A concept drift-oriented anomaly detection method for industrial control networks

Abstract

The present invention relates to an industrial control network anomaly detection method for concept drift, which uses real-time multidimensional data stream as target data. The method trains a teacher model and a single-class support vector machine model on the initial data stream; for each batch of data streams, a new student model is trained based on the teacher model; the student model is used to perform anomaly detection on the current batch of data streams, and the single-class support vector machine model is used to clean the abnormal values ​​in the normal data to obtain the training data required for updating the model; the old student model is used to obtain the abnormal score set of the current batch of data streams and the previous batch of data streams, and then the reliability of the model is calculated according to the Hoeffding inequality, thereby calculating the parameter coefficients of the model, and the parameter coefficients are used to update the model to adapt to concept drift. The present invention can effectively solve the problem of efficiency attenuation of the anomaly detection model when the concept drifts.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control network anomaly detection research, and in particular relates to an industrial control network anomaly detection method oriented to concept drift. Background Art

[0002] There are a large number of state data streams of field devices in industrial control networks, which can be used to detect abnormal behaviors. However, in real industrial environments, the data distribution changes in unpredictable ways due to non-stationary changes in the environment. This phenomenon is called concept drift. Since both abnormal and normal data distributions change over time, the pre-trained model will quickly become outdated, causing the efficiency of the anomaly detection model to decay. Therefore, in order to ensure the effectiveness of the anomaly detection model, we need to overcome the obstacle of concept drift.

[0003] Anomaly detection is a long-standing research problem. In recent years, the rapid development of deep learning technology has spawned many deep anomaly detection methods. Existing anomaly detection technologies can be roughly divided into offline deep anomaly detection and drift anomaly detection. Offline deep anomaly detection refers to training a deep anomaly detection model to detect data with unknown distribution without considering concept drift. Anomaly detection with drift refers to updating the anomaly detection model in real time through various forms to cope with changes in data distribution. Among offline deep anomaly detection methods, deep learning technologies such as autoencoders (AE), generative adversarial networks (GANs), and recurrent neural networks (RNNs) have been deeply studied. However, these methods are designed offline and cannot adapt to the changing data distribution. Deep learning with drift is a method that adapts neural network-based models to changing data streams by using effective means. Ensemble models and incremental update methods are two effective methods for dealing with concept drift in existing research. Typical ensemble methods such as Street divide stream data into fixed-size data blocks, build a single classifier on continuously trained data blocks, and use a replacement strategy to replace the worst performing classifier. INSOMNIA reduces the delay of model updates by incremental learning and obtains estimated labels by active learning. IADM embeds attention weights into the Fisher information matrix to achieve adaptive deep models. ARCUS uses a model pool method to dynamically adjust the model pool to adapt to the changing data stream. Although these studies have pioneered anomaly detection for concept drift, they still have some challenges.

[0004] 1. Model update delays lead to inefficient anomaly detection models. In principle, the updated model should be close to real-time, that is, the new model should be ready before the current batch of data is classified, but in practice, the updated model is usually available after some delay. Longer delays mean that the new model is too late for the new data stream. The way offline methods deal with new distribution data is to retrain from scratch, but this incurs a lot of time overhead and leads to efficiency decay. For non-offline training methods, there will also be update delays when the model is updated, which may cause temporary performance degradation. For example, when new traffic flow telemetry data arrives but the new model is not yet ready, this makes the model unable to detect anomalies in time, resulting in inefficiency of the anomaly detection model.

[0005] 2. The uneven importance of new data leads to inefficient anomaly detection models. Many methods designed for concept drift assume that only the most recent data points contain the most useful information, no matter how the data stream evolves. However, the recent data stream may contain information of varying degrees of importance, and blindly updating the model with the same importance for the recent data may lead to suboptimal results. For example, the distribution of the most recent batch of data may have appeared before, so the importance of this batch of data is small.

[0006] 3. The self-poisoning problem caused by the self-update of a single deep neural network model. Most supervised anomaly detection methods usually have high accuracy by processing labeled data. However, the high cost of manually labeled data and the lack of abnormal instances in real-world scenarios make supervised methods impractical. Due to the unreliability of labels predicted by unsupervised anomaly detection methods, the data used for incremental updates may contain a small number of abnormal data points, the presence of which will lead to unsatisfactory results of the model. Abnormal data points in the retraining data will accumulate over time, which may lead to self-poisoning problems when a single deep neural network model is self-updated. Summary of the invention

[0007] Aiming at the deficiencies of the existing industrial control network anomaly detection technology, the present invention provides an industrial control network anomaly detection method oriented to concept drift.

