Dual-model fusion anomaly detection method and device for distinguishing sensors from actuators

Abstract

The application belongs to the technical field of industrial production and relates to a dual-model fusion anomaly detection method and device for distinguishing sensors and actuators, computer equipment and a storage medium. The method comprises the following steps: dividing industrial process data nodes into sensor nodes and actuator nodes; constructing a sensor node relationship graph and an actuator node relationship graph based on the sensor nodes and the actuator nodes; constructing a sensor anomaly detection model based on operation rules and an actuator anomaly detection model based on control rules based on the sensor node relationship graph and the actuator node relationship graph; performing sensor anomaly detection based on the sensor anomaly detection model and performing actuator anomaly detection based on the actuator anomaly detection model; and fusing the sensor anomaly detection and the actuator anomaly detection. The expert knowledge is easy to obtain and has universality. The false alarm rate of anomaly detection can be reduced, and the problem of missed anomaly detection can be avoided. The recall rate, accuracy and F1 score and other evaluation indexes have strong advantages.

Description

Technical Field

[0001] This invention relates to the field of industrial production technology, and in particular to a dual-model fusion anomaly detection method, apparatus, computer equipment, and storage medium that distinguishes between sensors and actuators. Background Technology

[0002] While expert knowledge-based research has achieved good anomaly detection performance, expert knowledge is difficult to acquire and lacks universality, making it difficult to adapt the methods to different industrial production processes. Existing data-driven research assumes that industrial processes are completely unknown, and with training sets that cannot fully cover all situations, models struggle to reduce false alarm rates and may even miss anomalies. Evaluation metrics also have flaws; current research relies on metrics such as recall, precision, and F1 score, neglecting attack-specific evaluation metrics. Some detection schemes achieve high scores on evaluation metrics but miss attacks. Summary of the Invention

[0003] The purpose of this invention is to propose a dual-model fusion anomaly detection method, device, computer equipment, and storage medium that distinguishes between sensors and actuators, in order to solve the problem of the difficulty in reducing the false alarm rate of anomaly detection in industrial production processes in the prior art.

[0004] To address the aforementioned technical problems, this invention provides a dual-model fusion anomaly detection method that distinguishes between sensors and actuators, employing the technical solution described below, including the following steps:

[0005] Industrial process data nodes are divided into sensor nodes and actuator nodes;

[0006] Based on the sensor nodes and the actuator nodes, a sensor node relationship diagram and an actuator node relationship diagram are constructed respectively;

[0007] Based on the sensor node relationship diagram and actuator node relationship diagram, a sensor anomaly detection model based on operating rules and an actuator anomaly detection model based on control rules are constructed respectively.

[0008] Sensor anomaly detection is performed based on the aforementioned sensor anomaly detection model, and actuator anomaly detection is performed based on the aforementioned actuator anomaly detection model.

[0009] The sensor anomaly detection is fused with the actuator anomaly detection.

[0010] Preferably, the step of dividing the industrial process data nodes into sensor nodes and actuator nodes specifically includes:

[0011] Define the set of sensor nodes as Define the set of executor nodes as Contains M s Nodes, Contains M a If there are nodes, then there are in M represents the set of all nodes in an industrial process, where M represents the total number of nodes.

[0012] The vector x of the dataset at any time t t Divided into sensor vectors s t and executor vector a t ,in Indicates sensor node The value of time t, Indicates the actuator node The value of time t.

[0013] Preferably, the step of constructing a sensor node relationship diagram and an actuator node relationship diagram based on the sensor nodes and the actuator nodes respectively specifically includes:

[0014] Based on the sensor nodes, construct a relationship graph between the industrial process data nodes and the sensor nodes;

[0015] Based on the actuator node, construct a relationship graph between the industrial process data node and the actuator node.

[0016] Preferably, the steps of constructing a sensor anomaly detection model based on operational rules and an actuator anomaly detection model based on control rules based on the sensor node relationship diagram and the actuator node relationship diagram specifically include:

[0017] Based on the sensor node relationship diagram and actuator node relationship diagram, the sensor and actuator nodes of the process data are distinguished;

[0018] An aggregation function is designed using historical sensor information and actuator change information, and a sensor GNN prediction model based on the node relationship graph of the sensor is constructed to predict the operating rules.

[0019] An aggregation function is designed based on historical sensor information and changing trends, and an actuator GNN prediction model for control rules is constructed based on the node relationship graph for the actuator.

[0020] Preferably, the step of performing sensor anomaly detection based on the sensor anomaly detection model specifically includes:

[0021] Calculate the abnormal thresholds for each sensor;

[0022] Based on the sensor anomaly detection model, after training is completed, the absolute value vector of each sensor error at each time step in the training set is calculated as the anomaly evaluation score vector.

[0023] Calculate the mean and standard deviation of the errors of each sensor at all times;

[0024] Taking 3 times the standard deviation as the tolerance limit for anomaly monitoring, we obtain the anomaly detection threshold vector;

[0025] Using the anomaly detection threshold vector, the sensor anomaly detection model outputs a sensor anomaly label for a certain moment in the test set. A label value of 0 indicates normal operation, and a value of 1 indicates anomaly.

[0026] The sensor anomaly detection model outputs a test set of sensor anomaly detection labels.

