An industrial system abnormal data stream detection and diagnosis method based on a fusion multi-graph neural network

Abstract

The application discloses a kind of industrial system abnormal data stream detection and diagnosis method of fusion multi-graph neural network, comprising: the topology structure diagram of industrial system is built: the topology structure diagram is established based on the direct connection between each device in industrial system;The function structure diagram of industrial system is built: the function structure diagram is established based on the function similarity between each device in industrial system;Abnormal detection of fusion multi-graph neural network: fusion multiple graph neural networks establish industrial system data stream prediction model, and realize abnormal detection according to the difference between predicted data and real data;Abnormal diagnosis based on attention mechanism: the time factor, semantic factor and equipment factor that influence abnormal generation are obtained by reverse calculation of attention weight.The comprehensiveness and accuracy of diagnosis are realized by the application.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial anomaly monitoring, and particularly relates to an industrial system abnormal data stream detection and diagnosis method fusing a multi-graph neural network. BACKGROUND

[0002] Industrial systems, as important national infrastructure, are widely used in major industrial production fields such as energy and chemical industry, intelligent agriculture, transportation, etc. Unlike traditional industrial systems in a closed and independent environment, modern industrial systems have added many computer-related technologies in the process of informatization, making them open, convenient and interconnected, but also bringing many information security problems.

[0003] Industrial systems collect industrial spatio-temporal data, which has the characteristics of large data volume, long collection time and multiple data types, and is not suitable for large-scale manual label marking for supervised learning, so the anomaly detection of industrial systems is usually in an unsupervised learning mode. However, unsupervised-based algorithms often require a large amount of data to learn, but some industrial systems cannot produce enough data in a short time, and the longer the time, the greater the risk of intrusion. Industrial system anomaly detection methods mainly include traditional detection methods (such as type graph, simple Bayesian model and rule-based IP flow anomaly detection, etc.), machine learning-based methods (such as EGADS, HSVM, etc.) and deep learning methods (such as sparse autoencoder structure, AMDN, etc.).

[0004] However, the biggest deficiency of the existing model for industrial system abnormal data stream diagnosis is that: (1) only the time correlation of data stream is considered, and the correlation between devices in the industrial system is not considered. (2) Lack of explainability for abnormal data. First, the topological structure of the device in the industrial system is a kind of most intuitive spatial correlation, such as the mutual influence between devices in the same local area network, and the mutual influence between devices with the same function, so considering the above spatial correlation and time correlation in the advanced deep learning model can effectively improve the performance of the model. Second, introducing an attention mechanism in the model can make the spatio-temporal data explainable, comprehensive and accurate in diagnosis. SUMMARY

[0005] The purpose of the present application is to provide an industrial system abnormal data stream detection and diagnosis method fusing a multi-graph neural network, which realizes comprehensive and accurate diagnosis.

[0006] To achieve the above purpose, the technical solution adopted by the present application is:

[0007] An industrial system abnormal data stream detection and diagnosis method fusing a multi-graph neural network, the industrial system abnormal data stream detection and diagnosis method fusing a multi-graph neural network comprises:

[0008] Step 1: Construction of the topology diagram of the industrial system: Establish a topology diagram based on the direct connection relationships between the devices in the industrial system;

[0009] Step 2: Constructing the functional structure diagram of the industrial system: Establish a functional structure diagram based on the functional similarity between various devices in the industrial system;

[0010] Step 3: Anomaly detection by fusing multiple graph neural networks: Establish an industrial system data flow prediction model by fusing multiple graph neural networks, and realize anomaly detection based on the difference between the predicted data and the real data;

[0011] Step 4: Anomaly diagnosis based on attention mechanism: By reverse calculation of attention weights, the temporal factors, semantic factors, and device factors that affect the occurrence of anomalies are obtained;

[0012] The method of establishing an industrial system data flow prediction model by integrating multiple graph neural networks includes: integrating graph attention networks, attention mechanisms, and recurrent neural networks to construct the industrial system data flow prediction model. The network structure of the industrial system data flow prediction model is as follows:

[0013] Input layer: for input data D t A sliding window of size w is used to display the data D. t Divide into M small N×w matrices D t1 D t2 ,...,D tM N represents the number of devices;