[0008] This paper aims to solve three challenges of anomaly detection methods in industrial control networks: inefficiency of anomaly detection models due to model update delay, inefficiency of anomaly detection models due to uneven importance of new data, and self-poisoning caused by self-update of a single deep neural network model. The purpose is to ensure that the anomaly detection model can still maintain a balance between performance efficiency and time efficiency in a concept drift environment.

[0009] The present invention first learns an anomaly detection model from a historical data set containing only normal data, and this anomaly detection model acts as a teacher model. Then the teacher model that learns the known data distribution from the historical data can provide useful information for the subsequent student model. At the same time, a single-class support vector machine is trained using the historical data as a label estimator to reduce the outliers of the training data in the incremental training stage. In the incremental learning stage, new data points are consumed continuously and processed in batches of the same size. Each batch of data streams trains a student model under the guidance of the teacher model. The anomaly detection step uses the student model to calculate the anomaly score of each batch of stream data and selects data points with anomaly scores below a threshold, and then uses a single-class support vector machine to clean these data points to reduce the impact of outliers on incremental training. The model reasoning step estimates the reliability of the student model of the current batch. The model update step assigns importance to the current batch of data according to the reliability of the model, and updates the model according to the importance. The present invention can effectively realize anomaly detection of industrial control network data, can cope with data streams with changed data distribution, and meet the requirements of balancing performance efficiency and time efficiency.

[0010] Terminology explanation:

[0011] 1. Concept drift: The phenomenon that data distribution changes in unpredictable ways due to non-stationary changes in the environment.

[0012] 2. Single-class support vector machine: Use the zero point as the negative sample point and the other data as the positive sample points to train the support vector machine, and construct a hyperplane between the data and the origin, which has the maximum distance from the origin.

[0013] 3. EncDec-AD: Based on the autoencoder framework, each layer of its encoder and decoder is composed of LSTM (Long Short-Term Memory Network).

[0014] The technical solution of the present invention is:

[0015] A concept drift-oriented anomaly detection method for industrial control networks, comprising:

[0016] Step 1: Obtain the initial training set and train the initial model: Use the initial training set to train the teacher model and the single-class support vector machine model;

[0017] Step 2: Train the student model using real-time data stream;

[0018] Step 3: Use the student model to perform anomaly detection on the current batch data stream, obtain the anomaly score set of the current batch data, and obtain the new data required to update the student model;

[0019] Step 4: Calculate the reliability of the student model using the anomaly score set;

[0020] Step 5: Calculate the parameter coefficients of the new and old student models based on the reliability of the student model, and use the model parameter coefficients to update the student model.

[0021] Step 6: Use the student model updated in step 5 to calculate the anomaly score for each data point in the current batch of data streams. Data points with anomaly scores greater than the threshold τ are considered abnormal, otherwise they are normal.

[0022] According to the preferred embodiment of the present invention, in step 1, it is assumed that in the industrial control network, d time series are collected by d devices under the normal operation of the industrial control system, and the d time series are historical data sets containing only normal behaviors, X initial represents an initial training set containing only normal behaviors, i.e., a historical data set containing only normal behaviors; TM represents a teacher model based on an autoencoder; SVM represents a single-class support vector machine model;

[0023] Initialization phase, X initial As the training set, the teacher model TM is trained, and a single-class support vector machine model SVM is trained.

[0024] According to the preferred embodiment of the present invention, in step 2, assuming that X cur represents the data stream of the current batch; SM represents a student model based on an autoencoder, which converts the data stream of the current batch X cur Input into the student model SM, output X cur Reconstruction, assuming SM(X cur ) represents the reconstruction of the data stream of the current batch by the student model; the data stream of the current batch X cur Input into the teacher model TM, output X cur Reconstruction, assuming TM(X cur ) represents the reconstruction of the data stream of the current batch by the teacher model; the student model is trained. During the student model training phase, the back propagation of the teacher model is cut off and only the parameters of the student model are updated.