[0027] Preferably, the step of performing actuator anomaly detection based on the actuator anomaly detection model specifically includes:

[0028] Calculate the abnormal thresholds for each sensor;

[0029] For any executor node n i The training set is divided into stable and unstable states at T time points. Assuming the actuator n is at time t i A state change has occurred, and the timestamps t-1, t, and t+1 are recorded as unstable states. After traversing all T timestamps, all timestamps that were recorded as unstable states are now recorded as stable states.

[0030] The maximum cross-entropy loss value between the two states is taken as the actuator node n. i The abnormal thresholds for the two states are calculated by statistically analyzing the abnormal thresholds for the two states of all actuator nodes, resulting in the abnormal threshold vectors for stable and unstable states.

[0031] During anomaly detection, for a certain time t′, first determine whether all actuators are in a stable or unstable state at time t′, and then obtain the threshold from the corresponding anomaly threshold vector to obtain the anomaly detection threshold at time t′.

[0032] The actuator anomaly label at time t′ is calculated;

[0033] The actuator anomaly detection model outputs test set actuator anomaly detection labels.

[0034] Preferably, the step of fusing the sensor anomaly detection with the actuator anomaly detection specifically includes:

[0035] An offline modeling approach was adopted, using training set data to train sensor and actuator models, and then calculating sensor and actuator thresholds.

[0036] An online detection method was adopted, in which the test set data was fed into the sensor model and actuator model for detection, respectively, to obtain sensor anomaly scores and actuator anomaly scores;

[0037] The sensor anomaly detection tag and the actuator anomaly detection tag are calculated and fused using a logical OR operation to obtain a new anomaly detection tag.

[0038] To address the aforementioned technical problems, this invention also provides a dual-model fusion anomaly detection device that distinguishes between sensors and actuators, employing the technical solution described below, including:

[0039] The classification module is used to divide industrial process data nodes into sensor nodes and actuator nodes;

[0040] The node relationship graph construction module is used to construct a sensor node relationship graph and an actuator node relationship graph based on the sensor nodes and the actuator nodes, respectively.

[0041] The anomaly detection model construction module is used to construct a sensor anomaly detection model based on operating rules and an actuator anomaly detection model based on control rules, respectively, based on the sensor node relationship diagram and the actuator node relationship diagram.

[0042] Anomaly detection module is used to perform sensor anomaly detection based on the sensor anomaly detection model and actuator anomaly detection based on the actuator anomaly detection model;

[0043] The fusion module is used to fuse the sensor anomaly detection with the actuator anomaly detection.

[0044] To address the aforementioned technical problems, the present invention also provides a computer device that employs the technical solution described below, comprising a memory and a processor. The memory stores computer-readable instructions, and the processor, when executing the computer-readable instructions, implements the steps of the aforementioned dual-model fusion anomaly detection method for distinguishing between sensors and actuators.

[0045] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium, which employs the technical solution described below. The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the aforementioned dual-model fusion anomaly detection method for distinguishing between sensors and actuators.

[0046] Compared with the prior art, the present invention has the following main advantages: Implementing this embodiment has the following advantages:

[0047] Considering the characteristics of closed-loop systems in industrial production processes, nodes are classified into sensors and actuators. Based on this, a node relationship graph learning method based on prior knowledge is proposed to provide a node relationship graph that conforms to the physical process for subsequent anomaly detection models based on graph networks.

[0048] A method for anomaly detection based on the fusion of operational rules and control rules is proposed. An aggregation function is designed using historical sensor information and actuator change information. A GNN prediction model for operational rules is constructed based on the node relationship graph of the sensor. An aggregation function is designed using historical sensor information and change trends. A GNN prediction model for control rules is constructed based on the node relationship graph of the actuator.

[0049] Finally, based on the detection results of the two models, fusion anomaly detection is performed, and a complete anomaly detection process is provided.

[0050] It makes expert knowledge readily available and universal, and easy to adapt to different industrial production processes; even when the data training set cannot fully cover all situations, it can still reduce the false alarm rate of anomaly detection, while also avoiding the problem of missed anomaly detection; it has strong advantages in evaluation indicators such as recall, precision, and F1 score. Attached Figure Description

[0051] To more clearly illustrate the solutions in this invention, the accompanying drawings used in the description of the embodiments of this invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0052] Figure 1 This is a flowchart of an embodiment of the dual-model fusion anomaly detection method for distinguishing between sensors and actuators according to the present invention;

[0053] Figure 2 This is a schematic diagram of the structure of a closed-loop system for industrial processes in existing technologies;

[0054] Figure 3 This is a schematic diagram of the spatial relationship between the first and second processes of the SWaT water treatment process in the prior art;

[0055] Figure 4 This is a flowchart of the fusion anomaly detection method used in the dual-model fusion anomaly detection method for distinguishing between sensors and actuators in this invention;

[0056] Figure 5 This is a schematic diagram of the structure of an embodiment of the dual-model fusion anomaly detection device for distinguishing between sensors and actuators according to the present invention;

[0057] Figure 6 This is a schematic diagram of the structure of an embodiment of the computer device of the present invention. Detailed Implementation

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the invention; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects and not to describe a particular order.

[0059] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0060] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0061] Example 1

[0062] Continue to refer to Figure 1 The flowchart illustrates an embodiment of the dual-model fusion anomaly detection method for distinguishing between sensors and actuators according to the present invention. The dual-model fusion anomaly detection method for distinguishing between sensors and actuators includes the following steps:

[0063] Step S1: Divide the industrial process data nodes into sensor nodes and actuator nodes.

