dimensional data while discarding irrelevant information. For example, multilayer perceptrons (MLPs) have demonstrated powerful feature extraction capabilities for learning valuable information hidden within data and have achieved success in many fields, such as image recognition and natural language processing. Most current work focuses on extracting deep associations between labels and behavioral features. These approaches iteratively combine attributes of behavioral events to form highly general features. While these approaches have achieved success in behavioral data augmentation, they primarily focus on leveraging feature associations between labels without considering other information that could lead to significant improvements.

[0005] In addition, to extract more information to enhance behavioral data, other researchers are working to leverage the interactions between behavioral events, such as their sequence information, to build more effective behavioral models. For example, models based on Markov chains, convolutional neural networks, and recurrent neural networks have been used to model historical behavioral sequences, extracting more information from previous and subsequent historical events. However, low-quality behavioral data may make it impossible to build high-quality behavioral models based on data enhanced with local sequence information.

[0006] Current methods can all be summarized as extracting rich interactive information between behavioral events. Although the above methods obtain comprehensive information at the event level, they ignore the internal information of each event. Summary of the Invention

[0007] Although traditional methods obtain relatively comprehensive information at the event level, they ignore the internal information of each event and cannot effectively address the problem of industrial equipment event detection when data quality is poor. The purpose of this invention is to overcome the shortcomings of the above-mentioned existing technologies and provide an industrial equipment event detection method and device based on hierarchical network representation learning. Hierarchical network representation learning is used to enhance industrial Internet data, with stronger anomaly detection capabilities and robustness.

[0008] The purpose of the present invention can be achieved by the following technical solutions:

[0009] A method for detecting industrial equipment events based on hierarchical network representation learning, the method comprising:

[0010] The data of the event to be detected is obtained, and the attribute representation and mapping relationship are obtained through a pre-trained hierarchical network representation learning model, so as to obtain the event representation corresponding to the event to be detected. The Euclidean distance between the obtained event representation and the cluster center of all normal and abnormal events is calculated, and the event to be detected is classified into the category with the smallest distance.

[0011] Furthermore, the construction of the hierarchical network representation learning model specifically includes:

[0012] Obtaining discretized industrial equipment event data, wherein the industrial equipment event data is labeled as an abnormal event or a normal event;

[0013] A hierarchical network consisting of an event layer, an attribute layer, and their mapping relationships is constructed. For each event in the industrial equipment event data, the event's unique identifier is placed in the event layer, and each attribute in the event is placed in the attribute layer. A graph neural network is introduced to embed the attribute layer, treating attributes as nodes and their co-occurrence relationships as edges.

[0014] Based on the hierarchical network, a network representation learning algorithm is adopted to perform learning and training to obtain the hierarchical network representation learning model.

[0015] Furthermore, the discretization is specifically as follows:

[0016] For discrete data, retain its original discreteness; for continuous data, set basic units according to different business characteristics, and convert the original attributes into multiples of the basic units to convert them into discrete data.

[0017] Furthermore, for "time", a day can be divided into 24 time intervals of 1 hour, and "time" is divided into 24 unique discrete values; for the "quantity" attribute, the ratio of its value to the basic counting unit is rounded off as the discretized value; for the "percentage value", it is discretized at 1% intervals.

[0018] Furthermore, the first-order attribute interactions and second-order attribute interactions in the attribute layer are captured by an event-level extractor, and then the mapping relationship is designed.

[0019] Furthermore, the loss function used in training the hierarchical network representation learning model is expressed as:

[0020] L=L s +L c +L reg

[0021] Among them, L is the total loss, L s is the structural loss, L c is the classification loss, L reg is the regularization loss.

[0022] Furthermore, the structural loss is expressed as:

[0023]

[0024] Among them, E represents the set of all co-occurrence relationships between attributes in the attribute layer, e represents observable attribute pairs, e' represents unobservable attribute pairs, the σ() function is the sigmoid function, and the function s() is used to distinguish observed attribute pairs from unobservable attribute pairs.

[0025] Furthermore, the expression of the function s() is:

[0026]

[0027] Among them, the symbol ⊙ represents the Hadamard product operation, and Represents the attribute representation of attributes u and v.

[0028] Furthermore, the classification loss is expressed as:

[0029]

[0030] Among them, C represents the set of all events, D(c i ,c j ) represents two event sets c i 、c j The event set is represented by the event cluster center.

[0031] Furthermore, the expression of the regularization loss is:

[0032]

[0033] Among them, ε i Represents the weight of the i-th attribute of the event, and n is the number of attributes of the event.