[0025] Preferably, according to the present invention, in step 2, the training objectives of the student model are as shown in formulas (I) and (II):

[0026] L 1 =||TM(X cur )-SM(X cur )|| 2 (Ⅰ)

[0027] L 2 =||X cur -SM(X cur )|| 2 (Ⅱ)

[0028] In formula (I) and (II), ||.|| 2 Indicates L 2 norm;

[0029] L 1 Minimize the difference between the teacher model and the student model, L 2 Minimize the reconstruction value of the student model and the input X cur differences;

[0030] The final training objective of the student model is shown in formula (III):

[0031] L = α||TM(X cur )-SM(X cur )|| 2 +β||X cur -SM(X cur )|| 2 (III)

[0032] In formula (III), α+β=1, α and β are balance parameters used to weigh the importance of the teacher model and the student model.

[0033] More preferably, the values ​​of α and β are 0.1 and 0.9 respectively.

[0034] Preferably, in step 3, in the incremental update phase, assuming that X represents a batch of unknown label data arriving each time, X is input into the trained student model, and the anomaly score of each batch of data X is output; assuming that X cur Indicates the current batch input, X nor Indicates that the trained student model will X cur The data in is the set of data points marked as normal at the time point, X abnor Indicates that the single-class support vector machine model SVM transforms X nor The data points in X are marked as abnormal data points. nor -X abnor Represented as the newly arrived data to be incrementally trained; the newly arrived data to be incrementally trained is divided into a set D 1 and set D 2 , assuming D 1 Used to retrain the student model, D 2 Used for early stopping.

[0035] According to the preferred embodiment of the present invention, in step 4, assuming that S(X cur ) represents the abnormal score set of the current batch input, S(X pre ) represents the abnormal score set of the previous batch of inputs, S(X cur ) and S(X pre ) are obtained through the student model; assuming S(Bcur ) and S(B pre ) are respectively from S(X cur ) and S(X pre ), S(B cur ) and S(B pre ) are all [S min ,S max ] as the boundary; calculate the reliability of the student model and determine whether the concept drift has occurred in the current batch of data. If so, go to step 6 to update the current student model, otherwise, no update is required.

[0036] According to the preferred embodiment of the present invention, in step 3, assuming that V B Represents the reconstruction error vector of each batch of data, V B Each element in is represented by formula (IV):

[0037] e t =|x t -x′ t | (Ⅳ)

[0038] In formula (IV), x t represents the original data point at time t, x′ t represents the reconstructed value at time t, e t represents the reconstruction error at time t;

[0039] Assume that set D 2 There are B data points in the equation (IV). The reconstruction error e corresponding to each data point is calculated according to equation (IV). t , and finally obtain the reconstruction error vector V of this batch of data B , reconstruct the error vector V B The mean of is represented by μ, and the reconstructed error vector V B The variance is represented by ∑, and the normal distribution N(μ,∑) is obtained. For the current batch input X cur At each time point x t , anomaly score A t It is represented by formula (V):

[0040] A t =(e t -μ) T ∑ -1 (e t -μ) (V)

[0041] In formula (V), A t is time point x t The anomaly score of t Calculate the anomaly score A t , if the anomaly score A t>τ, then the time point is marked as abnormal, where τ is the threshold.

[0042] Further preferably, the threshold τ is obtained by a grid search method, and the specific implementation process is as follows:

[0043] For the current batch input X cur At each time point x t , both use formula (V) to calculate the anomaly score A t , assuming that the maximum value of the anomaly score is A MAX , the minimum value of the anomaly score is A MIN , in A MIN and A MAX Generate 100 values ​​evenly between them, use the exhaustive method to run all the 100 values, and select the value with the largest F1 score among the 100 values ​​as the threshold τ.

[0044] According to the preferred embodiment of the present invention, in step 3, the retraining data required for updating the student model is expressed as formula (VI):

[0045] X recur =X nor -X abnor (VI)

[0046] In formula (VI), X recur Represents the training dataset required for updating the student model in the current batch.

[0047] According to the preferred embodiment of the present invention, in step 4, S(B cur ) and S(B pre ) Applying the Hoeffding inequality:

[0048]

[0049] In formula (VII), b=|B cur |=|B pre |,ε=|avg(S(B cur ))-avg(S(B pre ))|,S min =min(min(S(B cur )),min(S(B pre ))),S max =max(max(S(B cur )),max(S(B pre ))).