[0064] In this embodiment, the electronic device (e.g., a server / terminal device) on which the dual-model fusion anomaly detection method for distinguishing between sensors and actuators runs can receive dual-model fusion anomaly detection requests for distinguishing between sensors and actuators via wired or wireless connections. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G / 5G connections, WiFi connections, Bluetooth connections, WiMAXX connections, Zigbee connections, UWB (ultra-wideband) connections, and other currently known or future known wireless connection methods.

[0065] Define the set of all data nodes in the industrial process as It contains M nodes, where the element n i This represents any node in the industrial process. The training set is defined as matrix X, which contains data at T time points, X = [x 1 ,x 2 ,...,x T ]∈R M×T is an M×T matrix, where the elements x t This refers to the values ​​of all M nodes at any given time t. in For nodes The value of X′ at time t. Similar to the training set, the test set is defined as matrix X′∈R. M×T′ The training set contains M identical variables and data from T′ time points. All time points in the training set are normal data, while the test set contains labeled data Y = [y...]. 1 ,y 2 ,…,y T ], where y t ∈{0,1},y t =1 indicates that time t has an anomaly.

[0066] To achieve anomaly detection, a model needs to be built, taking the test set data X′ as input and outputting a label set. Determine if there are any anomalies in the test set data.

[0067] Figure 2 This is a schematic diagram of a closed-loop system structure for industrial processes in existing technologies. For example... Figure 2 As shown, a typical industrial process closed-loop system consists of sensors, controllers, actuators, and physical devices. The physical process of production is realized through the operation of the physical devices. Sensors continuously monitor various indicators of the physical devices; the controller calculates and outputs control commands based on the sensor data and operator instructions; the actuators execute the control commands to keep the physical process constant or change its state. These four parts form a closed-loop system. Figure 2 The closed-loop control circuit shown is also the closed-loop system of an industrial process. The sensor and actuator data are collected by the Supervisory Control and Data Acquisition (SCADA) system and can be directly observed; while the controller and physical process imply the operating rules of the industrial process and cannot be directly observed.

[0068] Therefore, existing industrial process anomaly detection can be summarized into the following two steps:

[0069] Firstly, by training on a centralized set of sensor and actuator data, we attempt to construct rules hidden within the controller and physical processes;

[0070] Secondly, the test set is used to check whether the sensor and actuator data conform to the established rules.

[0071] Based on the above analysis, industrial process data nodes can be divided into sensor nodes and actuator nodes. In specific implementation, step S1 may further include the following steps:

[0072] S11. Define the sensor node set as follows: Define the set of executor nodes as Contains M s Nodes, Contains M a If there are nodes, then there are in Let M represent the set of all nodes in the industrial process, and let M represent the number of nodes in the industrial process.

[0073] S12, the vector x of the dataset at any time t. t Divided into sensor vectors s t and executor vector a t ,in white Indicates sensor node The value of vector a at time t t Middle elements Indicates the actuator node The value of time t.

[0074] There are significant differences between sensor nodes and actuator nodes, as detailed below:

[0075] First, the data types are different. Sensor nodes generally contain continuous data, which is typically stored as floating-point numbers; while actuator nodes generally contain discrete data, which is typically stored as integers.

[0076] Secondly, their functions differ. Actuator nodes can be actively modified via operator commands, providing a direct means of influencing the physical process; sensor nodes, on the other hand, passively monitor various values ​​of the industrial process, reflecting its status.

[0077] Third, the implicit rules differ. Changes to actuators should follow the control rules implicit in the controller; while sensor values ​​should conform to the laws implicit in the physical process.

[0078] The difference in implicit rules is particularly important. Existing research on anomaly detection models does not distinguish between the control rules implicit in the controller and the laws implicit in the physical process. Therefore, this invention constructs separate anomaly detection models for the operating laws and control rules followed by sensors and actuators, and designs a fusion anomaly detection method. This method can reduce the false alarm rate and improve the situation of missed anomaly detection.

[0079] It is worth noting that the training inputs of the models all contain sets. All nodes in the set, only the output is for the set. and

[0080] Step S2: Based on the sensor nodes and actuator nodes, construct the sensor node relationship diagram and the actuator node relationship diagram respectively.

[0081] Prior knowledge in industrial production processes includes entity attributes, sensor attributes, actuator attributes, and spatial relationships between entities. Entity attributes, specifically, require knowing whether a data node in the dataset is a sensor or an actuator. Sensor attributes include temperature, water flow rate, and pressure values; actuator attributes include valve on / off status and water pump on / off status. Spatial relationships between entities, specifically, require knowing the spatial relationships between physical devices, such as the attachment of sensors and actuators to physical devices.

[0082] These prior knowledge points are essential and readily available in industrial production processes, and using them, the relationships between nodes in the industrial process can be accurately described. Therefore, this invention assumes that these prior knowledge points are available and constructs a node relationship graph for the industrial process based on this assumption.