[0014] Graph attention layer: For each small matrix D tk Let k represent time points and k = 1, 2, ..., M. Then, let D... tk And the topological structure diagram TG, and D tk The functional structure graph FG is input into two graph attention networks, and the outputs are two N×d1 dimensional feature matrices TGM. tk and FGM tk And two N×N dimensional attention weight matrices TGA tk and FGA tk ;

[0015] Fusion layer: Based on attention mechanism for TGM of feature matrix tk and FGM tk By performing a weighted summation, we obtain an N×d1 dimensional matrix GM. tk and the feature matrix TGM tk Attention weight Ta tk and the characteristic matrix FGM tk Attention weight Fa tk ;

[0016] Recurrent layer: A recurrent neural network is used to process the output of the fusion layer, that is, to process all the small matrices D. t1 D t2 ,...,D tM The output matrix GM after the graph attention layer and the fusion layer t1 ,GM t2 ,...,GM tM Input each LSTM unit sequentially to generate M N×d² dimensional hidden state matrices HM. t1 HM t2 ,...,HM tM An attention mechanism is used to perform a weighted summation of all hidden state matrices, resulting in an N×d² dimensional output state matrix HM. t and an M-dimensional attention weight vector γ t ;

[0017] Output layer: Output state matrix HM t Input a fully connected layer, then input the output of the fully connected layer into a softmax layer, and finally output the softmax layer as an N-dimensional vector Y. t .

[0018] Several alternative methods are provided below, but they are not intended as additional limitations on the overall solution above. They are merely further additions or optimizations. Provided there are no technical or logical contradictions, each alternative method can be combined individually with respect to the overall solution above, or multiple alternative methods can be combined with each other.

[0019] Preferably, the establishment of a topology diagram based on the direct connection relationships between devices in the industrial system includes:

[0020] Step 1-1: Connect each device R in the industrial system i Create it as a node, if device R i With device R j If there is a direct connection between nodes, then at node R i and node R j Create an edge between them, and denote the undirected graph TG as the graph that is created;

[0021] Steps 1-2: Use an adjacency matrix TM to represent the undirected graph TG, and complete the construction of the topology graph.

[0022] Preferably, the direct connection is a physical connection or is located on the same local area network.

[0023] Preferably, the establishment of a functional structure diagram based on the functional similarity between devices in the industrial system includes:

[0024] Step 2-1: Classify the equipment in the industrial system according to their functions. If equipment R... i With device R j If they belong to the same type, then at node R i and node R j Create an edge between them, and denote the resulting undirected graph as FG;

[0025] Step 2-2: Use an adjacency matrix FM to represent the undirected graph FG and complete the construction of the functional structure graph.

[0026] Preferably, the industrial system data flow prediction model is trained as follows:

[0027] Step 3-1: Let the training samples S t Given data with current time t and a span of W time intervals, then S t =(WD t ,X t ); among which, WD t For S t The data portion represents the data flow of the industrial system over time [t–W, t-1], represented as an N×W dimensional matrix, WD. t [i] represents device R i The data stream over the time interval [t–W, t-1] is represented as a W-dimensional vector, where N represents the number of devices, and X... t For S t The labeled portion represents the actual data of the industrial system at time t, represented as an N-dimensional vector, X. t [i] represents device R i The real data at time t is used to segment the historical data stream of the industrial system to obtain a large number of training samples, thereby establishing a training sample set;

[0028] Step 3-2: Extract the data portion WD from the training samples. t The input is fed into the industrial system data flow prediction model, and the N-dimensional vector Y output by the industrial system data flow prediction model is obtained. t ;

[0029] Step 3-3: Based on the N-dimensional vector Y output by the industrial system data flow prediction model t and the labeled portion X in the training sample set. t Calculate the loss function and update the parameters of the industrial system data flow prediction model through backpropagation;

[0030] Step 3-4: If the training termination condition is met, output the industrial system data flow prediction model with the latest parameters and receive training; otherwise, return to step 3-2 to continue training.