[0050] According to the preferred embodiment of the present invention, in step 4, the reliability R of the student model M It is expressed as:

[0051]

[0052] According to the preferred embodiment of the present invention, in step 5, assuming that X recur The training data set required for updating the student model in the current batch, X repre The training data set required for updating the student model in the previous batch, SM 1 Is to use the current batch X recur Trained student model, SM 2 Is to use the previous batch of X repre The trained student model, θ 1 For SM 1 The model parameters, θ 2 For SM 2 The model parameters of the updated new student model are expressed as: θ = ω 1 *θ 1 +ω 2 *θ 2 ; Among them, ω 1 For SM 1 The model parameter coefficient, ω 2 For SM 2 The model parameter coefficients are ω 2 =1-ω 1 , τ R is the reliability threshold of the model, γ is a user-defined adjustable parameter, 0<γ<1.

[0053] More preferably, the value of γ is 0.5.

[0054] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of an industrial control network anomaly detection method oriented to concept drift when executing the computer program.

[0055] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an industrial control network anomaly detection method oriented to concept drift.

[0056] The beneficial effects of the present invention are:

[0057] The existing anomaly detection methods for concept drift in industrial control networks have defects such as model update delay, uneven importance of new data, and self-poisoning caused by model self-update. Compared with the existing anomaly detection methods for concept drift in industrial control networks, the beneficial effects of the present invention are as follows:

[0058] 1. The present invention learns knowledge from data with known distribution through a teacher model, and then learns knowledge of new data with unknown distribution through a student model. Each time, only the student model is updated with new data, thereby solving the problem of inefficient anomaly detection model caused by model update delay.

[0059] 2. The present invention calculates the model parameter coefficients of the new student model and the old student model according to the reliability of the model, and uses the model parameter coefficients to merge the new and old student models to obtain an updated new model, thereby solving the problem of low efficiency of the anomaly detection model caused by the uneven importance of new data.

[0060] 3. The present invention uses the student model to calculate the anomaly score of the current batch, obtains the data points marked as normal by the student model, and uses a single-class support vector machine to remove outliers in the normal data points, thereby solving the self-poisoning problem caused by the self-update of a single deep neural network model. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 The overall framework diagram of the anomaly detection method for concept drift of the present invention;

[0062] Figure 2(a) is a temperature variation curve on the INSECTS_Abr dataset;

[0063] FIG2( b ) is a diagram showing the reliability variation of the model of the present invention on the INSECTS_Abr data set;

[0064] Figure 3(a) is a temperature variation curve on the INSECTS_Incr dataset;

[0065] FIG3( b ) is a diagram showing the reliability variation of the model of the present invention on the INSECTS_Incr dataset;

[0066] Figure 4(a) is a temperature variation curve on the INSECTS_IncrGrd dataset;

[0067] FIG4( b ) is a diagram showing the reliability variation of the model of the present invention on the INSECTS_IncrGrd dataset;

[0068] Figure 5(a) is a temperature variation curve on the INSECTS_IncrRecr dataset;

[0069] FIG5( b ) is a diagram showing the reliability variation of the model of the present invention on the INSECTS_IncrRecr dataset;

[0070] FIG6( a ) is the running time of the present invention in the initialization stage;

[0071] FIG6( b ) shows the running time of the present invention in the incremental update phase. DETAILED DESCRIPTION

[0072] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

[0073] Example 1

[0074] A concept drift-oriented anomaly detection method for industrial control networks, such as Figure 1 As shown, including:

[0075] Step 1: Obtain the initial training set and train the initial model: Use the initial training set to train the teacher model and the single-class support vector machine model;

[0076] Step 2: Train the student model using real-time data stream;

[0077] Step 3: Use the student model to perform anomaly detection on the current batch data stream, obtain the anomaly score set of the current batch data, and obtain the new data required to update the student model;

[0078] Step 4: Calculate the reliability of the student model using the anomaly score set;

[0079] Step 5: Calculate the parameter coefficients of the new and old student models based on the reliability of the student model, and use the model parameter coefficients to update the student model.

[0080] Step 6: Use the student model updated in step 5 to calculate the anomaly score for each data point in the current batch of data streams. Data points with anomaly scores greater than the threshold τ are considered abnormal, otherwise they are normal.

[0081] Example 2

[0082] The difference between the method for detecting anomalies in industrial control networks oriented to concept drift described in Example 1 is that:

[0083] In step 1, it is assumed that in the industrial control network, d time series are collected by d devices (including sensors and actuators) under normal operation of the industrial control system. The d time series are large-scale historical data sets containing only normal behaviors. initial represents an initial training set that only contains normal behaviors, that is, a historical data set that only contains normal behaviors; TM represents a teacher model based on an autoencoder (the network architecture adopts EncDec-AD); SVM represents a single-class support vector machine model;

[0084] Initialization phase, X initialAs the training set, the teacher model TM is trained, and a single-class support vector machine model SVM is trained.