[0083] Physical spatial relationships include the spatial relationships between physical devices, while sensors and actuators are attached to physical devices. Figure 3 This is a schematic diagram illustrating the spatial relationship between the first and second processes in the existing SWaT water treatment process. (Example:) Figure 3 As shown, the process includes three physical devices: a raw water inlet pipe, a raw water storage tank, and a reagent mixing pipeline; three sensors: FIT101, LIT101, and FIT201; and four actuators: MV101, P101, P102, and MV201; totaling 10 items. The three physical devices are spatially connected sequentially. The three sensors belong to the three physical devices in sequence. Of the four actuators, MV101 belongs to the raw water inlet pipe, while P101, P102, and MV201 belong to the actual mixing pipeline. During the physical process, raw water enters the storage tank from the raw water inlet pipe and then flows out through the reagent mixing pipeline into the UF input storage tank in process 3.

[0084] The objective of this invention is to distinguish between sensors and actuators in industrial process data nodes. Therefore, the neighborhood information of nodes presented in the node relationship graph refers to nodes that directly influence the prediction of sensor (actuator) nodes within the operating rules (control rules). Since the influence of actuators and sensors is not necessarily mutual within the operating rules and control rules, a directed graph is chosen to construct the node relationship graph.

[0085] In this embodiment, step S2 may further include the following steps:

[0086] S21. Based on sensor nodes, construct a relationship diagram between industrial process data nodes and sensor nodes.

[0087] To understand the operational principles followed by sensors, it is necessary to construct a graph showing the relationship between all data nodes and sensor nodes in the industrial process. and picture picture The figure illustrates the effect of one sensor on another. This indicates the influence of the actuator on the sensor. In the operational patterns of industrial processes, sensors on adjacent physical devices are more likely to influence each other. For example, sensor LIT101 on TANK1 and sensor FIT101 on PIPE1 should be considered to influence each other during anomaly detection. A graph can be constructed using the following algorithm.

[0088]

[0089]

[0090] The above algorithm inputs a sensor set And all physical spatial relationships in the industrial process, output diagram Middle node set The edge set is constructed based on the spatial relationships between entities in the industrial process. It should be noted that the graph... A self-loop containing all sensor nodes.

[0091] picture The construction algorithm is as follows:

[0092]

[0093] S22. Based on the actuator node, construct a relationship graph between the industrial process data node and the actuator node.

[0094] To determine the control rules followed by the actuator, a graph showing the relationships between all nodes and actuator nodes needs to be constructed. and picture picture The diagram illustrates the effect of one actuator on another. This indicates the effect of the sensor on the actuator. In the control rules, the state of the actuator is not affected by other actuators. For example, actuators P101 & P102 and MV201 in pipe PIPE2 will not affect each other in the control rules. Therefore, it is not necessary to construct a relationship diagram. Or it can be considered a relationship diagram Its adjacency matrix is ​​a diagonal matrix.

[0095] picture This indicates the impact of sensors on actuators. Since actuators do not affect each other in the control rules, sensors in adjacent physical devices are also considered to have an impact. For example, actuator MV201 in pipe PIPE2, sensor LIT101 in adjacent entity TANK1, and sensor FIT201 in PIPE2 all have an impact on it according to the control rules.

[0096] picture The construction algorithm is as follows:

[0097]

[0098] The above construction diagram The method inputs a full node set. Sensor set Actuator set And all physical spatial relationships in the industrial process, output diagram Middle node set Directed edge e =<u,v> Constructed based on the spatial relationships of industrial processes, its starting point end

[0099] Step S3: Based on the sensor node relationship diagram and the actuator node relationship diagram, construct a sensor anomaly detection model based on operating rules and an actuator anomaly detection model based on control rules, respectively.

[0100] In this embodiment, step S3 may further include the following steps:

[0101] S31. Design an aggregation function based on historical sensor information and actuator change information, and construct a sensor GNN prediction model based on the node relationship graph of the sensor to predict the operating rules.

[0102] Graph Neural Networks (GNNs) are a general term for algorithms that use neural networks to learn graph-structured data, extract and discover features and patterns in graph-structured data, and meet the needs of graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0103] Existing methods fail to distinguish between sensor and actuator nodes and assume that industrial processes are completely unknown, neglecting to consider physical processes when designing the aggregation function of the GNN model. Such data-driven anomaly detection methods cannot differentiate between operational patterns and control rules, relying solely on learning the spatiotemporal patterns presented in the training set for anomaly detection. This leads to excessively high false alarm rates and missed anomalies.

[0104] This invention, based on a pre-constructed node relationship graph, distinguishes between sensor and actuator nodes in process data, and constructs multivariate prediction models based on GNNs for each, targeting operational patterns and control rules respectively. These models learn the operational patterns and control rules of the industrial process; in other words, they can predict sensor and actuator outputs based on these patterns and rules respectively.

[0105] As with other neural network modeling schemes, the training set first needs to be normalized to its minimum and maximum values ​​before being input into the model for training.

[0106] The interaction between sensors is captured through a linear combination method. Specifically, the number of sensors n is calculated using Equation 1. i Aggregated information from neighborhood sensors at time t

[0107]

[0108] in Indicates sensor n i The neighborhood of the graph constructed above. It can obtain neighborhood information of any sensor; It is sensor n j The value of α at time t-1; j,i These are trainable weight parameters, representing the sensor n j For sensor n i The influence weight.

[0109] S32. Design an aggregation function based on sensor historical information and change trends, and construct an actuator GNN prediction model for control rules based on the node relationship graph for the actuator.

