Industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation

Abstract

The present invention belongs to the field of industrial control systems and network security machine learning technology, and discloses an industrial control cross-domain anomaly detection method based on an attention mechanism LSTM and multi-dimensional node evaluation. An LSTM network with an attention mechanism is used to perform the two tasks of reconstruction and prediction, which can not only emphasize the weight of the time series and capture the periodicity in the industrial control data, but also train the network through multiple tasks to fully explore the behavior patterns of sensors / actuators contained in normal data in an unsupervised manner. Five unsupervised multi-dimensional node importance evaluation methods are used to evaluate the importance of different sensor / actuator nodes. A comprehensive threshold is set according to the reconstruction loss and node importance score of the node to perform node-level attack detection. It can not only detect whether the sample has been attacked, but also determine the node location of the sample being attacked and the start time of the attack.

Description

Technical Field

[0001] The present invention relates to the fields of industrial control systems and network security machine learning technology, and in particular to an industrial control cross-domain anomaly detection method based on an attention mechanism LSTM and multi-dimensional node evaluation. Background Art

[0002] Industrial control networks (ICS) are widely used in critical infrastructure applications such as power generation, petrochemicals, and water treatment. However, with the advancement of information technology, ICS are facing an increasing number of security threats. These threats can not only disrupt production but also lead to severe economic losses and social impacts. ICS are primarily composed of highly interdependent sensor / actuator nodes, often located in different physical domains. Their role in ICS spans time. Therefore, attacks against ICS networks can often span domains and time and space, posing a greater threat to ICS and increasing the difficulty of ICS anomaly detection. Therefore, accurately detecting anomalies at the node level and localizing attacks in time and space have become urgent challenges.

[0003] Traditional anomaly detection methods for industrial control systems rely primarily on predefined rules and thresholds, making them difficult to adapt to complex and changing industrial environments. With the development of data-driven approaches, anomaly detection methods based on machine learning have become a research hotspot. These methods automatically learn patterns from historical data to identify anomalous behavior. However, the high dimensionality, nonlinearity, and time-series nature of industrial control network data make traditional machine learning methods face significant challenges in processing such data.

[0004] To address these challenges, researchers have proposed numerous improved anomaly detection methods in recent years, including deep learning, autoencoders, and isolation forests. However, most of these methods focus on detecting anomalies across the entire system, lacking attack detection and localization for specific sensor nodes. They also neglect to fully explore and learn from the sensor / actuator behavior patterns contained in normal physical data. Furthermore, existing methods generally lack an assessment of node importance, failing to fully leverage the varying importance of sensor nodes in the system for node-level anomaly detection. Summary of the Invention

[0005] In response to the above problems, the present invention proposes an industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation, especially for anomaly detection and attack node positioning of industrial control physical data (such as SWaT dataset). This method uses an LSTM network with an attention mechanism to perform two tasks: reconstruction and prediction. It can not only emphasize the weight of the time series and capture the periodicity in the industrial control data, but also train the network through multiple tasks to fully explore the behavior patterns of sensors / actuators contained in normal data in an unsupervised manner. Five unsupervised multi-dimensional node importance evaluation methods are used to evaluate the importance of different sensor / actuator nodes. A comprehensive threshold is set according to the reconstruction loss and node importance score of the node to perform node-level attack detection. It can not only detect whether the sample has been attacked, but also determine the node location of the sample being attacked and the start time of the attack.

[0006] To achieve the above objectives, the technical solution of the present invention is as follows: a method for industrial control cross-domain anomaly detection based on attention mechanism LSTM and multi-dimensional node evaluation, comprising the following steps:

[0007] Step 1: Normal traffic data O raw Perform median downsampling to obtain the sampled data O, the data dimension is N×M, where N represents the number of samples after sampling, M represents the number of features after sampling, and is the number of nodes;

[0008] Step 2: Divide the sampled data O into C data sets with time attributes U = (U1, U2, ... U d …, U C ), U d =(g t , g t+1 ,…g t＋n ), where t is the time step, g t＋n Represents the data at time t+n;

[0009] Step 3: Input the dataset U into the LSTM long short-term memory network to calculate the hidden state h t , and uses the attention mechanism to optimize the hidden state; the LSTM long short-term memory network adds an attention mechanism layer and two fully connected layers based on the traditional LSTM network;

[0010] Step 4: Use the optimized hidden state c to perform the reconstruction and prediction tasks of the dataset U;

