Single-classification industrial control system anomaly detection method based on double-view information bottleneck fusion

Abstract

The invention discloses a single-classification industrial control system anomaly detection method based on double-view information bottleneck fusion, which belongs to the technical field of industrial control system anomaly detection and comprises the following steps of: in a training stage, simultaneously constructing a time sequence view and a pseudo image view; respectively extracting characterization through a time dynamic encoder and a pre-trained visual backbone; performing cross-view compression in the variational information bottleneck fusion module and establishing projection branches only depending on sequence representation; a normal subspace is learned around a center vector, an accurate hypersphere is established to describe normal data, and a center distance is used as an abnormal score and a quantile threshold is used to complete discrimination; in the detection stage, online recognition can be performed only by inputting a time sequence view. According to the method, dual-view prior and variational information bottleneck are fused, end-to-end collaborative optimization is carried out on the dual-view prior and the variational information bottleneck and deep support vector data description, an accurate decision boundary can be established under the condition of a small number of samples, and a solution for industrial control system anomaly detection under the condition that the samples are limited is provided.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial control system anomaly detection, and particularly relates to a single classification industrial control system anomaly detection method based on double-view information bottleneck fusion. BACKGROUND

[0002] Industrial control systems (ICS) support energy, power, chemical industry, metallurgy, transportation and discrete manufacturing, and the safe operation of ICS is directly related to personnel and equipment safety, environmental compliance and continuous production. Once an anomaly occurs and is not discovered in time, it may cause a chain of production stoppage, quality accidents and even disastrous consequences. At the same time, ICS has characteristics such as multivariate coupling, non-stationary and frequent switching of working conditions, and traditional anomaly detection methods are difficult to play a role in such complex situations. Therefore, it is of great significance to build a high-reliability anomaly detection technology for high-dimensional multivariate ICS time series to ensure the essential safety and economic operation of ICS.

[0003] The existing technology is deep support vector data description (DeSVDD), which is a deep single classification learning method trained only with normal samples. This method jointly learns the "feature learning + single classification boundary" target end to end, avoids relying on prior features or known abnormal patterns, and has good scalability for unknown types of anomalies. However, under the realistic conditions of limited normal samples, variable working conditions and unstable statistics, DeSVDD is prone to boundary learning deficiency and generalization instability. The center and radius are greatly affected by the distribution fluctuations of a small number of samples, and the threshold is difficult to set stably. Therefore, how to stably establish an effective single classification description boundary under the conditions of few samples and distribution changes has become the core bottleneck of the existing technology. SUMMARY

[0004] In view of the problem that the traditional DeSVDD cannot extract effective discriminant information and establish an accurate decision boundary under the condition of limited samples, the application provides a single classification industrial control system anomaly detection method based on double-view information bottleneck fusion. This method adds a pseudo-image auxiliary view based on the time series view, introduces a variational information bottleneck strategy to fuse the information of the two views, extracts the most discriminative decision information, and finally constructs a robust hypersphere decision boundary.

[0005] In order to achieve the above purpose, the application adopts the following technical solutions: The single classification industrial control system anomaly detection method based on double-view information bottleneck fusion comprises the following steps: Step 1: Obtain the multivariate sensor sequence of the industrial control system , wherein The number of channels is used to apply a length of [value] to the sequence. A sliding window is used to obtain samples. Deterministic mapping Will Convert to auxiliary pseudo-image Used to assist training, a training set is constructed from normal samples. The samples to be tested constitute the test set. ; Step 2: During the training phase, a time-based dynamic encoder and a time-based image representation module are used to perform dual-view representation of the same historical window. The time-based dynamic encoder maps the original sequence to a time-series representation. The time-image representation module represents pseudo-images. Visual representations are extracted from pre-trained visual backbones. ; Step 3: Establish a variational information bottleneck fusion module to fuse the concatenated vector [ Using [] as input, generate a fusion latent representation. Information compression is performed relative to isotropic priors, while setting up a system that only depends on... projection branch Used to replace in the reasoning stage This enables dual-view training and single-view inference stages. Step 4: Transfer the training phase With time series representation Linear combination, via embedded mapping parameters ( , The final embedding vector is obtained. , around the central vector Learn a compact subspace of normal samples and build a final embedding vector. With the center vector The distance between them is used as an anomaly score. The scoring rules are based on setting thresholds according to the quantiles of the score set of normal samples in the training set. ; Step 5: The window under test is characterized only by time series analysis. With projection branch Calculate the anomaly score and compare it with the threshold. Compare and output the result to determine whether it is normal or abnormal.