[0110] Then, the model also needs to capture the impact of actuator state changes on the sensor. In actual industrial processes, there is a certain time delay between the change in actuator state and the actual numerical fluctuation detected by the sensor. Therefore, it is necessary to capture the actuator data a from time tr to time t. t-r ,…,a t All of these are input into the model. Specifically, the sensor n is calculated using Formula 2. i At time t, it is affected by the change in the actuator state.

[0111]

[0112] in, Indicates sensor n i The actuator neighborhood, that is The graph constructed above It can obtain actuator neighborhood information for any sensor; β j,i These are trainable weight parameters, representing the executor For sensor n i Influence weight; Indicates actuator n j The cumulative state change information from time tr to time t is calculated as shown in Formula 3.

[0113]

[0114] in, It is actuator n j The value at time l, also known as the actuator state, is determined by adding the aggregated information from neighboring sensors to the effect of the actuator state change, thus obtaining the sensor n at time t. i The predicted values ​​are shown in Formula 4.

[0115]

[0116] Model output M at time t s Predicted value vector of each sensor node Model calculation model output vector and the actual vector s t The mean square error is used as the loss function to train the model as shown in Equation 5, where ||·|2 represents the 2-norm of the vector.

[0117]

[0118] Step S4: Perform sensor anomaly detection based on the sensor anomaly detection model, and perform actuator anomaly detection based on the actuator anomaly detection model.

[0119] In some optional implementations of this embodiment, step S4, which involves detecting sensor anomalies based on a sensor anomaly detection model, may further include the following steps:

[0120] S411. Calculate the abnormal threshold of each sensor.

[0121] S412. Based on the sensor anomaly detection model, after training, calculate the absolute value vector E of the error of each sensor at each time step in the training set. t As an anomaly evaluation score vector, it is shown in Formula 6.

[0122]

[0123] S413. Calculate the mean error E of each sensor at all times. μ With standard deviation E σ As shown in Formula 7.

[0124]

[0125]

[0126] Here, E t E μ and E σ All are M s Dimensional vector.

[0127] S414. Take 3 times the standard deviation as the tolerance limit for anomaly monitoring to obtain the anomaly detection threshold vector A, as shown in Formula 9.

[0128] A = E μ +3E σ (Formula 9)

[0129] S415. Using the anomaly detection threshold vector A, the sensor anomaly detection model outputs the sensor anomaly label for a certain time t′ in the test set. A value of 0 indicates normal operation, while a value of 1 indicates abnormal operation. See Formula 10.

[0130]

[0131] The CountNeg() function counts the number of elements less than zero in a vector.

[0132] S416, Sensor anomaly detection model output test set, sensor anomaly detection labels

[0133] Similar to sensor models, actuator anomaly detection models aim to learn industrial process control rules. Based on these control rules, actuator outputs can be predicted. These control rules can be described as the influence of industrial process nodes on actuator nodes, and can be categorized into actuator-to-actuator influence and sensor-to-actuator influence.

[0134] In the control rules, the actuators themselves do not affect each other; only the sensors do. Specifically, the control rules do not determine the actuator's state at the next moment based on its current state, but rather on the sensor values ​​and their changing trends.

[0135] The neural network structure used to extract the overall features of a vector is called a parser. The parser first expands the dimensionality using a hidden fully connected layer to extract features, then restricts the feature output using a tanh activation function, and finally passes the features through a linear layer to transform them into the output dimension. The specific derivation formulas are shown in Equations 11 and 12.

[0136] z i = h v i + h (Formula 11)

[0137] v o = l Tanh(z i )+ l (Formula 12)

[0138] Among them, v i Let z be the input vector. i The hidden features extracted by the Parser, w h b h w l b l These are the weight and bias matrices of the hidden fully connected layer and the linear output layer, respectively. Tanh() is the tanh activation function, and the final output vector is v. o Combining Formula 11 and Formula 12, the derivation formula for the parser is shown in Formula 13.

[0139] v o =Parser(v i )(Formula 13)

[0140] The model inputs sensor data s at times t-1 and t-2. t-1 With s t-2 Among them, s t-1 It is the value taken by the sensor, and the trend of the sensor's change is obtained by taking the difference s between two moments. t-1 -s t-2 The above-constructed graph g shows the input sensor values ​​and their changing trends. s,a Obtain each executor n i Value vector of neighborhood sensor With the trend vector As shown in Formula 14.

[0141]

[0142]

[0143] Among them, the elements in the vector ∈[1,v] is the sensor node nj The value of r at time r, It is the actuator node n i Sensors in the neighborhood.

[0144] Then, the value vector and the trend vector are fed into two parsers to extract features and then converted into output vectors. and As shown in Formulas 16 and 17.

[0145]

[0146]

[0147] Finally, the two output vectors are added together and the outputs are probabilized using the Softmax function to obtain the final output of the executor. As shown in Formula 18.

[0148]

[0149] vector and The dimension is the number of executor nodes n i The number of states, since the number of states for each actuator may be different, is uniformly set to the maximum number of states for all actuators, denoted as st. The model output M at time t... a Prediction matrix of each actuator node Then the executor of the time. The data is converted into one-hot encoded data, and the model is trained using the cross-entropy loss function, as shown in Equation 19.