[0011] Step 5: Define a dual loss function to train the LSTM long short-term memory network, optimize the reconstruction task and prediction task at the same time, and calculate the sample average reconstruction loss l under the dataset U s and node average reconstruction loss lj ;

[0012] Step 6: Evaluate node X using a multi-dimensional node importance evaluation method j Importance of Imp(X j );

[0013] Step 7: Use the same data preprocessing method as step 3 to process the industrial control attack data, use the industrial control attack data as test data, input it into the LSTM long short-term memory network trained in step 5, and calculate the node reconstruction error E of each sample. i，j ;

[0014] Step 8: Combine the node importance Imp(X j ) and the node average reconstruction loss l calculated in step 5 j , calculate the adaptive detection threshold T j ;

[0015] Step 9: Reconstruct the average loss l of the samples according to step 5 s , determine whether the sample has been attacked;

[0016] Step 10: Adaptive detection threshold T according to step 8 j , determine whether the node is attacked;

[0017] Step 11: Divide the result into e security events D = (D1, D2, ... D e ), D e =(start_time, end_time, attack_point), where start_time is the start time of the security event, end_time is the end time of the security event, and attack_point is the location of each node attacked by the security event, and a security event association diagram is drawn.

[0018] The specific process of step 3 is as follows:

[0019] Step 3-1. Calculate the weight of each time step through the attention mechanism layer in the LSTM long short-term memory network. The attention weight α of the time step t is t The calculation formula is as follows:

[0020]

[0021] Among them, h t Represents the hidden state at time step t, T is the total number of time steps, where W a and b a Represent the weight matrix and bias vector of the attention mechanism layer respectively;

[0022] Step 3-2. According to the attention weight α t , optimize the hidden state h t , and get the optimized hidden state c:

[0023]

[0024] The specific process of step 4 is as follows:

[0025] Step 4-1. A fully connected layer in the LSTM long short-term memory network is used as a reconstruction layer; the optimized hidden state c is used for reconstruction to obtain a reconstruction result with the same dimension as the input data. The calculation formula is:

[0026]

[0027] Among them, W r and b r Represent the weight matrix and bias vector of the reconstruction layer respectively;

[0028] Step 4-2. Another fully connected layer in the LSTM long short-term memory network is used as a prediction layer. It predicts the n+1 time step based on the first n time steps of the sequence. The prediction result of the n+1 time step is The formula is:

[0029]

[0030] Among them, W p and b p Represent the weight matrix and bias vector of the prediction layer respectively.

[0031] The specific process of step 5 is as follows:

[0032] Step 5-1. Define the reconstruction loss to measure the ability of the LSTM long short-term memory network in steps 3-4 to reconstruct the input data. The reconstruction loss L rec The calculation formula is:

[0033]

[0034] Among them, X i represents the input data of the i-th sample, Represents the reconstructed data of the i-th sample;

[0035] Step 5-2. Define the prediction loss to measure the ability of the LSTM long short-term memory network in steps 3-4 to predict the next time step of the sequence. The prediction loss L pre The calculation formula is:

[0036]

[0037] Among them, X i，n+1 represents the data of the i+nth time step, Represents the predicted data of the i+nth time step;

[0038] Step 5-3. Define the total loss L as the weighted sum of reconstruction loss and prediction loss, and its formula is:

[0039] L=λL rec +(1-λ)L pre

[0040] Among them, λ is the weight hyperparameter of the reconstruction loss, and its value range is [0, 1];

[0041] Step 5-4. Use the Adam optimizer to optimize the LSTM long short-term memory network in steps 3-4 and train it. The number of rounds can be selected as 200. The learning rate parameter lr is set to 1×10 -4 , the learning rate weight decay coefficient weight_decay is set to 1×10 -5 , optimize the parameters of the LSTM long short-term memory network by minimizing the total loss function L;

[0042] Step 5-5. During training, record the reconstruction loss and prediction loss of each round to monitor the training progress of the LSTM long short-term memory network; calculate the sample average reconstruction loss and the average reconstruction loss for each node

[0043] The specific process of step 6 is: for each feature in the sampled data O, perform the following operations:

[0044] Five node importance evaluation methods, namely principal component analysis, variance analysis, autoencoder, isolation forest, and mutual information, are used to score the importance of features. The five obtained feature importance scores are normalized and weighted averaged to obtain the final importance score of each feature. For the feature importance Q of any method, j The normalization formula is:

[0045]

[0046] The weighted average of the five methods is calculated as follows:

[0047]

[0048] Among them, Imp(X j ) is the importance of the jth node, w kis the weight of the kth method.