[0085] X initial As a training set to train the teacher model TM; including: initial The input is sent to the teacher model TM. The loss function uses the mean square error loss function and the Adam optimizer is used to optimize the teacher model until the number of training times reaches the set maximum value.

[0086] Training a single-class support vector machine model SVM includes: initial The data is input into a single-class support vector machine model SVM. The kernel function of SVM adopts radial basis kernel function (RBF), and the abnormal point ratio nu is set to 0.2. Finally, a single-class support vector machine model SVM is obtained.

[0087] In step 2, assume that X cur represents the data stream of the current batch; SM represents a student model based on an autoencoder (the network architecture uses EncDec-AD), and the network structure of SM can be different from that of TM; the data stream of the current batch X cur Input into the student model SM, output X cur Reconstruction, assuming SM(X cur ) represents the reconstruction of the data stream of the current batch by the student model; the data stream of the current batch X cur Input into the teacher model TM, output X cur Reconstruction, assuming TM(X cur ) represents the reconstruction of the data stream of the current batch by the teacher model; the student model is trained. During the student model training phase, the back propagation of the teacher model is cut off and only the parameters of the student model are updated.

[0088] In step 2, the training objectives of the student model are shown in formulas (I) and (II):

[0089] L 1 =||TM(X cur )-SM(X cur )|| 2 (Ⅰ)

[0090] L 2 =||X cur -SM(X cur )|| 2 (Ⅱ)

[0091] In formula (I) and (II), ||.|| 2 Indicates L 2 norm;

[0092] L 1Minimize the difference between the teacher model and the student model, L 2 Minimize the reconstruction value of the student model and the input X cur differences;

[0093] The final training objective of the student model is shown in formula (III):

[0094] L = α||TM(X cur )-SM(X cur )|| 2 +β||X cur -SM(X cur )|| 2 (III)

[0095] In formula (III), α+β=1, α and β are balance parameters used to weigh the importance of the teacher model and the student model.

[0096] In step 3, in the incremental update phase, assume that X represents a batch of unknown label data that arrives each time, input X into the trained student model, and output the anomaly score of each batch of data X; assume that X cur Indicates the current batch input, X nor Indicates that the trained student model will X cur The data in is the set of data points marked as normal at the time point, X abnor Indicates that the single-class support vector machine model SVM transforms X nor The data points in X are marked as abnormal data points. nor -X abnor Represented as the newly arrived data to be incrementally trained; the newly arrived data to be incrementally trained is divided into a set D 1 and set D 2 , assuming D 1 Used to retrain the student model, D 2 Used for early stopping. D 1 and D 2 The ratio is 3:1;

[0097] In step 4, assume that S(X cur ) represents the abnormal score set of the current batch input, S(X pre ) represents the abnormal score set of the previous batch of inputs, S(X cur ) and S(X pre ) are obtained through the student model; assuming S(B cur ) and S(B pre ) are respectively from S(X cur ) and S(X pre ), S(B cur ) and S(B pre ) are all [Smin ,S max ] as the boundary; calculate the reliability of the student model and determine whether the concept drift has occurred in the current batch of data. If so, go to step 6 to update the current student model, otherwise, no update is required.

[0098] In step 3, assume that V B Represents the reconstruction error vector of each batch of data, V B Each element in is represented by formula (IV):

[0099] e t =|x t -x′ t | (IV)

[0100] In formula (IV), x t represents the original data point at time t, x′ t represents the reconstructed value at time t, e t represents the reconstruction error at time t;

[0101] Assume that set D 2 There are B data points in the equation (IV). The reconstruction error e corresponding to each data point is calculated according to equation (IV). t , and finally obtain the reconstruction error vector V of this batch of data B , reconstruct the error vector V B The mean of is represented by μ, and the reconstructed error vector V B The variance is represented by ∑, and the normal distribution N(μ,∑) is obtained. For the current batch input X cur At each time point x t , anomaly score A t It is represented by formula (V):

[0102] A t =(e t -μ) T ∑ -1 (e t -μ) (V)

[0103] In formula (V), A t is time point x t The anomaly score of t Calculate the anomaly score A t , if the anomaly score A t >τ, then the time point is marked as abnormal, where τ is the threshold.

