Abnormal behavior detection method for industrial equipment based on equipment behavior recognition graph

Abstract

The present invention relates to a method for detecting abnormal behavior of industrial equipment based on an equipment behavior recognition graph, comprising the following steps: constructing an equipment behavior recognition graph at the current moment, in which nodes are attributes of behavior events, edges are co-occurrence relationships between any two attributes, and each edge has a weight; introducing an initial weight mechanism, a weight smoothing mechanism, a time influence mechanism, and a cycle influence mechanism to perform weight transformation on the equipment behavior recognition graph; capturing the equipment behavior event representation of the equipment behavior recognition graph after weight transformation through an event representation extractor; using the equipment behavior event representation as an input of a trained multi-layer perceptron to obtain the probability that the current industrial equipment has abnormal behavior. Compared with the prior art, the present invention has the advantages of improving the accuracy of intercepting abnormal behavior and the robustness of the model.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal behavior detection of industrial Internet, and in particular to a method for detecting abnormal behavior of industrial equipment based on an equipment behavior recognition graph. Background Art

[0002] With the increasing expansion of Internet business, industrial scenarios have also entered a new stage of development. The Internet connects industrial control systems and cloud platforms to achieve comprehensive perception of industrial data. The complexity of the Internet environment increases the possibility of industrial control systems being attacked by external parties. Abnormal behavior of industrial equipment often brings uncontrollable huge losses to enterprises. In order to ensure the business security of industrial control systems in industrial Internet scenarios, it is necessary to establish effective methods for detecting abnormal behavior of industrial equipment.

[0003] Traditional security technologies such as user authentication, firewalls, and data encryption, as the first line of defense for industrial control system security, are not only difficult to cope with the rapid evolution of industrial Internet intrusion technologies, but are also insufficient to fully cover the entire industrial Internet security field. Therefore, anomaly detection technology based on machine learning can serve as the second line of defense to supplement the security protection field of industrial control systems.

[0004] At present, the relevant work of intelligent anomaly detection technology based on machine learning has been widely studied, and it has become an industry consensus that machine learning algorithms can help achieve better industrial Internet security. For example, the bagged boosting method based on the C5 decision tree and KernelMiner are the two earliest attempts to build an anomaly detection solution for the industrial Internet. Later, some researchers further proposed methods to successfully apply machine learning techniques, such as support vector machines (SVM), to classify the behavior patterns of industrial Internet devices that do not match the normal behavior patterns. However, the current scale of industrial Internet data is often large, and abnormal behavior data is usually hidden in a large amount of normal data, which brings huge challenges to abnormal behavior detection in the industrial Internet. Because the abnormal data is deeply hidden, it is difficult to mine abnormal features, which in turn affects the performance of the machine learning model. Summary of the invention

[0005] Traditional methods cannot detect abnormal behaviors of complex industrial equipment based on limited data. The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide an abnormal behavior detection method for industrial equipment based on equipment behavior recognition graph. The equipment behavior recognition graph is designed to analyze the behavior pattern of industrial equipment based on its historical behavior data, and to mine deeper information inside the data and introduce external prior semantic knowledge to enhance the quality of behavior data, which has strong anomaly detection capability and robustness.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] A method for detecting abnormal behavior of industrial equipment based on equipment behavior recognition graph comprises the following steps:

[0008] Construct a device behavior recognition graph at the current moment, in which nodes are attributes of behavior events, edges are co-occurrence relationships between any two attributes, and each edge has a weight;

[0009] Introducing an initial weight mechanism, a weight smoothing mechanism, a time influence mechanism and a cycle influence mechanism to perform weight transformation on the device behavior recognition graph;

[0010] Capturing the device behavior event representation of the device behavior recognition graph after weight transformation through an event representation extractor;

[0011] The device behavior event representation is used as an input of a trained multi-layer perceptron to obtain the probability that the current industrial equipment has abnormal behavior.

[0012] The above method uses association graphs, weight settings and network representation learning to enhance industrial Internet data, reducing the professionalism and cost of discovering equipment anomalies while improving the robustness of anomaly detection.

[0013] Furthermore, the device behavior recognition graph is constructed based on cleaned industrial device behavior data, and the cleaning of the industrial device behavior data includes:

[0014] For discrete data, the discreteness of its data values ​​is retained; for continuous data, each data is discretized.