[0049] The specific process of step 7 is as follows:

[0050] Use the LSTM long short-term memory network finally trained in step 5 on the test data to calculate the node reconstruction error of each sample and the reconstruction error E of the jth feature of the i-th sample. i，j The formula is as follows:

[0051]

[0052] Among them, X i，j and Represent the values ​​of original data and reconstructed data respectively.

[0053] The specific process of step 8 is as follows:

[0054] Combined with the node importance Imp(X j ) and the node average reconstruction error l calculated in step 5 j , calculate the adaptive detection threshold T j , the formula is as follows:

[0055] T j =Imp(X j )×l j +β j

[0056] where β j is the bias hyperparameter of node j.

[0057] The specific process of step 9 is: for any sample of the test data, perform the following operations:

[0058] judge Is it greater than l s ;

[0059] when The current sample is attacked.

[0060] The specific process of step 10 is: for any node in any sample of the test data, perform the following operations:

[0061] Judgment E i，j Is it greater than T j ;

[0062] When E i，j >T j , the current node is attacked.

[0063] Furthermore, the window size of median downsampling is 10.

[0064] Step 3 uses an LSTM long short-term memory network with an attention mechanism to learn the weights of samples within the time window, which can place more emphasis on important time series and capture the periodicity in industrial control data.

[0065] In steps 4 and 5, the LSTM long short-term memory network is used to perform both reconstruction and prediction. By jointly training the network for multiple tasks, it is possible to compare the reconstruction results of each sample and the predicted results of the next time step, fully exploring and learning the behavioral patterns of normal traffic data.

[0066] In step 6, five unsupervised multi-dimensional node importance evaluation methods are used to evaluate the performance of the current node features. The methods evaluate the importance of each sensor node and obtain a comprehensive node importance score, which can evaluate the relevance of each node to the attack and improve the accuracy of the network.

[0067] Steps 8-10 perform attack detection on samples based on their reconstruction loss. A comprehensive threshold is set based on the node's reconstruction loss and importance score to detect node attacks. This allows for flexible setting of attack thresholds for each node, improving detection flexibility and accuracy. This allows for both detecting whether a sample has been attacked and determining the location of the attacked node.

[0068] Beneficial effects of the present invention: The present invention simulates the normal behavior of sensors / actuators in industrial control systems by reconstructing and predicting normal physical data using an LSTM long short-term memory network, utilizes an attention mechanism to mine the periodicity and important time of industrial control data, and adopts a multi-dimensional node evaluation method to score the importance of nodes, ultimately achieving sample-level and node-level anomaly detection. The industrial control network anomaly detection based on multi-method node importance evaluation and attention mechanism LSTM described in the present invention can effectively identify node-level anomalies and perform security event classification, locate the start time and node location of the attack, has a high classification accuracy, and the unsupervised method can better meet the actual needs of industrial control networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is the overall flow chart of the industrial control cross-domain anomaly detection method based on the attention mechanism LSTM and multi-dimensional node evaluation described in the present invention;

[0070] Figure 2 This is a graph showing the loss variation during the training process of the method of the present invention on industrial control physical data SWaT, where the solid line represents the prediction loss and the dotted line represents the reconstruction loss;

[0071] Figure 3 is the importance value of each node on the normal data in the industrial control physical data SWaT according to the method of the present invention;

[0072] Figure 4 This is a visualization diagram of the security events detected in the industrial control physical data SWaT by the present invention. The ellipses in the figure are attacked nodes, the arrows represent the relationship between the nodes in the attack, and the weight between two nodes is expressed as (duration of the previous attack point / number of attacks, duration of the next attack point / number of attacks). DETAILED DESCRIPTION

[0073] The specific implementation of the present invention is further described in detail below with reference to the accompanying drawings and examples.

[0074] Figure 1 The present invention is an industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation, including:

[0075] S11: Perform median downsampling on the input normal traffic data.

[0076] S12: Constructing time series data from the pre-processed normal traffic data includes:

[0077] According to n data as a sliding window (n=32 in the present invention), it is divided into C data sets with time attributes U=(U1, U2, ...U d ..., U C ), U d =(g t , g t+1 ,...g t＋n ).