[0006] Furthermore, in step 1, the multivariable sensor sequence from the industrial control system is processed according to a fixed window length. Historical windows are obtained by performing sliding aggregation and time alignment. During the training phase, continuous sensor variables in each normal window are deterministically mapped. Generate an auxiliary pseudo-image aligned with the normal window time. ; Where, mapping After normalizing the sequence intervals of each channel, it is represented as follows: Based on this, three types of encoding—Gram angle field, Markov transition field, and recursive graph—are jointly implemented, and the results are stacked by channel. ,in Number of channels , For the height of the pseudo-image, The width of the pseudo-image; The construction of the Gram Corner Field first requires The angle variable is obtained through the inverse cosine mapping shown in formula (1). The expression of formula (1) is: (1); The elements of the Gram matrix are constructed using formula (2), and the expression for formula (2) is as follows: (2); in For the first An angular variable at a given time position. The Gram angle field diagram is shown in the window. , No. The corresponding time position is the 1st line, number Column elements, , The first , No. An angular variable at a given time position; The Markov transition field is constructed as follows: value range according to The non-overlapping intervals are divided into According to formula (3), the first-order transition probability is defined, and the expression of formula (3) is: (3); And let the value at each time step be quantized by a quantization function. Mapped to its corresponding bin index The Markov transition field matrix elements are constructed using formula (4), and the expression for formula (4) is as follows: (4); in For probability operators, To be from the interval Transfer to interval The first-order transition probability, For binning mapping, Indicates from time the interval to which the value of belongs migration to time the interval to which the value of belongs first-order transition probability, equivalent to taking the element in the transition matrix row, column , represents the element in the first row, first column of the Markov transition field diagram in the window corresponding to the first time position, the second time position , , The construction of the recurrence graph is: embedding the first into the first and the second phase space to obtain state , given the sparsity control threshold and the step function , the elements in the recurrence graph are constructed by formula (5), the expression of formula (5) is: (5); wherein indicates whether the first and the second phase space state is recurrent or not; The three types of encoding methods generate symmetric matrices respectively, and are uniformly adjusted to the resolution through interpolation or clipping, and only the continuous sensor channels are encoded to avoid single-color noise in the image domain, and finally the is obtained by stacking along the channel axis.

[0007] Further, in step 2, the time dynamic encoder maps the original sequence into a time sequence representation , specifically: First, the input window batch dimension is expanded and rearranged into a four-dimensional tensor , wherein is the batch size, and then a one-dimensional convolution is adopted in the local feature extraction stack of the time dynamic encoder through formula (6) only along the time axis, to obtain a sequence tensor with a length of and a feature dimension of , the expression of formula (6) is: (6); wherein, is the time sequence local feature mapping; Then, through formula (7), a long short-term memory network which can encode long-range dependencies is used to encode ​​​Perform timing aggregation and output the last time step. The expression for formula (7) is: (7); in, The dimension of the time representation vector; The time-image representation module will use pseudo-images Visual representations are extracted from pre-trained visual backbones. Specifically: Using a pre-trained visual backbone network with frozen parameters Convolutional feature extraction is performed and then global average pooling is used to obtain the vector. The visual representation is then obtained through linear mapping using formula (8), which is expressed as follows: (8); in, For linear mapping network parameters, For bias vectors, is the dimension of the visual representation vector.