[0015] Furthermore, the continuous data includes time, count value, percentage value and longitude and latitude, specifically:

[0016] For "time", a day can be divided into four time intervals: [0; 3), [6; 11), [15; 24) and [3; 6) ∪ [11; 15), and further by distinguishing whether the "time" is a weekday, the "time" is divided into 8 unique discrete values; for "count value", the ratio of its value to the basic counting unit is rounded off as the discretized value; for "percentage value", it is discretized at 1% intervals; for "latitude and longitude", the geohash encoding method is used to convert the two-dimensional longitude and latitude into a string, which uniquely corresponds to a rectangular area on the map.

[0017] Furthermore, the weight calculation formula for weight transformation of the device behavior recognition graph is:

[0018]

[0019] Among them, ω u,v is the weight of the edge between nodes u and v, λ u,v is the initial weight of the edge between nodes u and v, S(·) represents a smooth function, κ(·) represents a kernel function, δ(·) represents a periodic function, g represents the user associated with the edge (u, v), t h is the appearance time of edge (u,v) before time t.

[0020] Furthermore, the initial weight λ u,v Determined based on the pre-trained word vector, the calculation formula is:

[0021]

[0022] in, and Represent word vectors and The value of the sth dimension, word vector and The corresponding vectors of nodes u and v obtained by querying the pre-trained word vector.

[0023] Furthermore, the smoothing function S(·) is expressed as:

[0024]

[0025] Among them, α and θ are parameters that jointly affect the degree of weight smoothing.

[0026] Furthermore, the kernel function κ(·) is defined as follows:

[0027] κ(tt h ):=exp(-β(tt h )

[0028] Among them, β is a parameter that affects the time decay effect with different intensities.

[0029] Furthermore, the event representation extractor is constructed based on a network representation learning algorithm, and the network representation learning algorithm is used to obtain the mapping relationship between nodes and vector representations in the device behavior recognition graph. b i Represents the i-th field in behavior event b.

[0030] Furthermore, the event representation captured by the event representation extractor is an event representation of a second-order feature, which is expressed as:

[0031]

[0032] in, is the event representation of the first-order feature, n is the number of behavioral events, b j represents the jth field in the behavior event b, ε i , ε j are the weights of the ith and jth fields in the process of generating event representation, and ⊙ represents the Hadamard product.

[0033] Furthermore, the loss function used in the training of the multilayer perceptron is expressed as:

[0034]

[0035] Among them, y represents the true label of the training set data during the training process, It represents the probability of judging the training data as abnormal during the training process, D is the training set, and E represents each behavioral event in the training set.

[0036] Furthermore, the model's training set time window and test set time window are divided according to the performance of the deployed machine equipment and the amount of original industrial equipment behavior data, where the time windows of the training set and the test set should both be continuous time windows, and the time windows of the training set and the test set should be continuous, that is, the time window of the test set follows the time window of the training set.

[0037] Furthermore, the occurrence time of the industrial equipment behavior data in all test sets is later than the occurrence time of the industrial equipment behavior data in any training set.

[0038] Furthermore, the size of the training set time window is twice the size of the test set time window.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. With the help of network representation learning, the potential connections between nodes in the equipment behavior recognition graph are obtained, and the behavior modeling of industrial equipment is realized based on the node representation obtained by network representation learning. The behavior of the industrial equipment to be detected is compared with the obtained industrial equipment behavior model to detect abnormal behavior, thereby improving the accuracy of intercepting abnormal behavior and the robustness of the model, and reducing the professionalism and cost of discovering equipment abnormalities.

[0041] 2. The present invention cleans the industrial Internet device behavior data, constructs a device behavior identification graph, characterizes the co-occurrence relationship between fine-grained attributes in the device behavior, and constructs a heterogeneous network based on the above co-occurrence relationship. It uses the existing network representation learning algorithm to perform representation learning on it, thereby automatically extracting deeper potential correlation features from the data, reducing the system's dependence on business knowledge and achieving an enhanced effect on industrial Internet data.

[0042] 3. The present invention constructs the obtained vector representation from the first-order features and the second-order features respectively, constructs the attribute-level representation fusion for a single event to obtain the event representation, and inputs the obtained event representation into a multi-layer perceptron for detection to obtain the abnormal probability of the behavior data, which effectively characterizes the behavior pattern of the equipment, can distinguish the normal behavior and abnormal behavior of industrial equipment, and has high anomaly detection accuracy.