[0078] S13: Input the dataset U into the LSTM long short-term memory network to calculate the hidden state h t , and uses the attention mechanism to optimize the hidden state. The LSTM long short-term memory network adds an attention mechanism layer and two fully connected layers based on the traditional LSTM network; specifically, it includes:

[0079] 1. Use the attention mechanism layer to calculate the weight of each time step, thereby emphasizing the attention to important time steps. The attention weight α of the time step t is t The calculation formula is as follows:

[0080]

[0081] Among them, h t Represents the hidden state at time step t, T is the total number of time steps, where W a and b a Represent the weight matrix and bias vector of the attention layer respectively;

[0082] 2. According to the attention weight αt , optimize the hidden state h t , and get the optimized hidden state c:

[0083]

[0084] S14: Using the optimized hidden state c to perform data reconstruction and prediction tasks, specifically including;

[0085] 1. The reconstruction layer uses the optimized hidden state c to reconstruct and obtain a reconstruction result with the same dimension as the input data. The calculation formula is:

[0086]

[0087] Among them, W r and b r Represent the weight matrix and bias vector of the reconstruction layer respectively;

[0088] 2. The prediction layer of the LSTM network predicts the n+1 time step based on the first n time steps of the sequence. The prediction result of the n+1 time step is The formula is:

[0089]

[0090] Among them, W p and b p Represent the weight matrix and bias vector of the prediction layer respectively.

[0091] S15: Use dual loss to optimize the reconstruction and prediction tasks simultaneously and calculate the average reconstruction loss, specifically including:

[0092] 1. Define the reconstruction loss to measure the model's ability to reconstruct the input data. The reconstruction loss L rec The calculation formula is:

[0093]

[0094] Among them, X i represents the input data of the i-th sample, Represents the reconstructed data of the i-th sample;

[0095] 2. Define the prediction loss to measure the model's ability to predict the next time step of the sequence. The prediction loss L pre The calculation formula is:

[0096]

[0097] Among them, X i，n+1 represents the data of the i+nth time step, Represents the predicted data of the i+nth time step;

[0098] 3. Define the total loss L as the weighted sum of reconstruction loss and prediction loss, and its formula is:

[0099] L=λL rec +(1-λ)L pre

[0100] Among them, λ is the weight hyperparameter of the reconstruction loss, and its value range is [0, 1];

[0101] 4. The Adam optimizer was used to optimize the model. The model was trained for 200 rounds, with the learning rate parameter lr set to 1×10 -4 , the learning rate weight decay coefficient weight_decay is set to 1×10 -5 , optimize the model parameters by minimizing the total loss function L;

[0102] 5. During the training process, record the reconstruction loss and prediction loss of each round to monitor the training progress of the model. Calculate the sample average reconstruction loss and the average reconstruction loss for each node

[0103] S16: Use a multi-dimensional node evaluation method to evaluate node importance, including:

[0104] For each feature in the sampled data O, five node importance evaluation methods, namely PCA (principal component analysis), variance analysis, autoencoder, isolation forest, and mutual information, are used to score the importance of the feature. The five obtained feature importance scores are normalized and weighted averaged to obtain the final importance score of each feature. For the feature importance Q of any method, j The normalization formula is:

[0105]

[0106] The weighted average of the five methods is calculated as follows:

[0107]

[0108] Where Imp(X j ) is the importance of the jth node, w k is the weight of the kth method.

[0109] S17: Use the pre-processed attack data to input the trained network computing nodes to reconstruct the error, specifically including:

[0110] Use the trained network on the test data to calculate the node reconstruction error of each sample and the reconstruction error E of the jth feature of the i-th sample. i，j The formula is as follows:

[0111]

[0112] Among them, represents, X i，j and Represent the values ​​of original data and reconstructed data respectively.

[0113] S18: Calculate the adaptive detection threshold based on the node importance, specifically including:

[0114] Combined with the node importance Imp(X j ) and the node average reconstruction error l calculated in step 5 j , calculate the adaptive detection threshold T j , the formula is as follows:

[0115] T j =Imp(X j )×l j +β j

[0116] where β j is the bias hyperparameter of node j.

[0117] S19: Determine whether the sample has been attacked, including:

[0118] For any sample of test data, judge Is it greater than l s ;

[0119] when The current sample is attacked.

[0120] S110: Determine whether the node is attacked, specifically including:

[0121] For any node in any sample of the test data, determine E i，j Is it greater than T j ;

[0122] When E i，j >T j , the current node is attacked.