[0150]

[0151] In some optional implementations of this embodiment, step S4, which involves performing actuator anomaly detection based on the actuator anomaly detection model, may further include the following steps:

[0152] S421. Calculate the abnormal threshold of each sensor.

[0153] Using cross-entropy loss value L t As an anomaly evaluation score, it is shown in Formula 20.

[0154]

[0155] In industrial processes, the actuator state remains unchanged for a large portion of the time, with changes occurring only a small fraction of the time. The loss value calculated by the model increases significantly when the actuator changes, and also before and after such changes. To improve anomaly detection accuracy, it is necessary to distinguish between a stable and unstable actuator state (when the actuator changes, and before and after such changes) and to statistically determine the anomaly thresholds for both scenarios.

[0156] S422. For any executor node n i The training set is divided into stable and unstable states at T time points. Assuming the actuator n is at time t i A state change has occurred, and the timestamps t-1, t, and t+1 are recorded as unstable states. After traversing all T times, all times that were recorded as unstable states are now stable states.

[0157] S423. Take the maximum cross-entropy loss value between the two states as the actuator node n. i The abnormal thresholds for the two states are calculated, and the abnormal thresholds for both states for all actuator nodes are statistically analyzed to obtain the stable state abnormal threshold vector and the unstable state abnormal threshold vector A. u .

[0158] S424. During anomaly detection, for a certain time t′, first determine whether all actuators are in a stable or unstable state at time t′, then obtain the threshold from the corresponding anomaly threshold vector to obtain the anomaly detection threshold A at time t′. t′ .

[0159] S425, Calculate the actuator anomaly label at time t′. As shown in Formula 21.

[0160]

[0161] S426, Actuator Anomaly Detection Model Output Test Set: Actuator Anomaly Detection Labels

[0162] Step S5: The sensor anomaly detection and actuator anomaly detection are fused together.

[0163] Using the two anomaly detection models mentioned above (sensor anomaly detection model and actuator anomaly detection model), the anomaly detection labels of the sensor and actuator at each time step can be obtained. and At any given moment, it is considered that an anomaly exists at that moment, whether it is an abnormal sensor tag, an abnormal actuator tag, or both.

[0164] Figure 4This is a flowchart of the fusion anomaly detection method used in the dual-model fusion anomaly detection method for distinguishing between sensors and actuators in this invention. Figure 4 As shown, in some optional implementations of this embodiment, step S5, the step of fusing sensor anomaly detection and actuator anomaly detection, specifically includes:

[0165] S51. Using an offline modeling approach, the sensor model and actuator model are trained using the training set data, and the sensor threshold and actuator threshold are calculated.

[0166] The offline modeling method can use training set data to train sensor and actuator models, and calculate sensor threshold A and actuator threshold A'. s and A u .

[0167] S52. Using an online detection method, the test set data is fed into the sensor model and actuator model for detection, respectively, to obtain the sensor anomaly score E. t Actuator anomaly score L t .

[0168] Two sets of anomaly labels can be calculated using Equations 10 and 21 based on the threshold. and

[0169] S53. Combine the sensor anomaly detection tag and the actuator anomaly detection tag by performing a logical OR operation to calculate and fuse the anomaly detection tag.

[0170] Since the anomaly detection tags of both sensors and actuators are data with values ​​of 0 or 1, the fused anomaly detection tag at a certain time t can be calculated using a logical OR operation. As shown in Formula 22.

[0171]

[0172] Using Formula 22, the fused anomaly detection labels are obtained by applying Formula 22 to the sensor and actuator anomaly detection labels at all times. The initial time t′ = max(3, r+1).

[0173] For example, the test results of the evaluation indicators obtained through experiments are shown in Table 1 below:

[0174] Table 1 Summary of Evaluation Index Test Results

[0175] Anomaly detection methods accuracy Recall rate F1 score Comparison Methods 0.7872 0.9827 0.8741 Sensor Model 0.1087 0.9393 0.1948 Actuator Model 0.7773 0.9639 0.8606 Fusion Method 0.8210 0.9624 0.8861

[0176] As shown in Table 1, four anomaly detection methods were used in the experiment: comparison method, sensor model, actuator model and fusion method. The anomaly detection method using the sensor and actuator dual model fusion method has the most obvious advantages in terms of accuracy, recall rate and F1 score.

[0177] Table 2 Summary of Results of Persistent Anomaly Detection Evaluation Method

[0178]

[0179] As shown in Table 2, two anomaly detection methods, namely the comparison method and the fusion method, were used in the experiment. The results of the continuous anomaly detection evaluation method showed that the sensor and actuator dual-model fusion anomaly detection method had the most obvious advantages in terms of the number of correct detections, the number of false alarms (number of false alarm times / number of false alarm segments), and the number of missed attack numbers.

[0180] The beneficial effects of implementing this embodiment are:

[0181] Considering the characteristics of closed-loop systems in industrial production processes, nodes are classified into sensors and actuators. Based on this, a node relationship graph learning method based on prior knowledge is proposed to provide a node relationship graph that conforms to the physical process for subsequent anomaly detection models based on graph networks.

[0182] A method for anomaly detection based on the fusion of operational rules and control rules is proposed. An aggregation function is designed using historical sensor information and actuator change information. A GNN prediction model for operational rules is constructed based on the node relationship graph of the sensor. An aggregation function is designed using historical sensor information and change trends. A GNN prediction model for control rules is constructed based on the node relationship graph of the actuator.