[0104] The threshold τ is obtained through the grid search method, and the specific implementation process is as follows:

[0105] For the current batch input X cur At each time point xt , both use formula (V) to calculate the anomaly score A t , assuming that the maximum value of the anomaly score is A MAX , the minimum value of the anomaly score is A MIN , in A MIN and A MAX Generate 100 values ​​evenly between them, use the exhaustive method to run all the 100 values, and select the value with the largest F1 score among the 100 values ​​as the threshold τ.

[0106] In step 3, the retraining data required for updating the student model is expressed as formula (VI):

[0107] X recur =X nor -X abnor (VI)

[0108] In formula (VI), X recur Represents the training dataset required for updating the student model in the current batch.

[0109] In step 4, S(B cur ) and S(B pre ) Applying the Hoeffding inequality:

[0110]

[0111] In formula (VII), b=|B cur |=|B pre |,ε=|avg(S(B cur ))-avg(S(B pre ))|,S min =min(min(S(B cur )),min(S(B pre ))),S max =max(max(S(B cur )),max(S(B pre ))).

[0112] In step 4, the reliability R of the student model M It is expressed as:

[0113]

[0114] In step 5, assume that X recur The training data set required for updating the student model in the current batch, X repre The training data set required for updating the student model in the previous batch, SM 1 Is to use the current batch X recurTrained student model, SM 2 Is to use the previous batch of X repre The trained student model, θ 1 For SM 1 The model parameters, θ 2 For SM 2 The model parameters of the updated new student model are expressed as: θ = ω 1 *θ 1 +ω 2 *θ 2 ; Among them, ω 1 For SM 1 The model parameter coefficient, ω 2 For SM 2 The model parameter coefficients are ω 2 =1-ω 1 , τ R is the reliability threshold of the model, γ is a user-defined adjustable parameter, 0<γ<1.

[0115] This example selects four real datasets with known concept drift and three real datasets with unknown drift for verification. The four real datasets with known concept drift are INSECTS-Abr, INSECTS-Inc, INSECTS-IncGrd, and INSECTS-IncRec. The three real datasets with unknown drift are the BATADAL dataset, the safe water treatment (SWaT) dataset, and the safe water distribution (WADI) dataset provided by the Cyber ​​Security Research Center of Singapore University of Technology and Design.

[0116] The experimental conditions of this embodiment are as follows:

[0117] A high-performance server, Windows 10 64-bit system, Python compilation environment, and Pytorch framework.

[0118] The performance of the model is evaluated by AvgAUC, which represents the real-time AUC value of the model and reflects the overall classification performance of the model. The specific definition is as follows:

[0119]

[0120] Where T represents all online time steps, AUC t Represents the real-time AUC value of the model at timestamp t.

[0121] For ease of understanding, the present invention is described below with specific examples:

[0122] Step 1: Get the initial training set and train the initial model.

[0123] Get the initial training data sets of INSECTS-Abr, INSECTS-Inc, INSECTS-IncGrd, INSECTS-IncRec, BATADAL, SWaT and WADI respectively. In this example, the length of the initial training set of INSECTS-Abr, INSECTS-Inc, INSECTS-IncGrd, and INSECTS-IncRec is 10000 (i.e., 10000 data points), the length of the initial training set of BATADAL is 8761, the length of the initial training set of SWaT is 496800, and the length of the initial training set of WADI is 784571. Use the initial training set to train the teacher model and the one-class support vector machine model.

[0124] Step 2: Train the student model using real-time data stream.

[0125] The training objectives of the student model are divided into two parts. One part is to narrow the gap between the teacher model and the student model, and the other part is to narrow the gap between the reconstructed value of the student model and the input value to ensure that the student model learns knowledge from known distribution data and unknown distribution data.

[0126] In this example, the values ​​of the balance parameters α and β are 0.1 and 0.9 respectively. The larger the α, the more attention the student model pays to the data with known distribution, while the larger the β, the more attention the student model pays to the data with unknown distribution. Choosing appropriate α and β can help improve the performance of the model.

[0127] Step 3: Use the student model to perform anomaly detection on the current batch data stream, obtain the anomaly score set of the current batch data, and obtain the new data needed to update the model.

[0128] In this example, the batch size is set to 1000, and anomaly detection is performed on the current batch data stream to obtain the anomaly score set of the current batch data. Data with anomaly scores exceeding the threshold τ are marked as abnormal, and the marked normal data are used as the input of the single-class support vector machine model. The outlier removal operation is performed on these marked normal data to obtain new data that can be used to update the model.