[0123] S111: Divide the result into e security events D, D (D1, D2, ... D) according to the time attribute and node location obtained by attack detection. e ), D e(start_time, end_time, attack_point), where start_time is the start time of the security event, end_time is the end time of the security event, and attack_point is the location of each node attacked by the security event, and a security event association diagram is drawn.

[0124] In order to verify the effectiveness of the method proposed in this paper, we conducted experiments using the proposed method on the SWaT dataset and presented the results.

[0125] Figure 2 This graph shows the loss evolution during the training process of the method described in this invention on industrial control physical data (SWaT). The solid line represents the prediction loss, and the dashed line represents the reconstruction loss. It can be seen that after 200 rounds of training, both the training loss and the prediction loss stabilize, indicating model convergence.

[0126] Figure 3 The importance of each node is evaluated by the method of the present invention on normal data in the industrial control physical data SWaT, which is used to guide the network's judgment on node attacks.

[0127] Figure 4 This is a visualization diagram of the security events detected in the industrial control physical data SWaT by the present invention, showing the attack time of the security events and the relationship between the attack nodes.

[0128] Table 1 shows the accuracy (ACC), area under the receiver operating characteristic curve (AUC), precision (PRE), and F1 score (F1) statistics of the present method and other methods in the test set. It can be seen that the experimental results of the method described in the present invention are better than those of all the compared methods. The average classification accuracy is improved by 21.1%, the average AUC is improved by 7.9%, the average PRE is improved by 23.3%, and the average F1 value is improved by 13.6%. This shows that the proposed method can improve the accuracy of industrial control anomaly detection and achieve stable anomaly detection.

[0129] Table 1 Comparison of experimental results of the present invention with other methods on industrial control flow data SWaT

[0130]

[0131] Table 2 shows some of the node-level attacks successfully detected by the method of the present invention and the corresponding time periods. These attacks are consistent with the real data, indicating that the present invention can successfully detect node-level attacks, accurately detect cross-domain attack security events, and determine the location and duration of the attack.

[0132] Table 2 Attack security events detected by the present invention in industrial control traffic data SWaT

[0133]

[0134]

[0135] The above preferred embodiments are only for illustrating the technical concept and features of the present invention, and the purpose is to enable technicians in this field to understand the content of the present invention and implement it. It cannot be used to limit the scope of protection of the present invention. Any equivalent changes or modifications made according to the essence of the present invention fall within the scope of protection of the present invention.

[0136] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A cross-domain anomaly detection method for industrial control based on attention mechanism LSTM and multi-dimensional node evaluation, characterized by: The following steps are involved: Step 1: Normal traffic data O raw Perform median downsampling to obtain the sampled data O, the data dimension is N×M, where N represents the number of samples after sampling, M represents the number of features after sampling, and is the number of nodes; Step 2: Divide the sampled data O into C data sets with time attributes U = (U1, U2, ...U Id …, U C ), U d =(g t , g t+1 ,...g t+n ), where t is the time step, g t+n Represents the data at time t+n; Step 3: Input the dataset U into the LSTM long short-term memory network to calculate the hidden state h t , and uses the attention mechanism to optimize the hidden state; the LSTM long short-term memory network adds an attention mechanism layer and two fully connected layers based on the traditional LSTM network; Step 4: Use the optimized hidden state c to perform the reconstruction and prediction tasks of the dataset U; Step 5: Define a dual loss function to train the LSTM long short-term memory network, optimize the reconstruction task and prediction task at the same time, and calculate the sample average reconstruction loss l under the dataset U s and node average reconstruction loss l j ; Step 6: Evaluate node X using a multi-dimensional node importance evaluation method j Importance of Imp(X j ); Step 7: Use the same data preprocessing method as step 3 to process the industrial control attack data, use the industrial control attack data as test data, input it into the LSTM long short-term memory network trained in step 5, and calculate the node reconstruction error E of each sample. i，j ; Step 8: Combine the node importance Imp(X j ) and the node average reconstruction loss l calculated in step 5 j , calculate the adaptive detection threshold T j ; Step 9: Reconstruct the average loss l of the samples according to step 5 s , determine whether the sample has been attacked; Step 10: Adaptive detection threshold T according to step 8 j , determine whether the node is attacked; Step 11: Divide the result into e security events D = (D1, D2, ... D e ), D e =(start_time, end_time, attack_point), where start_time is the start time of the security event, end_time is the end time of the security event, and attack_point is the location of each node attacked by the security event, and a security event association diagram is drawn.

2. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 1 is characterized in that: The specific process of step 3 is as follows: Step 3-1. Calculate the weight of each time step through the attention mechanism layer in the LSTM long short-term memory network, the attention weight a of the time step t t The calculation formula is as follows: Among them, h t Represents the hidden state at time step t, T is the total number of time steps, where W a and b a Represent the weight matrix and bias vector of the attention mechanism layer respectively; Step 3-2. According to the attention weight a t , optimize the hidden state h t , and get the optimized hidden state c:

3. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 2 is characterized in that: The specific process of step 4 is as follows: Step 4-1. A fully connected layer in the LSTM long short-term memory network is used as a reconstruction layer; the optimized hidden state c is used for reconstruction to obtain a reconstruction result with the same dimension as the input data. The calculation formula is: Among them, W r and b r Represent the weight matrix and bias vector of the reconstruction layer respectively; Step 4-2. Another fully connected layer in the LSTM long short-term memory network is used as a prediction layer. It predicts the n+1 time step based on the first n time steps of the sequence. The prediction result of the n+1 time step is The formula is: Among them, W p and b p Represent the weight matrix and bias vector of the prediction layer respectively.

4. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 3 is characterized in that: The specific process of step 5 is as follows: Step 5-1. Define the reconstruction loss to measure the ability of the LSTM long short-term memory network in steps 3-4 to reconstruct the input data. The reconstruction loss L rec The calculation formula is: Among them, X i represents the input data of the i-th sample, Represents the reconstructed data of the i-th sample; Step 5-2. Define the prediction loss to measure the ability of the LSTM long short-term memory network in steps 3-4 to predict the next time step of the sequence. The prediction loss L pre The calculation formula is: Among them, X i,n+1 represents the data of the i+nth time step, Represents the predicted data of the i+nth time step; Step 5-3. Define the total loss L as the weighted sum of reconstruction loss and prediction loss, and its formula is: L=λL rec +(1-λ)L pre Among them, λ is the weight hyperparameter of the reconstruction loss, and its value range is [0, 1]; Step 5-4. Use Adam optimizer to optimize the LSTM long short-term memory network of step 3-step 4 and train it, where the learning rate parameter lr is set to 1×10 -4 , the learning rate weight decay coefficient weight_decay is set to 1×10 -5 , optimize the parameters of the LSTM long short-term memory network by minimizing the total loss function L; Step 5-5. During training, record the reconstruction loss and prediction loss of each round to monitor the training progress of the LSTM long short-term memory network; calculate the sample average reconstruction loss and the average reconstruction loss for each node 5. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 4 is characterized in that: The specific process of step 6 is: for each feature in the sampled data O, perform the following operations: Five node importance evaluation methods, namely principal component analysis, variance analysis, autoencoder, isolation forest, and mutual information, are used to score the importance of features. The five obtained feature importance scores are normalized and weighted averaged to obtain the final importance score of each feature. For the feature importance Q of any method, j The normalization formula is: The weighted average of the five methods is calculated as follows: Among them, Imp(X j ) is the importance of the jth node, w k is the weight of the kth method.

6. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 5 is characterized in that: The specific process of step 7 is as follows: Use the LSTM long short-term memory network finally trained in step 5 on the test data to calculate the node reconstruction error of each sample and the reconstruction error E of the jth feature of the i-th sample. i,j The formula is as follows: Among them, X i,j and Represent the values ​​of original data and reconstructed data respectively.

7. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 6 is characterized in that: The specific process of step 8 is: Combined with the node importance Imp(X j ) and the node average reconstruction error l calculated in step 5 j , calculate the adaptive detection threshold T j , the formula is as follows: T j =Imp(X j )×l i +β j where β j is the bias hyperparameter of node j.

8. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 7 is characterized in that: The specific process of step 9 is: for any sample of the test data, perform the following operations: judge Is it greater than l s ; when The current sample is attacked.

9. The industrial control cross-domain anomaly detection method based on attention mechanism LSTM and multi-dimensional node evaluation according to claim 8 is characterized in that: The specific process of step 10 is: for any node in any sample of the test data, perform the following operations: Judgment E i，j Is it greater than T j ; When E i，j >T j , the current node is attacked.

Images