[0043] Other features and advantages of the present invention will be described in the following description. The purpose and other advantages of the present invention can be achieved and obtained through the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 Generate an example graph for the device behavior recognition graph of the present invention;

[0045] Figure 2 It is a schematic diagram of the principle of the present invention;

[0046] Figure 3 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0047] The following will describe the implementation of the present invention in detail with reference to the accompanying drawings and examples, so that how the present invention applies technical means to solve the problem of abnormal behavior detection of industrial equipment and achieve good abnormality detection effects can be fully understood and implemented accordingly. It should be additionally noted that, in the absence of a conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other, and the resulting technical solutions are all within the scope of protection of the present invention.

[0048] To address the problem that abnormal data is deeply hidden and difficult to mine, a feasible method is to use data enhancement technology to improve low-quality behavioral data and then establish a high-resolution behavioral model.

[0049] In order to achieve data augmentation, an inevitable problem is how to extract necessary information from high-dimensional data and discard irrelevant information. Some recent studies, such as multi-layer perceptrons, aim to obtain powerful feature extraction capabilities to learn effective information hidden in the data and have achieved success in many fields. However, most of the work focuses on extracting deep associations between labels and behavioral features without considering other information that can further bring significant improvements.

[0050] Behavioral models identify abnormal behaviors by detecting differences in behavior at the individual level and are considered to be a promising anomaly detection paradigm. The effectiveness of this paradigm depends largely on the adequacy of behavioral data. In order to establish a model of normal behavior of devices in the Industrial Internet at the individual level, it is necessary to mine the regularity and normal patterns of behavioral data.

[0051] Through the above research, it is found that a major problem for abnormal behavior detection of industrial Internet equipment is how to construct the normal behavior pattern of the equipment. Traditional behavior modeling methods are difficult to deal with deeply hidden abnormal data, cannot capture the correlation between devices, and thus lack good generalization capabilities. To this end, the present invention studies a method for abnormal behavior detection of industrial equipment based on equipment behavior recognition graphs. First, the equipment behavior recognition graph at the current moment is constructed, and the initial weight mechanism, weight smoothing mechanism, time influence mechanism and cycle influence mechanism are introduced to perform weight transformation on the equipment behavior recognition graph. The equipment behavior event representation of the equipment behavior recognition graph after weight transformation is captured by an event representation extractor; the equipment behavior event representation is used as the input of a trained multi-layer perceptron to obtain the probability that the current industrial equipment has abnormal behavior. This method uses association graphs and network representation learning to enhance industrial Internet data, so that it is sufficient to establish an efficient behavior model, reduce the professionalism and cost of discovering equipment anomalies, and improve the robustness of anomaly detection.

[0052] refer to Figure 2 and Figure 3 As shown, the abnormal behavior detection method of industrial equipment based on the equipment behavior recognition graph of the present invention includes the following steps:

[0053] Step S101, obtaining cleaned industrial equipment behavior data according to original industrial equipment behavior data, and constructing an equipment behavior recognition graph based on the cleaned industrial equipment behavior data.

[0054] The original industrial equipment behavior data is collected from the industrial equipment. The collected original industrial equipment behavior data can be divided into two types of data: discrete data and continuous data, as shown in Table 1. For discrete data, the discreteness of its data value is retained and no further processing is performed; for continuous data, the original data is discretized to become discrete data. It is worth noting that in the process of processing continuous data, the discretization operation will cause the data to lose a certain amount of information. In order to minimize the loss of information as much as possible, the present invention customizes some data discretization operation processes for common data types. For the original industrial equipment behavior data, the data types that usually need to be converted include "time", "count value", "percentage value" and "latitude and longitude". Specifically, for "time", the time of a day can be divided into four time intervals: [0; 3), [6; 11), [15; 24) and [3; 6) ∪ [11; 15), and further by distinguishing whether the "time" is a working day, the "time" is divided into 8 unique discrete values. For the "count value" attribute, the ratio of its value to the basic counting unit is rounded off as the discretized value. For the "percentage value", it is discretized at 1% intervals. For "latitude and longitude", the geohash encoding method is used to convert the two-dimensional latitude and longitude into a string, which uniquely corresponds to a rectangular area on the map. Generally speaking, the length of the geohash code represents areas of different sizes, where the longer the code, the smaller the rectangle it represents.