[0008] Furthermore, in step 3, [ The mean of the posterior distribution is obtained by parametric mapping using formula (9). with standard deviation The expression for formula (9) is: (9); in, To [ The parameterized mapping is a function of the mean vector of each dimension of the latent variables. To [ The parameterized mapping is a function of the standard deviation vector of each dimension of the latent variables. The dimension of the potential representation; And let the approximate posterior satisfy formula (10), the expression of formula (10) is: (10); in, For the reason Conditionally determined fusion latent representation, It is a multidimensional Gaussian distribution. For parameters The defined approximate posterior distribution; The prior is taken as an isotropic Gaussian distribution. The fusion latent representation is obtained by reparameterization sampling using formula (11), and the expression of formula (11) is: (11); in, is a random noise vector; and in the training phase applies a variational information compression term described by formula (12) to the difference between the prior , and the expression of formula (12) is: (12) ; wherein, is a variational information compression term loss, is a Kullback-Leibler divergence operator; the projection branch only depends on the first view representation in the parallel setting , is a multi-layer perceptron network defined by parameters and a consistency constraint is imposed to make approximate , so that the fused latent representation can be reproduced without the second view in the inference phase, and the consistency of the two views is calculated by formula (13), and the expression of formula (13) is: (13) ; wherein, is a consistency loss of the latent representations of the two views; the training target of the variational information bottleneck fusion is , combined by formula (14), and the expression of formula (14) is: (14) ; wherein, is the total loss of the variational information bottleneck fusion, is a hyperparameter.

[0009] Further, in step 4, the fused latent representation in the training phase and the time series representation are input, and the discriminative embedding vector is obtained by linear embedding represented by formula (15), and the expression of formula (15) is: (15) ; wherein, is a network parameter, is the dimension of the discriminative embedding vector, is the length of the fused latent representation , and is a bias vector, initialized by the embedding mean of the normal samples in the training set, and the center vector is calculated by formula (16), and the expression of formula (16) is: (16) in, For the first estimation center The final discriminant embedding vector of a normal sample, The number of normal samples participating in the center estimation, the center vector The dimension is the same as the dimension of the discriminant embedding vector; The sub-objective function during the training phase is calculated using formula (17). The expression for formula (17) is: (17); and The end-to-end optimization objective is jointly constructed using formula (18). The expression for formula (18) is: (18); The anomaly score based on center distance is calculated using formula (19), which is expressed as follows: (19); The threshold is determined by the quantiles of the normal sample score set during the training phase, and the threshold calculation method is shown in formula (20): (20); in, Given the maximum permissible false alarm ratio, when hour, Equal to normal score quantile values, This represents the total number of normal samples used to estimate the threshold during the training phase. The first normal sample outlier score in the normal sample anomaly score sequence sorted from smallest to largest. Each score value, i.e., the empirical distribution of scores in a normal sample. quantiles, corresponding to ensuring the false positive rate does not exceed [a certain threshold]. The threshold.

[0010] Furthermore, in step 5, single-view reasoning is performed under the condition of only inputting the time series view, and the result is obtained through formula (7) in step 2. The projection branch is obtained through step 3. The test vector is calculated according to formula (21). The expression for formula (21) is: (twenty one); The anomaly score of the test vector is calculated using formula (22). The expression for formula (22) is: (22); and the threshold value preset according to the quantile of the score set of the normal sample in the training stage In comparison, the prediction label is output by the discriminant rule based on the indicator function through formula (23) The expression of formula (23) is as follows: (23); wherein, is an indicator function, if the anomaly score of the sample is greater than the threshold value , the label 1 is output, indicating that the sample is abnormal, otherwise the label 0 is output, indicating that the sample is normal.

[0011] The beneficial technical effects brought by the present application are as follows: The single classification industrial control system anomaly detection method based on double-view information bottleneck fusion provided by the present application uses only normal data, fuses the double-view prior into DeSVDD through variational information bottleneck, compresses the redundancy and enhances the discrimination through the time series and pseudo-image double views during training, realizes deployment through single-view projection replacement during inference, and can stably establish an effective anomaly detection boundary under the condition of few samples, significantly reduces false positives and false negatives, and improves the cross-scene generalization ability and detection efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 is the model structure diagram of the single classification industrial control system anomaly detection method based on double-view information bottleneck fusion in the present application. DETAILED DESCRIPTION