[0183] Finally, based on the detection results of the two models, fusion anomaly detection is performed, and a complete anomaly detection process is provided.

[0184] It makes expert knowledge readily available and universal, and easy to adapt to different industrial production processes; even when the data training set cannot fully cover all situations, it can still reduce the false alarm rate of anomaly detection, and may also avoid the problem of missed anomaly detection; it has strong advantages in evaluation indicators such as recall, precision, and F1 score.

[0185] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0186] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0187] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0188] Example 2

[0189] Further reference Figure 5 As a response to the above Figure 1 The present invention provides an embodiment of a dual-model fusion anomaly detection device that distinguishes between sensors and actuators, based on the method shown. This embodiment is similar to... Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0190] like Figure 5 As shown, the dual-model fusion anomaly detection device 60 distinguishing between sensors and actuators in this embodiment includes: a classification module 61, a node relationship graph construction module 62, an anomaly detection model construction module 63, an anomaly detection module 64, and a fusion module 65. Wherein:

[0191] Classification module 61 is used to classify industrial process data nodes into sensor nodes and actuator nodes;

[0192] The node relationship graph construction module 62 is used to construct sensor node relationship graphs and actuator node relationship graphs based on sensor nodes and actuator nodes, respectively.

[0193] The anomaly detection model construction module 63 is used to construct a sensor anomaly detection model based on operating rules and an actuator anomaly detection model based on control rules, respectively, based on the sensor node relationship diagram and the actuator node relationship diagram.

[0194] Anomaly detection module 64 is used to perform sensor anomaly detection based on sensor anomaly detection model and actuator anomaly detection based on actuator anomaly detection model;

[0195] The fusion module 65 is used to fuse sensor anomaly detection with actuator anomaly detection.

[0196] The beneficial effects of implementing this embodiment are:

[0197] Considering the characteristics of closed-loop systems in industrial production processes, nodes are classified into sensors and actuators. Based on this, a node relationship graph learning method based on prior knowledge is proposed to provide a node relationship graph that conforms to the physical process for subsequent anomaly detection models based on graph networks.

[0198] A method for anomaly detection based on the fusion of operational rules and control rules is proposed. An aggregation function is designed using historical sensor information and actuator change information. A GNN prediction model for operational rules is constructed based on the node relationship graph of the sensor. An aggregation function is designed using historical sensor information and change trends. A GNN prediction model for control rules is constructed based on the node relationship graph of the actuator.

[0199] Finally, based on the detection results of the two models, fusion anomaly detection is performed, and a complete anomaly detection process is provided.

[0200] It makes expert knowledge readily available and universal, and easy to adapt to different industrial production processes; even when the data training set cannot fully cover all situations, it can still reduce the false alarm rate of anomaly detection, and may also avoid the problem of missed anomaly detection; it has strong advantages in evaluation indicators such as recall, precision, and F1 score.

[0201] Example 3

[0202] To address the aforementioned technical problems, embodiments of the present invention also provide a computer device. Please refer to [link / reference needed]. Figure 6 , Figure 6 This is a basic structural block diagram of the computer device in this embodiment.

[0203] Computer device 7 includes a memory 71, a processor 72, and a network interface 73 that are interconnected via a system bus. It should be noted that only computer device 7 with components 71, 72, and 73 is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components may be implemented instead. Those skilled in the art will understand that the computer device described herein is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0204] Computer devices can include desktop computers, laptops, handheld computers, and cloud servers. These devices allow for human-computer interaction with users through keyboards, mice, remote controls, touchpads, or voice-activated devices.

[0205] The memory 71 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 71 may be an internal storage unit of the computer device 7, such as the hard disk or memory of the computer device 7. In other embodiments, the memory 71 may also be an external storage device of the computer device 7, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 7. Of course, the memory 71 may also include both internal storage units and external storage devices of the computer device 7. In this embodiment, the memory 71 is typically used to store the operating system and various application software installed on the computer device 7, such as computer-readable instructions for a dual-model fusion anomaly detection method that distinguishes between sensors and actuators. In addition, the memory 71 can also be used to temporarily store various types of data that have been output or will be output.

[0206] In some embodiments, processor 72 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. Processor 72 is typically used to control the overall operation of computer device 7. In this embodiment, processor 72 is used to execute computer-readable instructions stored in memory 71 or to process data, such as executing computer-readable instructions for a dual-model fusion anomaly detection method that distinguishes between sensors and actuators.

[0207] The network interface 73 may include a wireless network interface or a wired network interface, which is typically used to establish a communication connection between the computer device 7 and other electronic devices.

[0208] The beneficial effects of implementing this embodiment are: it makes expert knowledge easy to obtain and universal, and easy to adapt to different industrial production processes; even when the data training set cannot fully cover all situations, it can still reduce the false alarm rate of anomaly detection, and may also avoid the problem of missed anomaly detection; it has strong advantages in evaluation indicators such as recall, precision, and F1 score.

[0209] Example 4

[0210] The present invention also provides another embodiment, namely, a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the dual-model fusion anomaly detection method for distinguishing between sensors and actuators as described above.

[0211] The beneficial effects of implementing this embodiment are: it makes expert knowledge easy to obtain and universal, and easy to adapt to different industrial production processes; even when the data training set cannot fully cover all situations, it can still reduce the false alarm rate of anomaly detection, and may also avoid the problem of missed anomaly detection; it has strong advantages in evaluation indicators such as recall, precision, and F1 score.