[0055] Table 1. Raw industrial equipment behavior data

[0056]

[0057] The training set time window and the test set time window of the model are divided according to the machine equipment performance and the number of original industrial equipment behavior data deployed by the present invention, so as to divide the industrial equipment behavior data after cleaning into training set data and test set data. The time windows of the training set and the test set should both be continuous time windows, and the time windows of the training set and the test set should be continuous, that is, the time window of the test set follows the time window of the training set. Furthermore, in order to avoid the problem of time travel (future data is used to train the model), it should be ensured that the occurrence time of the industrial equipment behavior data in all test sets is later than the occurrence time of the industrial equipment behavior data in any training set. Preferably, in general, the size of the training set time window is set to be twice the size of the test set time window. Next, the equipment behavior recognition graph is constructed using the training set data and the multi-layer perceptron model is trained, and the model performance is verified using the test set data.

[0058] Based on the training set data, for each behavior event in the data, the unique identifier u of the behavior event and each attribute v in the behavior event are set as nodes in the native graph, and the node pair (u, v) is defined as the edge corresponding to the behavior event in the native graph. The native graph is as follows: Figure 1 As shown on the left side of . In the device behavior recognition graph, the present invention is committed to mining behavior patterns using co-occurrence relationships (i.e., nodes u and v co-appear in a behavior event). Therefore, the co-occurrence relationship between any two attributes in the behavior event is recorded as an edge, and the unique identifier node in the native graph is removed, thereby obtaining Figure 1 The device behavior recognition graph is shown on the right. Next, in order to ensure that the attribute nodes in the device behavior recognition graph can re-represent a behavior event after losing the unique identifier node, an event space corresponding to the attribute space (i.e., the geometric space represented by the device behavior recognition graph) is introduced to store the unique identifier node.

[0059] When the co-occurrence relationship of two attributes appears multiple times in multiple different behavior events, the sum of all its initial weights in the behavior events is set as the weight of its edge in the device behavior recognition graph, denoted as w u,v ; as shown in the following formula:

[0060]

[0061] Where B represents a set of behavioral events, b represents a behavioral event, Represents the node pair that appears in the corresponding behavior event, λ u,v Represents the initial weight of the co-occurrence relationship between attributes u and v. The larger the edge weight, the closer the relationship between the two attribute nodes in the device behavior recognition graph.

[0062] Step S102, according to the device behavior recognition graph described in step S101, an initial weight mechanism, a weight smoothing mechanism, a time influence mechanism and a cycle influence mechanism are introduced to perform weight transformation on the device behavior recognition graph.

[0063] 1) Initial weight mechanism. The edges corresponding to different co-occurrence relationships in the device behavior recognition graph should have different initial weights. For example, the weight of the edge corresponding to the attributes "2pm" and "Beijing" should be different from the weight of the edge corresponding to the attributes "2pm" and "100 yuan". Therefore, it is necessary to set appropriate initial weights between any two nodes. This process is obviously very time-consuming and dependent on external expert knowledge. To this end, the present invention introduces pre-trained word vectors widely used in the industry to help determine the initial weights, and regards this scheme as an optional alternative in the absence of external expert knowledge. Among them, the pre-trained word vectors (such as fasttext) are obtained from public general corpus data using natural language processing tools, have strong versatility, and can be directly applied in the present invention. For any two attribute nodes u and v, first query their corresponding vectors in the pre-trained word vectors. and Then formula (2) calculates the initial weight λ u,v :

[0064]

[0065] in, and Represent the word vectors and The value of the sth dimension of .

[0066] 2) Weight smoothing mechanism. The weight of an edge in the device behavior recognition graph is closely related to the number of behavior events in the test set data. In a large data set, the weight calculated in the form of summation in formula (1) may produce obvious imbalance between the weights of different edges. For example, the weight of one edge is very small in the test set data due to few co-occurrence relationships, but the weight of another edge is very large due to frequent appearance in many events. The huge weight gap is not conducive to reflecting the real relationship between different nodes in reality. This makes it easier for subsequent models to ignore those seemingly unimportant relationships, that is, the edges with smaller weights in the device behavior recognition graph. In order to treat each relationship fairly, a smoothing function is introduced to reduce the weight gap of the edge and to smooth the weight ω. u,v The smoothing function S(·) is shown in equation (3):

[0067]

[0068] Among them, the parameters α and θ jointly affect the smoothness of the weight. The parameter α is mainly in the weight ω u,v When the weight is small, it controls the degree of change of the weight. u,v When is larger, the parameter θ plays a more important role.