[0031] Preferably, the time factors, semantic factors, and device factors influencing anomaly generation are obtained through the inverse calculation of attention weights, including:

[0032] Step 4-1, Time Factor in Diagnosing Anomalies: Take the attention weight vector γ calculated by the loop layer of the industrial system data flow prediction model. t We select the historical moment K with the highest attention weight as the time factor that has the greatest impact on anomalies;

[0033] Step 4-2, diagnosing semantic factors of anomalies: taking the attention weight Ta of historical time K calculated by the fusion layer of the industrial system data flow prediction model. tK and Fa tK Let the structural graph corresponding to the semantic factor with the largest attention weight be MG;

[0034] Step 4-2, Diagnosing Abnormal Equipment Factors: Obtain the attention weight matrix TGA calculated from the historical time K of the graph attention layer of the industrial system data flow prediction model. tK and FGA tK If the structure diagram MG is the topology diagram of the industrial system, then the calculation makes the TGA tK [n][I] The largest value of n, where n ranges from 1 to N; if MG is the functional structure diagram of an industrial system, then calculate the value that makes FGA... tK [n][I] is the largest value of n, where I is the device label detected as having an anomaly in the anomaly detection, then R n The equipment factors that have the greatest impact on the occurrence of anomalies.

[0035] The beneficial effects of the industrial system abnormal data flow detection and diagnosis method fused with multi-graph neural networks provided by this invention are mainly reflected in the following aspects: (1) It simultaneously considers multiple relationships between devices in the industrial system, thereby improving the accuracy of abnormal detection. (2) It organizes deep neural networks based on hierarchical attention mechanisms, thereby enabling the diagnosis and interpretation of abnormal detection results. Attached Figure Description

[0036] Figure 1 This is a flowchart of the abnormal data flow detection and diagnosis method for industrial systems that integrates multi-graph neural networks according to the present invention.

[0037] Figure 2 This is a schematic diagram of the structure of the industrial system data flow prediction model of the present invention;

[0038] Figure 3 This is a flowchart illustrating the abnormality diagnosis process of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to limit the invention.

[0041] like Figure 1 As shown, in order to overcome the shortcomings of existing abnormal data flow diagnostic models for industrial systems, this embodiment provides a method for detecting and diagnosing abnormal data flow in industrial systems that integrates multi-graph neural networks, including the following steps:

[0042] (1) Construction of the topology diagram of the industrial system: The topology diagram is established based on the direct connection relationship between the devices in the industrial system.

[0043] (1-1) Establishing the industrial system topology diagram: First, connect each device R in the industrial system... i Create it as a node. Then, if device R... i With device R j If there is a direct connection between nodes (such as a physical connection, being on the same local area network, etc.), then at node R... i and node R j Create an edge between them. Let the final undirected graph be TG.

[0044] (1-2) Industrial system topology diagram representation: TG is represented by an N×N dimensional adjacency matrix TM (where N is the number of devices). If node R... i and node R j If there is an edge, then TM[i][j] = 1; otherwise, TM[i][j] = 0.

[0045] This embodiment first establishes corresponding nodes based on the device, for example, based on device R. i Establish the corresponding node R i Then, edges between nodes are added based on the direct connection relationships between devices. The construction method is simple and the illustrative effect is obvious. It should be noted that, in this embodiment, for the convenience of describing different devices, R is used. i R j The following are used to distinguish between them, where the subscripts i and j are any one of the device labels and i and j are not equal.

[0046] (2) Construction of functional structure diagram of industrial system: Functional structure diagram is established based on the functional similarity between equipment in industrial system.

[0047] (2-1) Establishing an Industrial System Functional Diagram: First, classify the equipment in the industrial system according to their different functions. For example: sensing equipment (such as pressure sensors, temperature sensors, etc.), transmission equipment (such as speed controllers, motors, etc.), automation equipment (such as PLCs, switches, etc.), computing equipment (such as computer CPUs, memory, etc.), communication equipment (such as switches, bridges, etc.). Different classification standards can be used for different industrial systems. Then, if equipment R... i With device R j If they belong to the same type, then at node R i and node R j Create an edge between them. Let the final undirected graph be FG.

[0048] (1-2) Functional structure diagram representation of industrial system: An N×N dimensional adjacency matrix FM is used to represent FG (where N is the number of devices). If node R i and node R j If there is an edge, then FM[i][j] = 1; otherwise, FM[i][j] = 0.