[0034] The present invention further provides an electronic device, comprising:

[0035] one or more processors;

[0036] Memory; and

[0037] One or more programs stored in a memory, the one or more programs comprising instructions for executing the industrial equipment event detection method based on hierarchical network representation learning as described above.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] 1. The present invention uses hierarchical network representation learning to obtain the classification associations between events and the structural connections between attributes, and realizes the joint modeling of the attribute layer and the event layer based on the mapping relationship. The industrial equipment events to be detected are compared with the cluster centers of the industrial equipment events obtained above to detect abnormal events, thereby improving the accuracy of intercepting abnormal equipment events and the robustness of the model.

[0040] 2. The present invention establishes a hierarchical network, mines fine-grained co-occurrence associations between attributes at the attribute layer, introduces label information at the event layer to optimize the learning of attribute representation, mines deeper potential connections, and optimizes the accuracy and robustness of the model.

[0041] 3. The present invention constructs a hierarchical network and adopts a designed hierarchical network representation learning model to automatically extract potential correlation features from the data, reducing the system's dependence on business knowledge and achieving the effect of enhancing industrial equipment event data.

[0042] 4. The present invention utilizes hierarchical network representation learning, which can not only mine the deep information contained in the network structure, but also introduce the label information of the event to improve the performance of industrial equipment event detection.

[0043] 5. Compared with traditional methods, the present invention reduces the professionalism and cost of discovering equipment anomalies, while improving the robustness of the anomaly detection model.

[0044] Other features and advantages of the present invention will be described in the following description. The purpose and other advantages of the present invention can be achieved and obtained through the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a structural schematic diagram of the present invention. DETAILED DESCRIPTION

[0046] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0047] In order to overcome the difficulties of the prior art, a feasible research direction of the present invention is to capture global and local information based on graph models (such as graph neural networks) to ensure that nodes aggregate sufficient information. The present invention is proposed based on the above findings.

[0048] like Figure 1 As shown, the present invention provides an industrial equipment event detection method based on hierarchical network representation learning, which specifically includes: obtaining event data to be detected, obtaining attribute representation and mapping relationship through a pre-trained hierarchical network representation learning model, thereby obtaining event representation corresponding to the event to be detected, calculating the Euclidean distance between the obtained event representation and the cluster center of all normal and abnormal events, and classifying the event to be detected into a category with a small distance.

[0049] The construction principle of the hierarchical network representation learning model is as follows: obtain the initial industrial equipment event data and construct a hierarchical network based on it; based on the constructed hierarchical network, generate the matrix form of the attribute layer in the hierarchical network; design the attribute representation learned by the graph neural network model for the matrix; based on the initial industrial equipment event data and the generated attribute representation, design the mapping relationship between events and attributes to generate event representation; and based on the structural loss corresponding to the attribute representation, the classification loss corresponding to the event representation and the regularization loss corresponding to the mapping relationship, design a hierarchical network representation learning model, which synergistically considers the above three losses and divides the event representation into two categories: normal and abnormal, and trains the hierarchical network representation learning model.

[0050] The above detection method uses hierarchical network representation learning to obtain the classification associations between events and the structural connections between attributes, and realizes the joint modeling of the attribute layer and the event layer based on the mapping relationship. The industrial equipment events to be detected are compared with the cluster centers of the industrial equipment events obtained above to detect abnormal events, thereby improving the accuracy of intercepting abnormal equipment events and the robustness of the model.

[0051] refer to Figure 1 As shown in Figure 2, the specific construction of the hierarchical network representation learning model includes the following steps:

[0052] Step S101 : performing a discretization operation on original industrial equipment event data, and constructing a hierarchical network based on the discretized industrial equipment event data.

[0053] Specifically, the raw industrial equipment event data collected from industrial equipment is simply divided into data with two labels: abnormal events and normal events. In general, the raw industrial equipment event data can be recorded as B = [b1; b2; ...; b |B| ], |B| represents the number of events in the original industrial equipment event data, and b represents an industrial equipment event. Each industrial equipment event b i It usually consists of n attributes, which can be recorded as b i =[b 1 i , b 2 i , b 3 i ,……,b n i ], where b j i Representative event b i The j-th attribute of . In order to construct a hierarchical network, all attributes in the original industrial equipment event data are uniformly discretized. For discrete data, its original discreteness is retained; for continuous data, basic units are set according to different business characteristics, and the original attributes are converted into multiples of the basic units, making them discrete data. For example, for "time", a day can be divided into 24 time intervals of 1 hour, and "time" is divided into 24 unique discrete values. For the "quantity" attribute, the ratio of its value to the basic counting unit is rounded off as the discretized value. For the "percentage value", it is discretized at 1% intervals.