[0069] 3) Time influence mechanism. In practical applications, the device behavior recognition graph is formed by adding nodes and edges in sequence, that is, the structure of the device behavior recognition graph changes continuously with the addition of behavior events. In the above process, the added edges are composed of node pairs in different behavior events, and these node pairs are not formed at the same time. In order to learn the rich timing information in the formation process of the device behavior recognition graph, the present invention designs a timing function to perform differential processing on the edges formed by different time nodes. Assuming that the historical behavior events before the current time t can affect the structure of the device behavior recognition graph at the current time t, the formation sequence of an edge in the above graph is regarded as a counting process in the historical behavior event set, and the Hawkes process is applied to affect the formation process of the edge e = (u, v, r). The weight of e at t can be calculated by formula (4).

[0070] ω u,v =λ u,v +∑ th＜t λ u,v ·κ(tt h ) (4)

[0071] Among them, κ(tt h ):=exp(-β(tt h ), t h is the appearance time of edge e before time t, and the kernel function κ(·) represents the time decay effect. It is worth noting that the parameter β can have different strengths of influence on the time decay effect. The time influence mechanism shows that the structure of the device behavior recognition graph depends not only on the number of node pairs in all behavior events, but also on the time decay effect, that is, the weight of the edge will be affected by the higher intensity of the recent behavior events, while the events that occurred in a longer history have less influence on the weight of the edge.

[0072] 4) Periodic influence mechanism. The occurrence of some behavioral events has an inherent periodicity. A good example is the user's shopping behavior. For example, the user can purchase specific goods during the annual promotion period, or make daily dining expenses at a fixed time. Considering the periodic occurrence of behavioral events, the device behavior recognition graph should not only consider the impact of time decay, but also add appropriate periodic influences based on the user's behavioral habits and business scenarios. Therefore, the present invention applies a periodic function to reflect the periodic influence of behavioral events, as shown in formula (5):

[0073]

[0074] in represents the weight of the edge (u, v) associated with user g, and D[·] is a dictionary that specifies the impact factor of each time period in period T.

[0075] Taking the above four mechanisms into consideration, the final weight of the edge in the device behavior recognition graph is calculated by formula (6):

[0076]

[0077] Step S103, according to the device behavior recognition graph after weight transformation in step S102, introduce a network representation learning algorithm, learn the mapping relationship between nodes and corresponding representations in the device behavior recognition graph, design an event representation extractor, and obtain a representation corresponding to the device behavior.

[0078] The present invention adopts a network representation learning algorithm to obtain the vector representation of the nodes in the device behavior recognition graph. The input of the algorithm is the device behavior recognition graph, and the output of the algorithm is the mapping relationship b i Represents the ith field in the behavior event b, and realizes the mapping from node to representation. This step is implemented using the existing network representation learning algorithm GAT (graph attention neural network).

[0079] The present invention designs an event representation extractor, which can simultaneously capture the first-order and second-order feature interactions to more effectively extract the internal information of each behavior event. First, the event representation extractor of the first-order feature is designed, as shown in formula (7):

[0080]

[0081] The first-order feature event representation extractor represents the weighted sum of the node representations in n behavioral events as the final event representation, where ε i Represents the weight of different fields in the process of generating event representation.

[0082] The inventors found that the interaction of high-order features is very useful for subsequent tasks. Therefore, the present invention further designs a second-order feature event representation extractor based on the first-order feature event representation extractor, as shown in formula (8):

[0083]

[0084] The event representation extractor of the second-order feature further adds the sum of the Hadamard products of any two node representations corresponding to the fields in the behavior event on the basis of the event representation extractor of the first-order feature.

[0085] As described in the above formula (8), based on the mapping relationship between the learned nodes and the corresponding representations, for a behavior event b, its corresponding event representation can be obtained:

[0086] Step S104: characterize the device behavior event obtained in step S103 The Multi-Layer Perceptron (MLP) is introduced to simplify abnormal behavior detection into a binary classification task and obtain the probability that a device behavior is judged as abnormal behavior.