[0049] (3) Anomaly detection by integrating multiple graph neural networks: integrate multiple graph neural networks to establish an industrial system data flow prediction model, and realize anomaly detection based on the difference between the predicted data and the real data.

[0050] (3-1) Prediction Model Construction: Assuming the target time is t, the function of the prediction model is to predict the data of the industrial system at time t based on the data flow of the industrial system over the time interval [t–W, t-1]. A prediction model is constructed by fusing graph attention networks, attention mechanisms, and recurrent neural networks. Its network structure is as follows: Figure 2 As shown. The explanation of the network structure is as follows:

[0051] a. Input layer: For input data D t Input data D t The model uses sample data during training and real data in practical applications. A sliding window of size w is used to measure D. t Divide into M small N×w matrices D t1 D t2 ,...,D tM .

[0052] b. Graph Attention Layer: For each small matrix D tk D tk and TG and D tk FG and FG are input into two graph attention networks respectively, and the outputs are two N×d1 dimensional feature matrices TGM.tk and FGM tk And two N×N dimensional attention weight matrices TGA tk and FGA tk Among them, TGM tk [i] represents device R i The feature vector after processing the industrial system topology diagram, FGM tk [i] represents device R i The feature vector after processing by the Industrial System Functional Architecture Diagram (TGA) tk [i][j] represent equipment R after processing the industrial system topology diagram. i For equipment R j Influence weight, FGA tk [i][j] represent equipment R after processing by the industrial system functional structure diagram. i For equipment R j The influence weight. Let α be the weight of influence. tk ={TGA tk FGA tk}

[0053] c. Fusion Layer: TGM based on attention mechanism tk and FGM tk By performing a weighted summation, we obtain an N×d1 dimensional matrix GM. tk and TGM tk Attention weight Ta tk and FGM tk Attention weight Fa tk Let β be the base value. tk ={Ta tk Fa tk}

[0054] d. Recurrent Layer: LSTM is used to process the output of the fusion layer, that is, all small matrices D... t1 D t2 ,...,D tM The output GM after the graph attention layer and fusion layer t1 ,GM t2 ,...,GM tM By sequentially inputting one LSTM unit at a time, M N×d² dimensional hidden state matrices HM are generated. t1 HM t2 ,...,HM tM An attention mechanism is used to perform a weighted summation of these hidden state matrices, resulting in an N×d² dimensional output state matrix HM. t and an M-dimensional attention weight vector γ t Among them, γ t[j] represents the influence weight of the j-th submatrix.

[0055] e. Output layer: HM t Input a fully connected layer, then input the output of the fully connected layer into a softmax layer, and finally output the softmax layer as an N-dimensional vector Y. t (where Y) t [i] represents device R i (Predicted data at time t).

[0056] (3-2) Construction of training sample set: Assume training sample S t If the current time is t and the span is W time intervals, then S t =(WD t ,X t ), of which WD t For S t The data portion represents the data flow of the industrial system over time [t–W, t-1], represented as an N×W dimensional matrix, WD. t [i] represents device R i The data stream over time [t–W, t-1] is represented as a W-dimensional vector. X t For S t The labeled portion represents the actual data of the industrial system at time t, represented as an N-dimensional vector, X. t [i] represents device R i The actual data at time t. A large number of training samples are obtained by segmenting the historical data stream of the industrial system, thus establishing the training sample set TS.

[0057] (3-3) Prediction model training: The prediction model constructed in step (3-1) is trained based on the training sample set TS.

[0058] (3-3-1) Take the data portion WD from the training samples t The input is fed into the industrial system data flow prediction model, and the N-dimensional vector Y output by the industrial system data flow prediction model is obtained. t .

[0059] (3-3-2) Based on the N-dimensional vector Y output by the industrial system data flow prediction model t and the labeled portion X in the training sample set. t Calculate the loss function and update the parameters of the industrial system data flow prediction model through backpropagation.

[0060] (3-3-3) If the training termination condition is met, output the industrial system data flow prediction model with the latest parameters and receive training; otherwise, return to (3-3-1) to continue training.