[0013] The specific implementation of the present application will be further described in combination with specific embodiments: The single classification industrial control system anomaly detection method based on double-view information bottleneck fusion, as shown in Figure 1 , comprises the following steps: Step 1: obtaining a multivariate sensor sequence of an industrial control system wherein, is the number of channels, a sliding window with a length of is applied to the sequence to obtain a sample is converted into an auxiliary pseudo-image by a deterministic mapping is used for auxiliary training , a training set is constructed by normal samples , and a test set is constituted by test samples ; Specifically, the multivariate sensor sequence from the industrial control system is aggregated by sliding with a fixed window length and time alignment to obtain a historical window During the training phase, continuous sensor variables in each normal window are subjected to deterministic mapping. Generate auxiliary pseudo-images aligned with the normal window time. No fake images are generated during the testing and online inference phases; Where, mapping After normalizing the sequence intervals of each channel, it is represented as follows: Based on this, three types of encoding—Gram angle field, Markov transition field, and recursive graph—are jointly implemented, and the results are stacked by channel. ,in Number of channels , For the height of the pseudo-image, The width of the pseudo-image; The construction of the Gram Corner Field first requires The angle variable is obtained through the inverse cosine mapping shown in formula (1). The expression of formula (1) is: (1); The elements of the Gram matrix are constructed using formula (2), and the expression for formula (2) is as follows: (2); in For the first An angular variable at a given time position. The Gram angle field diagram is shown in the window. , No. The corresponding time position is the 1st line, number Column elements, , The first , No. An angular variable at a given time position; The Markov transition field is constructed as follows: value range according to The non-overlapping intervals are divided into According to formula (3), the first-order transition probability is defined, and the expression of formula (3) is: (3); And let the value at each time step be quantized by a quantization function. Mapped to its corresponding bin index The Markov transition field matrix elements are constructed using formula (4), and the expression for formula (4) is as follows: (4); in For probability operators, To be from the interval Transfer to interval The first-order transition probability, For binning mapping, Indicates from time The range of values Migration to time The range of values The first-order transition probability is equivalent to the first-order transition probability in the transition matrix. Get the first place line, number Column elements, This indicates the Markov transition field diagram within the window. , No. The corresponding time position is the 1st line, number Column elements; The recursion graph is constructed as follows: Embedded With the The phase space obtains the state. Given a sparsity control threshold With step function The elements in the recursive graph are constructed using formula (5), and the expression of formula (5) is: (5); in Instruction No. With the Whether the phase space state is reproduced; The three encoding methods generate symmetrical... The matrix is ​​then uniformly adjusted to the resolution via interpolation or cropping. Furthermore, only continuous sensor channels are encoded to avoid monochromatic noise in the image domain caused by switching signals, and finally, the signals are stacked along the channel axis to obtain... .

[0014] Step 2: During the training phase, a time-based dynamic encoder and a time-based image representation module are used to perform dual-view representation of the same historical window. The time-based dynamic encoder maps the original sequence to a time-series representation. The time-image representation module represents pseudo-images. Visual representations are extracted from pre-trained visual backbones. .

[0015] The time-series dynamic encoder maps the original sequence to a time-series representation. Specifically: First, the input window is batch-dimensionally expanded and rearranged into a four-dimensional tensor. ,in To determine the batch size, a one-dimensional convolution that slides only along the time axis is used in the local feature extraction stack of the temporal dynamic encoder using formula (6) to obtain a length of... The feature dimension is sequence tensors The expression for formula (6) is: (6); in, For temporal local feature mapping; Then, using formula (7), a long short-term memory network capable of encoding long-range dependencies is employed. right Perform timing aggregation and output the last time step. The expression for formula (7) is: (7); in, The dimension of the time representation vector; The time-image representation module will use pseudo-images Visual representations are extracted from pre-trained visual backbones. Specifically: Using a pre-trained visual backbone network with frozen parameters Convolutional feature extraction is performed and then global average pooling is used to obtain the vector. The visual representation is then obtained through linear mapping using formula (8), which is expressed as follows: (8); in, For linear mapping network parameters, For bias vectors, is the dimension of the visual representation vector.