[0129] Step 4: Calculate the reliability of the model using the anomaly score set.

[0130] The old student model is used to calculate the anomaly score set of the current batch of data and the previous batch of data respectively, and the reliability of the model is calculated according to the Hoeffding inequality.

[0131] In this example, FIG. 2(a) is a temperature change curve on the INSECTS_Abr dataset, FIG. 2(b) is a model reliability change diagram of the present invention on the INSECTS_Abr dataset, FIG. 3(a) is a temperature change curve on the INSECTS_Incr dataset, FIG. 3(b) is a model reliability change diagram of the present invention on the INSECTS_Incr dataset, FIG. 4(a) is a temperature change curve on the INSECTS_IncrGrd dataset, FIG. 4(b) is a model reliability change diagram of the present invention on the INSECTS_IncrGrd dataset, FIG. 5(a) is a temperature change curve on the INSECTS_IncrRecr dataset, and FIG. 5(b) is a model reliability change diagram of the present invention on the INSECTS_IncrRecr dataset. In the four real datasets of known concept drift, INSECTS_Abr, INSECTS_Incr, INSECTS_IncrGrd and INSECTS_IncrRecr, temperature represents the concept, and at the position where the concept changes, it can be observed that the reliability of the model of the present invention decreases.

[0132] Step 5: Calculate the parameter coefficients of the new and old student models based on model reliability, and use the model parameter coefficients to update the model.

[0133] According to the reliability of the current student model R M Calculate the parameter coefficients θ of the new and old student models 1 ,θ 2 , and then use the model parameter coefficients to merge the new and old student models to obtain a new model.

[0134] In this example, the value of γ is 0.5.

[0135] The results are shown in Table 1, which is a performance comparison table of the present invention on seven datasets: INSECTS-Abr, INSECTS-Inc, INSECTS-IncGrd, INSECTS-IncRec, BATADAL, SWaT and WADI.

[0136] Table 1

[0137]

[0138] The time efficiency is evaluated on seven datasets: INSECTS-Abr, INSECTS-Inc, INSECTS-IncGrd, INSECTS-IncRec, BATADAL, SWaT and WADI. Figure 6(a) shows the running time of the present invention in the initialization phase. Figure 6(b) shows the running time of the present invention in the incremental update phase. The present invention takes less than four seconds to process a batch of 1,000 data points, which is efficient enough for high-dimensional data streams.

[0139] Example 3

[0140] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the industrial control network anomaly detection method oriented to concept drift described in embodiment 1 or 2 are implemented.

[0141] Example 4

[0142] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the industrial control network anomaly detection method for concept drift in embodiment 1 or 2.