[0061] (3-4) Data Stream Anomaly Detection: For the target time t, the trained prediction model is first used to obtain the predicted data vector Y of the industrial system at time t. t Among them, Y t [i] represents device R i The predicted data at time t. Then, compare Y. t [i] and X t [i] (i ranges from 1 to N), if the difference between the two is greater than a specified threshold, then the equipment R in the industrial system is determined to be... i A data stream anomaly occurred at time t. For example, device R with device number I. I Its corresponding Y t [I] and X t If the difference in [I] is greater than a specified threshold, then R I To detect devices with abnormalities during anomaly detection.

[0062] (4) Anomaly diagnosis based on attention mechanism: By inversely calculating attention weights, the temporal, semantic, and device factors influencing anomaly generation are obtained. The specific diagnostic process is as follows: Figure 3 As shown.

[0063] (4-1) Time factor in diagnosing abnormalities: Obtain the attention weight vector γ calculated by the recurrent layer of the prediction model. t (where γ t [k] represents the attention weight of historical time k), and the historical time K with the largest attention weight is selected as the time factor that has the greatest impact on the occurrence of anomalies.

[0064] (4-2) Semantic factors for diagnosing anomalies: Obtain the attention weight β of historical time K calculated by the fusion layer of the prediction model. tK ={Ta tK Fa tK If Ta tK >Fa tK The semantic factor that has the greatest impact on anomaly generation is the topological association between devices; if Ta tK <Fa tK The semantic factor that has the greatest impact on anomalies is the functional relationship between devices. Let the structural diagram corresponding to the semantic factor with the greatest impact be MG.

[0065] (4-3) Diagnostic factors of equipment abnormalities: Obtain the attention weight matrix α of historical time K calculated by the graph attention layer of the prediction model. tK ={TGA tK FGA tK If MG is the topology diagram of an industrial system, then the calculation makes TGA... tK[n][I] The largest value of n (n ranges from 1 to N); If MG is the functional structure diagram of an industrial system, then calculate the value that makes FGA... tK [n][I] The largest value of n (n ranges from 1 to N). Finally, R n The equipment factor that has the greatest impact on the anomaly, i.e., R n For equipment R I Other equipment most affected by the malfunction.

[0066] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A method for detecting and diagnosing abnormal data streams in industrial systems by integrating multi-graph neural networks, characterized in that, The method for detecting and diagnosing abnormal data streams in industrial systems by fusing multi-graph neural networks includes: Step 1: Construction of the topology diagram of the industrial system: Establish a topology diagram based on the direct connection relationships between the devices in the industrial system; Step 2: Constructing the functional structure diagram of the industrial system: Establish a functional structure diagram based on the functional similarity between various devices in the industrial system; Step 3: Anomaly detection by fusing multiple graph neural networks: Establish an industrial system data flow prediction model by fusing multiple graph neural networks, and realize anomaly detection based on the difference between the predicted data and the real data; Step 4: Anomaly diagnosis based on attention mechanism: By reverse calculation of attention weights, the temporal factors, semantic factors, and device factors that affect the occurrence of anomalies are obtained; Step 4-1, Time Factor in Diagnosing Anomalies: Take the attention weight vector γ calculated by the loop layer of the industrial system data flow prediction model. t We select the historical moment K with the highest attention weight as the time factor that has the greatest impact on anomalies; Step 4-2, diagnosing semantic factors of anomalies: taking the attention weight Ta of historical time K calculated by the fusion layer of the industrial system data flow prediction model. tK and Fa tK Let the structural graph corresponding to the semantic factor with the largest attention weight be MG; Step 4-2, Diagnosing Abnormal Equipment Factors: Obtain the attention weight matrix TGA calculated from the historical time K of the graph attention layer of the industrial system data flow prediction model. tK and FGA tK If the structure diagram MG is the topology diagram of the industrial system, then the calculation makes the TGA tK [n][I] The largest value of n, where n ranges from 1 to N; if MG is the functional structure diagram of an industrial system, then calculate the value that makes FGA... tK [n][I] is the largest value of n, where I is the device label detected as having an anomaly in the anomaly detection, then R n The equipment factors that have the greatest impact on the occurrence of anomalies; The method of establishing an industrial system data flow prediction model by integrating multiple graph neural networks includes: integrating graph attention networks, attention mechanisms, and recurrent neural networks to construct the industrial system data flow prediction model. The network structure of the industrial system data flow prediction model is as follows: Input layer: for input data D t A sliding window of size w is used to display the data D. t Divide into M small N × w-dimensional matrices D t1 D t2 , ..., D tM N represents the number of devices; Graph attention layer: For each small matrix D tk Let k represent time points and k = 1, 2, ..., M. Then, let D... tk And the topological structure diagram TG, and D tk The functional structure graph FG is input into two graph attention networks, and the outputs are two N × d1 dimensional feature matrices TGM. tk and FGM tk And two N × N dimensional attention weight matrices TGA tk and FGA tk ; Fusion layer: Based on attention mechanism for TGM of feature matrix tk and FGM tk Weighted summation yields an N × d1 dimensional matrix GM. tk and the feature matrix TGM tk Attention weight Ta tk and the characteristic matrix FGM tk Attention weight Fa tk ; Recurrent layer: A recurrent neural network is used to process the output of the fusion layer, that is, to process all the small matrices D. t1 D t2 , ...,D tM The output matrix GM after the graph attention layer and the fusion layer t1 GM t2 , ..., GM tM Input each LSTM unit sequentially to generate M N × d² dimensional hidden state matrices HM. t1 HM t2 HM tM An attention mechanism is used to perform a weighted summation of all hidden state matrices, resulting in an N × d² dimensional output state matrix HM. t and an M-dimensional attention weight vector γ t ; Output layer: Output state matrix HM t Input a fully connected layer, then input the output of the fully connected layer into a softmax layer, and finally output the softmax layer as an N-dimensional vector Y. t .