[0016] Step 3: Establish a variational information bottleneck fusion module to fuse the concatenated vector [ Using [] as input, generate a fusion latent representation. Information compression is performed relative to isotropic priors, while setting up a system that only depends on... projection branch Used to replace in the reasoning stage This enables dual-view training and single-view inference stages. Specifically, [ The mean of the posterior distribution is obtained by parametric mapping using formula (9). with standard deviation The expression for formula (9) is: (9); in, To [ The parameterized mapping is a function of the mean vector of each dimension of the latent variables (derived from the parameters). Sure), To [ The parameterized mapping is a function of the standard deviation vector of each dimension of the latent variables. The dimension of the potential representation; And let the approximate posterior satisfy formula (10), the expression of formula (10) is: (10); in, For the reason Conditionally determined fusion latent representation, It is a multidimensional Gaussian distribution. For parameters The defined approximate posterior distribution; The prior is taken as an isotropic Gaussian distribution. The fusion latent representation is obtained by reparameterization sampling using formula (11), and the expression of formula (11) is: (11); in, It is a random noise vector; And during the training phase with prior The difference is applied by the variational information compression term described by formula (12), and the expression of formula (12) is: (12); in, For variational information compression term loss, For the Kullback-Leibler divergence operator; To achieve "two views during training and one view during inference", projection branches that rely solely on the representation of the first view are set up in parallel. , For parameters Define a multilayer perceptron network and promote consistency constraints. Approaching Thus, the fused latent representation can be reproduced without relying on the second view during the inference stage. The consistency between the two views is calculated using formula (13), which is expressed as follows: (13); in, The consistency loss of the potential representation of the two views; The training objective of variational information bottleneck fusion is from , is combined by weight, and the expression of formula (14) is: (14) ; wherein, is the total loss of variational information bottleneck fusion, is a hyperparameter, and is used in the training stage. is used as the fusion latent representation to participate in subsequent learning, and is used as the fusion latent representation to input subsequent support vector data description and discrimination process in the inference stage, so as to ensure that the representation ability consistent with the double-view training is maintained under the condition of only the first view.

[0017] Step 4: Linearly combine the training stage and the time sequence representation to obtain the final embedding vector via embedding mapping parameters , learn a compact subspace of normal samples around the center vector , and establish a scoring rule of abnormal score based on the distance between the final embedding vector and the center vector ; Take the fusion latent representation and the time sequence representation in the training stage as inputs, and obtain the discrimination embedding vector via linear embedding represented by formula (15), and the expression of formula (15) is: (15) ; wherein, is a network parameter, is the dimension of the discrimination embedding vector, is the length of the fusion latent representation , is a bias vector, initialized by the embedding mean of the training set normal samples, and the center vector is calculated by formula (16), and the expression of formula (16) is: (16) wherein, is the final discrimination embedding vector of the th normal sample used to estimate the center, is the number of normal samples participating in the center estimation, and the dimension of the center vector is the same as that of the discrimination embedding vector; The sub-objective function during the training phase is calculated using formula (17). The expression for formula (17) is: (17); and The end-to-end optimization objective is jointly constructed using formula (18). The expression for formula (18) is: (18); The anomaly score based on center distance is calculated using formula (19), which is expressed as follows: (19); The threshold is determined by the quantiles of the normal sample score set during the training phase, and the threshold calculation method is shown in formula (20): (20); in, Given the maximum permissible false alarm ratio, when hour, Equal to normal score quantile values, This represents the total number of normal samples used to estimate the threshold during the training phase. The first normal sample outlier score in the normal sample anomaly score sequence sorted from smallest to largest. Each score value, i.e., the empirical distribution of scores in a normal sample. quantiles, corresponding to ensuring the false positive rate does not exceed [a certain threshold]. The threshold.

[0018] Step 5: The sample to be tested is characterized only by time series analysis. With projection branch Calculate the anomaly score and compare it with the threshold. Compare and output the result to determine whether it is normal or abnormal.

[0019] Single-view reasoning is performed under the condition of only inputting the time series view, and obtained through formula (7) in step 2. The projection branch is obtained through step 3. The test vector is calculated according to formula (21). The expression for formula (21) is: (twenty one); The anomaly score of the test vector is calculated using formula (22). The expression for formula (22) is: (twenty two); And compared with the threshold pre-set based on the quantiles of the normal sample score set during the training phase. In comparison, the prediction label is output by the discriminant rule based on the indicator function through formula (23) The expression of formula (23) is: (23); Wherein, is an indicator function, if the anomaly score of is greater than the threshold , the label 1 is output to indicate an anomaly, otherwise the label 0 is output to indicate normal.