[0054] Based on the discretized industrial equipment event data, for each event b in the industrial equipment event data B, i , the unique identifier of the event b i Place it in the event layer and set each attribute b in the event ji Place in the attribute layer. Define the event b i The two attributes b in j i and b k i As the edge in the attribute layer, it is recorded as the co-occurrence relationship of the attribute (that is, it appears in the same industrial equipment event). Between the event layer and the attribute layer, the event b is defined i Neutralization composition b i There is a mapping relationship between the various attributes in the

[15] . The present invention combines the event layer, attribute layer, and the mapping relationship between the event layer and the attribute layer to form a hierarchical network. Next, the present invention designs hierarchical network representation learning to extract more information from the hierarchical network to generate event representations and attribute representations.

[0055] Step S102: Based on the hierarchical network, a network representation learning algorithm is used to perform learning and training to obtain the hierarchical network representation learning model.

[0056] When training the hierarchical network representation learning model, an overall loss function is used that takes into account structural loss, classification loss, and regularization loss. The specific calculation process of each loss is as follows:

[0057] 1) According to the attribute layer of the hierarchical network described in step S101, a network representation learning algorithm is designed to obtain attribute representations corresponding to attribute nodes, and the structural loss is calculated.

[0058] To extract the co-occurrence relationships between attributes in the attribute layer, the present invention assumes that attributes with commonalities in the attribute layer have stronger similarity between their corresponding attribute representations. That is, the similarity between the attribute representations corresponding to the observable attribute pairs (u, v) in the attribute layer is greater than the similarity between the attribute representations corresponding to the unobservable attribute pairs (u', v'). A graph neural network is introduced to embed the attribute layer, which treats attributes as nodes and the co-occurrence relationships as edges. A matrix representation representing the attribute layer can be obtained as the input of the graph neural network.

[0059] Therefore, for the entire attribute layer, the loss of the objective function to the network structure can be expressed as:

[0060]

[0061] Where E represents the set of all co-occurrence relationships between attributes in the attribute layer, e represents observable attribute pairs, e' represents unobservable attribute pairs, and the σ() function is the sigmoid function. The s() function is a customized function that allows the model to distinguish between observable attribute pairs (u, v) and unobservable attribute pairs (u', v') as much as possible. It is calculated as follows:

[0062]

[0063] Among them, the symbol ⊙ represents the Hadamard product operation, and Represents the attribute representation of attributes u and v. It is worth noting that the calculation result of s() must eventually be a non-negative number, and the attribute co-occurrence relationship it is based on is non-directional.

[0064] 2) Based on the event layer of the hierarchical network and the obtained attribute representations in step S101, a mapping relationship between events and attributes is designed, event representations are generated, and classification loss is calculated.

[0065] The present invention extracts event representation from the attribute representation corresponding to the event based on the attribute representation described in step S102. Some current studies have found that the interaction between attributes can provide useful information for event modeling. Therefore, the present invention designs a simple event-level extractor to capture the first-order attribute interaction and second-order attribute interaction in the attribute space. For event b i =[b 1 i , b 2 i , b 3 i ,……,b n i ], and record the event representation as It is calculated as follows:

[0066]

[0067] in, represents the attribute representation, ε j Represents the weight of the j-th attribute, which can be automatically determined in the process of learning representation.

[0068] In the event layer, the goal of this invention is to distinguish two events as much as possible in the low-dimensional representation space. That is, in the task of industrial equipment event detection, the two event sets consisting of normal events and abnormal events should be as far apart as possible. In order to quantify the distance between the two event sets, this invention introduces the cluster center To represent all events in the event set c, and its corresponding representation is regarded as the representative of the event set. Therefore, the cluster center It can be expressed as:

[0069]

[0070] Among them, B c represents all events in the event set c, N cis the number of all events in the event set c. Therefore, for any two event sets c i and c j , the distance between two event sets can be calculated as:

[0071]

[0072] Furthermore, the present invention can extend the distance between event sets to the case of multiple event sets, and the classification loss is as follows:

[0073]

[0074] Among them, C represents the set of all events.

[0075] 3) According to the designed mapping relationship between events and attributes, the regularization loss is calculated to prevent the model from overfitting.