2. The method for detecting and diagnosing abnormal data streams in industrial systems by fusing multi-graph neural networks as described in claim 1, characterized in that, The establishment of a topology diagram based on the direct connection relationships between devices in an industrial system includes: Step 1-1: Connect each device R in the industrial system i Create it as a node, if device R i With device R j If there is a direct connection between nodes, then at node R i and node R j Create an edge between them, and denote the undirected graph TG as the graph that is created; Steps 1-2: Use an adjacency matrix TM to represent the undirected graph TG, and complete the construction of the topology graph.

3. The method for detecting and diagnosing abnormal data streams in industrial systems by fusing multi-graph neural networks as described in claim 1, characterized in that, The direct connection relationship is a physical connection or being on the same local area network.

4. The method for detecting and diagnosing abnormal data streams in industrial systems by fusing multi-graph neural networks as described in claim 1, characterized in that, The establishment of a functional structure diagram based on the functional similarity between devices in an industrial system includes: Step 2-1: Classify the equipment in the industrial system according to their functions. If equipment R... i With device R j If they belong to the same type, then at node R i and node R j Create an edge between them, and denote the resulting undirected graph as FG; Step 2-2: Use an adjacency matrix FM to represent the undirected graph FG and complete the construction of the functional structure graph.

5. The method for detecting and diagnosing abnormal data streams in industrial systems by fusing multi-graph neural networks as described in claim 1, characterized in that, The training of the industrial system data flow prediction model is as follows: Step 3-1: Let the training samples S t Given data with current time t and a span of W time intervals, then S t = (WD t , X t ); among which, WD t For S t The data portion represents the data flow of the industrial system over time [t – W, ​​t - 1], represented as an N × W dimensional matrix, WD. t [i] represents device R i The data stream over the time interval [t – W, ​​t - 1] is represented as a W-dimensional vector, where N represents the number of devices, and X... t For S t The labeled portion represents the actual data of the industrial system at time t, represented as an N-dimensional vector, X. t [i] represents device R i The real data at time t is used to segment the historical data stream of the industrial system to obtain a large number of training samples, thereby establishing a training sample set; Step 3-2: Extract the data portion WD from the training samples. t The input is fed into the industrial system data flow prediction model, and the N-dimensional vector Y output by the industrial system data flow prediction model is obtained. t ; Step 3-3: Based on the N-dimensional vector Y output by the industrial system data flow prediction model t and the labeled portion X in the training sample set. t Calculate the loss function and update the parameters of the industrial system data flow prediction model through backpropagation; Step 3-4: If the training termination condition is met, output the industrial system data flow prediction model with the latest parameters and receive training; otherwise, return to step 3-2 to continue training.

Images