[0020] The abnormality detection method of the industrial control system described above simultaneously constructs a time series view and a pseudo image view for the same historical window in the training stage, respectively extracts the representation through a time dynamic encoder and a time image representation module, and realizes cross-view fusion and redundancy compression in a variational information bottleneck fusion module. A projection branch that only depends on the time series representation is set to ensure that a single view can be replaced during the inference period. Then, in the support vector data description and scoring module, the fused latent representation and the time series representation are linearly embedded, the normal subspace is learned around the center vector, and the center distance is used as the anomaly score. The end-to-end optimization is performed jointly with the variational compression term and the projection consistency term. In the detection stage, only the time series view is input, the latent representation is obtained through the projection branch, the anomaly score is calculated, and the threshold determined by the training normal sample quantile is compared to complete the determination. The present application combines the double-view priori injection, variational compression and deep single classification organically, and can stably establish an effective boundary under the condition of few samples without constructing additional samples, significantly reduces false positives and false negatives, and has cross-scene generalization ability.

[0021] Embodiment: In this embodiment, SWaT dataset and WADI dataset are used for experimental verification. Both SWaT and WADI datasets are public industrial control system anomaly detection datasets provided by SUTD iTrust (access website: https: / / itrust.sutd.edu.sg / itrust-labs_datasets / dataset_info / ).

[0022] The SWaT dataset is a control system log collected under a six-stage reverse osmosis water purification platform developed by the iTrust organization of the Singapore University of Technology and Design. It contains 51 sensor and actuator signals, and a total of 11 days of real-time running data, of which the first 7 days are completely in a safe working condition, and the last 4 days are injected with multiple attack scripts by a penetration testing team.

[0023] The WADI dataset records the data of 127 monitoring points of the water supply system of the Singapore University of Technology and Design, covering valves, flow meters and water quality indicators, and a total of 16 days of operation of the water supply network are collected, the first 14 days collect pure normal flow, and the last 2 days simulate the same multi-category attack scenario.

[0024] In this embodiment, the autoencoder method (abbreviation: AE), the variational autoencoder method based on long short-term memory network (abbreviation: LSTM-VAE), the deep support vector data description method (abbreviation: DeSVDD) and the double-view variational information bottleneck fusion deep support vector data description method (abbreviation: DVIB-DeSVDD) of the application are simulated and compared. The precision (Precision), recall (Recall) and F1 score are used as the performance indicators of different anomaly detection methods. The hyperparameters in the DVIB-DeSVDD method of the application are respectively , and the comparison experiment results are shown in Table 1.

[0025] Table 1 Performance of different models under two datasets ; The experimental results of Table 1 verify the effectiveness of the DVIB-DeSVDD method of the application in the anomaly detection task. During training, the time series and pseudo-image double views are introduced, and the redundancy is compressed in the variational information bottleneck to realize the projection consistency during inference. Single view replacement makes the method better than the traditional single classification method. Further, Table 2 shows the F1 score comparison under different proportions of missing training data under the SWaT dataset.

[0026] Table 2 F1 score comparison under different proportions of training data under the SWaT dataset ; The experimental results of Table 2 show that even in the case of very few samples (10%), the F1 score of DVIB-DeSVDD can still reach 76.41%, while the traditional single classification method can only achieve an F1 score of 23-38% under this setting, showing the vulnerability of this method when the data is scarce. The comparison analysis further verifies the core role of double-view feature fusion and latent space compression in improving the performance of anomaly detection under the condition of few samples.

[0027] In combination with the above analysis, the DVIB-DeSVDD method provided by the application fuses double-view priori and variational information bottleneck, and performs end-to-end collaborative optimization with deep support vector data description, injects cross-view discriminant priori and compresses redundant information during training, and only relies on single-view projection to realize reasoning during testing, so that an accurate decision boundary can also be established under the condition of a small amount of samples, and a solution for abnormal detection of an industrial control system under a sample limitation condition is provided.

[0028] Of course, the above description is not a limitation of the present application, and the present application is not limited to the above examples. Changes, modifications, additions or replacements made by those skilled in the art within the essential scope of the present application shall also fall within the protection scope of the present application.