[0076] Since the classification loss L c With weight ε=[ε1,ε2,…,ε n ] is negatively correlated, so ε will tend to increase significantly to minimize the classification loss L c In order to avoid this phenomenon, the present invention introduces the regularization loss L res To punish the unlimited increase of weight, as shown in the following formula:

[0077]

[0078] Generally speaking, regularization loss can control the complexity of the model and reduce the risk of overfitting. In addition, regularization loss plays a role in balancing the classification loss of the event layer and the result loss of the attribute layer in the model of the present invention. Note that the attribute layer and the event layer have different loss functions, which are not of the same order of magnitude. By adjusting the weights (ε=[ε1,ε2,…,ε n ]) automatic learning, the model makes L s and L c Try to keep them at the same level as much as possible to avoid the model focusing on only one part of the loss.

[0079] 4) Design the overall loss of the hierarchical network representation learning model.

[0080] This paper proposes a hierarchical network representation learning model to exploit the complexity of hierarchical networks. This model not only mines the deep information contained in the network structure but also introduces event labels to improve the performance of industrial equipment event detection. Based on the obtained structural loss, classification loss, and regularization loss, the overall loss L is calculated as follows:

[0081] L=L s +Lc +L reg .

[0082] In step S103, when the overall loss obtained in step S102 is minimized, the final hierarchical network representation learning model is obtained through training, and industrial equipment event detection for abnormal events can be implemented based on the model. Specifically, the model is used to obtain the event representation to be detected, and the Euclidean distance between the event representation to be detected and the cluster centers of all normal events and all abnormal events is calculated. The event to be detected is classified into a class with a small Euclidean distance, which can implement industrial equipment event detection for abnormal events.

[0083] The above method was verified on a real industrial equipment event dataset, and the performance of the system was comprehensively evaluated using the model's ROC curve and F1-score indicators. This method outperformed previous studies in terms of this indicator and calculation time, and has good robustness, achieving stable performance in multiple different scenarios.

[0084] If the above method is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0085] The above describes in detail the preferred embodiments of the present invention. It should be understood that those skilled in the art can make numerous modifications and variations based on the concepts of the present invention without inventive effort. Therefore, any technical solutions that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A method for industrial equipment event detection based on hierarchical network representation learning, characterized in that: The method includes: Obtain the event data to be detected, and use a pre-trained hierarchical network representation learning model to obtain attribute representations and mapping relationships, thereby obtaining event representations corresponding to the event to be detected. Calculate the Euclidean distance between the obtained event representation and the cluster centers of all normal and abnormal events, and classify the event to be detected into the category with the smallest distance. The construction of the hierarchical network representation learning model specifically includes: Obtaining discretized industrial equipment event data, wherein the industrial equipment event data is labeled as an abnormal event or a normal event; A hierarchical network consisting of an event layer, an attribute layer, and their mapping relationships is constructed. For each event in the industrial equipment event data, the event's unique identifier is placed in the event layer, and each attribute in the event is placed in the attribute layer. A graph neural network is introduced to embed the attribute layer, treating attributes as nodes and their co-occurrence relationships as edges. Based on the hierarchical network, a network representation learning algorithm is used to perform learning and training to obtain the hierarchical network representation learning model; The loss function used in training the hierarchical network representation learning model is expressed as: L=L s +L c +L reg Among them, L is the total loss, L s is the structural loss, L c is the classification loss, L reg is the regularization loss; The structural loss is expressed as: Among them, E represents the set of all co-occurrence relationships between attributes in the attribute layer, e represents observable attribute pairs, e' represents unobservable attribute pairs, σ() function is the sigmoid function, and function s() is used to distinguish observed attribute pairs from unobservable attribute pairs; The expression of the function s() is: Among them, the symbol ⊙ represents the Hadamard product operation, and Attribute representation representing attributes u and v; The expression of the classification loss is: Among them, C represents the set of all events, D(c i ,c j ) represents two event sets c i 、c j The distance between them, the event set is represented by the event cluster center; The expression of the regularization loss is: Among them, ε i Represents the weight of the i-th attribute of the event, and n is the number of attributes of the event.

2. The industrial equipment event detection method based on hierarchical network representation learning according to claim 1 is characterized in that: The discretization is specifically as follows: For discrete data, retain its original discreteness; for continuous data, set basic units according to different business characteristics, and convert the original attributes into multiples of the basic units to convert them into discrete data.

3. The industrial equipment event detection method based on hierarchical network representation learning according to claim 1 is characterized in that: The first-order attribute interaction and the second-order attribute interaction in the attribute layer are captured by an event-level extractor, and then the mapping relationship is designed.

4. An electronic device, characterized in that: include: one or more processors; Memory; and One or more programs stored in a memory, wherein the one or more programs include instructions for executing the industrial equipment event detection method based on hierarchical network representation learning as claimed in any one of claims 1 to 3.

Images