Claims

1. A concept drift-oriented industrial control network anomaly detection method, characterized in that: include: Step 1: Obtain the initial training set and train the initial model: Use the initial training set to train the teacher model and the single-class support vector machine model; Step 2: Train the student model using real-time data stream; Step 3: Use the student model to perform anomaly detection on the current batch data stream, obtain the anomaly score set of the current batch data, and obtain the new data required to update the student model; Step 4: Calculate the reliability of the student model using the anomaly score set; Step 5: Calculate the parameter coefficients of the new and old student models based on the reliability of the student model, and use the model parameter coefficients to update the student model; Step 6: Use the student model updated in step 5 to calculate the anomaly score for each data point in the current batch of data streams. Data points with anomaly scores greater than the threshold τ are considered abnormal, otherwise they are normal. In step 1, in the industrial control network, d time series are collected by d devices under normal operation of the industrial control system. The d time series are historical data sets containing only normal behaviors. initial represents an initial training set containing only normal behaviors, i.e., a historical data set containing only normal behaviors; TM represents a teacher model based on an autoencoder; SVM represents a single-class support vector machine model; Initialization phase, X initial As a training set to train the teacher model TM, and train a single-class support vector machine model SVM; In step 2, X cur represents the data stream of the current batch; SM represents a student model based on an autoencoder, which converts the data stream of the current batch X cur Input into the student model SM, output X cur Reconstruction of SM(X cur ) represents the reconstruction of the data stream of the current batch by the student model; the data stream of the current batch X cur Input into the teacher model TM, output X cur Reconstruction of TM(X cur ) represents the reconstruction of the data stream of the current batch by the teacher model; the student model is trained. During the student model training phase, the back propagation of the teacher model is cut off and only the parameters of the student model are updated; In step 3, in the incremental update phase, X represents a batch of unknown label data that arrives each time. X is input into the trained student model, and the anomaly score of each batch of data X is output; X cur Indicates the current batch input, X nor Indicates that the trained student model will X cur The data in is the set of data points marked as normal at the time point, X abnor Indicates that the single-class support vector machine model SVM transforms X nor The data points in X are marked as abnormal data points. nor -X abnor Represented as the newly arrived data to be incrementally trained; the newly arrived data to be incrementally trained is divided into set D1 and set D2, D1 is used for retraining the student model, and D2 is used for early stopping; In step 3, V B Represents the reconstruction error vector of each batch of data, V B Each element in is represented by formula (IV): e t =|x t -x t ′|(Ⅳ) In formula (IV), x t represents the original data point at time t, x t ′ represents the reconstructed value at time t, e t represents the reconstruction error at time t; There are B data points in set D2. The reconstruction error e corresponding to each data point is calculated according to formula (IV): t , and finally obtain the reconstruction error vector V of this batch of data B , reconstruct the error vector V B The mean of is represented by μ, and the reconstructed error vector V B The variance is represented by ∑, and the normal distribution N(μ,∑) is obtained. For the current batch input X cur At each time point x t , anomaly score A t It is represented by formula (V): A t =(and t -μ) T ∑ -1 (and t -μ)(Ⅴ) In formula (V), A t is time point x t The anomaly score of t Calculate the anomaly score A t , if the anomaly score A t >τ, then the time point is marked as abnormal, where τ is the threshold; In step 3, the retraining data required for updating the student model is expressed as formula (VI): X recur =X nor -X abnor (Ⅵ) In formula (VI), X recur Represents the training data set required to update the student model in the current batch; In step 4, S(X cur ) represents the abnormal score set of the current batch input, S(X pre ) represents the abnormal score set of the previous batch of inputs, S(X cur ) and S(X pre ) are obtained through the student model; S(B cur ) and S(B pre ) are respectively from S(X cur ) and S(X pre ), S(B cur ) and S(B pre ) are all [S min ,S max ] as the boundary; calculate the reliability of the student model and determine whether the concept drift occurs in the current batch of data. If so, proceed to step 6 to update the current student model. Otherwise, no update is required. In step 4, S(B cur ) and S(B pre ) Applying the Hoeffding inequality: In formula (VII), b=|B cur |=|B pre |,ε=|avg(S(B cur ))-avg(S(B pre ))|,S min =min(min(S(B cur )),min(S(B pre ))),S max =max(max(S(B cur )),max(S(B pre ))); In step 4, the reliability R of the student model M It is expressed as: In step 5, X recur The training data set required for updating the student model in the current batch, X repre The training data set required for updating the student model in the previous batch is used in SM1. recur The student model of training, SM2 is to use the previous batch X repre The trained student model, θ1 is the model parameter of SM1, θ2 is the model parameter of SM2, then the parameters of the updated new student model are expressed as: θ = ω1*θ1+ω2*θ2; where ω1 is the model parameter coefficient of SM1, ω2 is the model parameter coefficient of SM2, ω2=1-ω1,τ R is the reliability threshold of the model, γ is a user-defined adjustable parameter, 0<γ<1.

2. The method for detecting anomalies in industrial control networks based on concept drift according to claim 1, characterized in that: The training objectives of the student model are shown in formulas (I) and (II): L1=||TM(X cur )-SM(X cur )||2(Ⅰ) L2=||X cur -SM(X cur )||2(Ⅱ) In formula (I) and (II), ||.||2 represents the L2 norm; L1 minimizes the difference between the teacher model and the student model, and L2 minimizes the difference between the reconstruction value of the student model and the input X cur differences; The final training objective of the student model is shown in formula (III): L=α||TM(X cur )-SM(X cur )||2+β||X cur -SM(X cur )||2(Ⅲ) In formula (III), α+β=1, α and β are balance parameters used to weigh the importance of the teacher model and the student model.

3. The method for detecting anomalies in industrial control networks based on concept drift according to claim 2, characterized in that: The values ​​of α and β are 0.1 and 0.9 respectively.

4. The method for detecting anomalies in industrial control networks based on concept drift according to claim 1, characterized in that: The value of γ is 0.

5.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the industrial control network anomaly detection method oriented to concept drift described in any one of claims 1 to 4 are implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the industrial control network anomaly detection method oriented to concept drift described in any one of claims 1 to 4 are implemented.

Images