Claims

1. An anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion, characterized in that, Includes the following steps: Step 1: Obtain the multivariable sensor sequence of the industrial control system ,in The number of channels is used to apply a length of [value] to the sequence. A sliding window is used to obtain samples. Deterministic mapping Will Convert to auxiliary pseudo-image Used to assist training, a training set is constructed from normal samples. The samples to be tested constitute the test set. ; Step 2: During the training phase, a time-based dynamic encoder and a time-based image representation module are used to perform dual-view representation of the same historical window. The time-based dynamic encoder maps the original sequence to a time-series representation. The time-image representation module represents pseudo-images. Visual representations are extracted from pre-trained visual backbones. ; Step 3: Establish a variational information bottleneck fusion module to fuse the concatenated vector [ Using [] as input, generate a fusion latent representation. Information compression is performed relative to isotropic priors, while setting up a system that only depends on... projection branch Used to replace in the reasoning stage This enables dual-view training and single-view inference stages. Step 4: Transfer the training phase With time series representation Linear combination, via embedded mapping parameters ( , The final embedding vector is obtained. , around the central vector Learn a compact subspace of normal samples and build a final embedding vector. With the center vector The distance between them is used as an anomaly score. The scoring rules are based on setting thresholds according to the quantiles of the score set of normal samples in the training set. ; Step 5: The window under test is characterized only by time series analysis. With projection branch Calculate the anomaly score and compare it with the threshold. Compare and output the result to determine whether it is normal or abnormal.

2. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 1, characterized in that, In step 1, the multivariable sensor sequence from the industrial control system is arranged according to a fixed window length. Historical windows are obtained by performing sliding aggregation and time alignment. During the training phase, continuous sensor variables in each normal window are deterministically mapped. Generate an auxiliary pseudo-image aligned with the normal window time. ; Where, mapping After normalizing the sequence intervals of each channel, it is represented as follows: Based on this, three types of encoding—Gram angle field, Markov transition field, and recursive graph—are jointly implemented, and the results are stacked by channel. ,in Number of channels , For the height of the pseudo-image, The width of the pseudo-image; The construction of Gram's Corner Field first requires The angle variable is obtained through the inverse cosine mapping shown in formula (1). The expression of formula (1) is: (1)； The elements of the Gram matrix are constructed using formula (2), and the expression for formula (2) is as follows: (2)； in For the first An angular variable at a given time position. The Gram angle field diagram is shown in the window. , No. The corresponding time position is the 1st line, number Column elements, , The first , No. An angular variable at a given time position; The Markov transition field is constructed as follows: value range according to The non-overlapping intervals are divided into According to formula (3), the first-order transition probability is defined, and the expression of formula (3) is: (3)； And let the value at each time step be quantized by a quantization function. Mapped to its corresponding bin index The Markov transition field matrix elements are constructed using formula (4), and the expression for formula (4) is as follows: (4)； in For probability operators, To be from the interval Transfer to interval The first-order transition probability, For binning mapping, Indicates from time The range of values Migration to time The range of values The first-order transition probability is equivalent to the first-order transition probability in the transition matrix. Get the first place line, number Column elements, This indicates the Markov transition field diagram within the window. , No. The corresponding time position is the 1st line, number Column elements; The recursion graph is constructed as follows: Embedded With the The phase space obtains the state. Given a sparsity control threshold With step function The elements in the recursive graph are constructed using formula (5), and the expression of formula (5) is: (5)； in Instruction No. With the Whether the phase space state is reproduced; The three encoding methods generate symmetrical... The matrix is ​​then uniformly adjusted to the resolution via interpolation or cropping. Furthermore, only continuous sensor channels are encoded to avoid monochromatic noise in the image domain caused by switching signals, and finally, the signals are stacked along the channel axis to obtain... .

3. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 2, characterized in that, In step 2, the time dynamic encoder maps the original sequence into a time series representation. Specifically: First, the input window is batch-dimensionally expanded and rearranged into a four-dimensional tensor. ,in To determine the batch size, a one-dimensional convolution that slides only along the time axis is used in the local feature extraction stack of the temporal dynamic encoder using formula (6) to obtain a length of... The feature dimension is sequence tensors The expression for formula (6) is: (6)； in, For temporal local feature mapping; Then, using formula (7), a long short-term memory network capable of encoding long-range dependencies is employed. right Perform timing aggregation and output the last time step. The expression for formula (7) is: (7)； in, The dimension of the time representation vector; The time-image representation module will use pseudo-images Visual representations are extracted from pre-trained visual backbones. Specifically: Using a pre-trained visual backbone network with frozen parameters Convolutional feature extraction is performed and then global average pooling is used to obtain the vector. The visual representation is then obtained through linear mapping using formula (8), which is expressed as follows: (8)； in, For linear mapping network parameters, For bias vectors, is the dimension of the visual representation vector.

4. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 3, characterized in that, In step 3, [ The mean of the posterior distribution is obtained by parametric mapping using formula (9). with standard deviation The expression for formula (9) is: (9)； in, To [ The parameterized mapping is a function of the mean vector of each dimension of the latent variables. To [ The parameterized mapping is a function of the standard deviation vector of each dimension of the latent variables. The dimension of the potential representation; And let the approximate posterior satisfy formula (10), the expression of formula (10) is: (10)； in, For the reason Conditionally determined fusion latent representation, It is a multidimensional Gaussian distribution. For parameters The defined approximate posterior distribution; The prior is taken as an isotropic Gaussian distribution. The fusion latent representation is obtained by reparameterization sampling using formula (11). The expression for formula (11) is: (11)； in, It is a random noise vector; And during the training phase with prior The difference is applied by the variational information compression term described by formula (12), and the expression of formula (12) is: (12)； in, For variational information compression term loss, For the Kullback-Leibler divergence operator; Parallel settings depend only on the projection branches represented by the first view. , For parameters Define a multilayer perceptron network and promote consistency constraints. Approaching Thus, the fused latent representation can be reproduced without relying on the second view during the inference stage. The consistency between the two views is calculated using formula (13), which is expressed as follows: (13)； in, The consistency loss of the potential representation of the two views; The training objective of variational information bottleneck fusion is... , It is formed by combining the weights according to formula (14), and the expression of formula (14) is: (14)； in, The total loss of variational information bottleneck fusion, This is a hyperparameter.

5. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 4, characterized in that, In step 4, the fusion latent representation during the training phase is used. With time series representation As input, the discriminant embedding vector is obtained through the linear embedding expressed by formula (15). The expression for formula (15) is: (15)； in, For network parameters, To determine the dimension of the embedding vector, To fuse potential representations Length, The bias vector is initialized with the embedding mean of the normal samples in the training set, and the center vector is calculated using formula (16). The expression for formula (16) is: (16) in, For the first estimation center The final discriminant embedding vector of a normal sample, The number of normal samples participating in the center estimation, the center vector The dimension is the same as the dimension of the discriminant embedding vector; The sub-objective function during the training phase is calculated using formula (17). The expression for formula (17) is: (17)； and The end-to-end optimization objective is jointly constructed using formula (18). The expression for formula (18) is: (18)； The anomaly score based on center distance is calculated using formula (19), which is expressed as follows: (19)； The threshold is determined by the quantiles of the normal sample score set during the training phase, and the threshold calculation method is shown in formula (20): (20)； in, Given the maximum permissible false alarm ratio, when hour, Equal to normal score quantile values, This represents the total number of normal samples used to estimate the threshold during the training phase. The first normal sample outlier score in the normal sample anomaly score sequence sorted from smallest to largest. Each score value, i.e., the empirical distribution of scores in a normal sample. quantiles, corresponding to ensuring the false positive rate does not exceed [a certain threshold]. The threshold.

6. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 5, characterized in that, In step 5, single-view reasoning is performed under the condition of only inputting the time series view, and the result is obtained through formula (7) in step 2. The projection branch is obtained through step 3. The test vector is calculated according to formula (21). The expression for formula (21) is: (21)； The anomaly score of the test vector is calculated using formula (22). The expression for formula (22) is: (22)； And compared with the threshold pre-set based on the quantiles of the normal sample score set during the training phase. By comparison, the predicted label is output based on the discrimination rule of the indicator function using formula (23). The expression for formula (23) is: (23)； in, For indicator functions, if Anomaly score greater than threshold If the output label is 1, it indicates an error; otherwise, it indicates a normal operation.

Images