[0087] Characterize device behavior events Feed it into the multi-layer perceptron (MLP) to judge a behavior event, map the result of the multi-layer perceptron through the sigmoid function, and then get the probability of being judged as abnormal behavior y = sigmoid (MLP ).

[0088] The present invention simplifies abnormal behavior detection into a binary classification task, so the loss function of the anomaly detection task can be simplified as shown in formula (9).

[0089]

[0090] Among them, y represents the true label (0 or 1) of the training set data during training. It represents the probability of judging the training data as abnormal during the training process (between 0 and 1), D is the training set, and E represents each behavioral event in the training set.

[0091] The above method establishes a device behavior recognition graph to characterize the co-occurrence relationship between fine-grained attributes in device behavior, and at the same time constructs a heterogeneous network based on the above co-occurrence relationship and performs network representation learning to explore deeper potential connections, thereby optimizing the accuracy and robustness of the model. The above method uses the attribute vector obtained by network representation learning to construct attribute-level representation fusion for a single event to obtain event representation, and performs behavioral modeling on the obtained event representation, effectively characterizing the behavior pattern of the device to accurately distinguish normal and abnormal behaviors of industrial equipment.

[0092] The above method was tested on a real industrial equipment dataset and verified, and the recall rate (interception rate) and F1-score indicators were obtained when the disturbance rate (false interception rate) was less than 1%, 0.5%, 0.1% and 0.05%, respectively, to comprehensively evaluate the performance of the system. This method is superior to previous studies in terms of this indicator and calculation time, and has good robustness.

[0093] If the above method is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0094] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A method for detecting abnormal behavior of industrial equipment based on equipment behavior recognition graph, characterized in that: The following steps are involved: Construct a device behavior recognition graph at the current moment, in which nodes are attributes of behavior events, edges are co-occurrence relationships between any two attributes, and each edge has a weight; Introducing an initial weight mechanism, a weight smoothing mechanism, a time influence mechanism and a cycle influence mechanism to perform weight transformation on the device behavior recognition graph; Capturing the device behavior event representation of the device behavior recognition graph after weight transformation through an event representation extractor; Using the device behavior event representation as an input of a trained multi-layer perceptron to obtain the probability that the current industrial equipment has abnormal behavior; The weight calculation formula for weight transformation of the device behavior recognition graph is: Among them, ω u,v is the weight of the edge between nodes u and v, λ u,v is the initial weight of the edge between nodes u and v, S(·) represents a smooth function, κ(·) represents a kernel function, δ(·) represents a periodic function, g represents the user associated with the edge (u, v), t h is the appearance time of edge (u,v) before time t; The initial weight λ u,v Determined based on the pre-trained word vector, the calculation formula is: in, and Represent word vectors and The value of the sth dimension, word vector and The corresponding vectors of nodes u and v obtained by querying the pre-trained word vector; The smoothing function S(·) is expressed as: Among them, α and θ are parameters that jointly affect the degree of weight smoothing; The kernel function κ(·) is defined as follows: κ(t-t h ):=exp(-β(t-t h ) Among them, β is a parameter that affects the time decay effect with different intensities; The event representation extractor is constructed based on a network representation learning algorithm, which is used to obtain the mapping relationship between nodes and vector representations in the device behavior recognition graph. b i Represents the i-th field in behavior event b; The event representation captured by the event representation extractor is an event representation of a second-order feature, expressed as: in, is the event representation of the first-order feature, n is the number of behavioral events, b j represents the jth field in the behavior event b, ε i , ε j are the weights of the ith and jth fields in the process of generating event representation, ⊙ represents the Hadamard product; The loss function used in the training of the multilayer perceptron is expressed as: Among them, y represents the true label of the training set data during the training process, It represents the probability of judging the training data as abnormal during the training process, D is the training set, and E represents each behavioral event in the training set.

2. The method for detecting abnormal behavior of industrial equipment based on equipment behavior recognition graph according to claim 1, characterized in that: The device behavior recognition graph is constructed based on cleaned industrial device behavior data, and the cleaning of the industrial device behavior data includes: For discrete data, the discreteness of its data values ​​is retained; for continuous data, each data is discretized.

3. The method for detecting abnormal behavior of industrial equipment based on equipment behavior recognition graph according to claim 2 is characterized in that: The continuous data includes time, count value, percentage value and longitude and latitude.

Images