[0212] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0213] Obviously, the embodiments described above are merely some embodiments of the present invention, not all embodiments. The accompanying drawings show preferred embodiments of the present invention, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of this invention.

Claims

1. A dual model fusion anomaly detection method for distinguishing between sensors and actuators, characterized by, The method comprises the following steps: dividing the industrial process data nodes into sensor nodes and actuator nodes; constructing a sensor node relationship graph and an actuator node relationship graph based on the sensor nodes and the actuator nodes respectively; constructing a sensor anomaly detection model based on operation rules and an actuator anomaly detection model based on control rules based on the sensor node relationship graph and the actuator node relationship graph respectively; performing sensor anomaly detection based on the sensor anomaly detection model and performing actuator anomaly detection based on the actuator anomaly detection model; fusing the sensor anomaly detection and the actuator anomaly detection; the step of constructing a sensor anomaly detection model based on operation rules and an actuator anomaly detection model based on control rules based on the sensor node relationship graph and the actuator node relationship graph respectively comprises: designing an aggregation function based on sensor historical information and actuator change information, and constructing a sensor GNN prediction model based on operation rules based on the node relationship graph for the sensor; designing an aggregation function based on sensor historical information and change trend, and constructing an actuator GNN prediction model based on control rules based on the node relationship graph for the actuator.

2. The dual model fusion anomaly detection method of distinguishing between sensors and actuators according to claim 1, characterized in that, the step of dividing the industrial process data nodes into sensor nodes and actuator nodes comprises: Define the set of sensor nodes as Define the set of actuator nodes as containing M s nodes, containing M a nodes, then M = M s + M a where denotes the set of all nodes of the industrial process, and M denotes the number of all nodes. Vector x of the dataset at an arbitrary time instant t t is divided into a sensor vector s t and an actuator vector a t wherein denotes a sensor node with a value at time instant t, denotes an actuator node with a value at time instant t. 3.The method of claim 1, wherein, the step of constructing a sensor node relationship graph and an actuator node relationship graph based on the sensor nodes and the actuator nodes respectively comprises: constructing a relationship graph of the industrial process data nodes to the sensor nodes based on the sensor nodes; constructing a relationship graph of the industrial process data nodes to the actuator nodes based on the actuator nodes. 4.The method of claim 1, wherein, the step of performing sensor anomaly detection based on the sensor anomaly detection model comprises: statistically determining an abnormal threshold value of each sensor; after the training of the sensor anomaly detection model is completed, calculating an absolute value vector of an error of each sensor at each time point in the training set as an abnormal evaluation score vector; statistically determining a mean value and a standard deviation of the error of each sensor at all time points; taking 3 times the standard deviation as a tolerance limit of abnormal monitoring to obtain an abnormal detection threshold value vector; the sensor anomaly detection model outputs a sensor abnormality label of the test set at a certain time point through the abnormal detection threshold value vector, and a label value of 0 indicates normality and a label value of 1 indicates abnormality; the sensor anomaly detection model outputs a sensor anomaly detection label of the test set.

5. The dual model fusion anomaly detection method of distinguishing between sensors and actuators according to claim 4, characterized in that, the step of performing actuator anomaly detection based on the actuator anomaly detection model comprises: statistically determining an abnormal threshold value of each sensor; For any actuator node n i Divide the T time points in the training set into stable state and unstable state, if Consider time t actuator n i State change occurs, record time t-1, t and t+1 as unstable state, after traversing all T time points, for the time points recorded as unstable state are stable state; Take the maximum value of the cross-entropy loss value of the two states as the executor node n i Two-state abnormal threshold, count all executor node two-state abnormal threshold, get stable state abnormal threshold vector and unstable state abnormal threshold vector; At the time t ′ , first, judge whether the time t ′ is in stable state or unstable state, then get the threshold value in the corresponding abnormal threshold vector, and get the abnormal detection threshold value of the time t ′ . The time t is calculated ′ Actuator exception tag; the actuator anomaly detection model outputs an actuator anomaly detection label of the test set.

6. The dual model fusion anomaly detection method of distinguishing between sensors and actuators according to claim 5, characterized in that, the step of fusing the sensor anomaly detection and the actuator anomaly detection comprises: using an offline modeling method to train a sensor model and an actuator model using training set data, and calculating a sensor threshold value and an actuator threshold value; using an online detection method to detect a sensor anomaly score and an actuator anomaly score by respectively inputting test set data into the sensor model and the actuator model; and The sensor anomaly detection tag and the actuator anomaly detection tag are calculated and fused using a logical OR operation to obtain a new anomaly detection tag. 7.A dual model fusion anomaly detection apparatus that distinguishes between a sensor and an actuator, characterized by include: The classification module is used to divide industrial process data nodes into sensor nodes and actuator nodes; The node relationship graph construction module is used to construct a sensor node relationship graph and an actuator node relationship graph based on the sensor nodes and the actuator nodes, respectively. The anomaly detection model construction module is used to construct a sensor anomaly detection model based on operating rules and an actuator anomaly detection model based on control rules, respectively, based on the sensor node relationship diagram and the actuator node relationship diagram. Anomaly detection module is used to perform sensor anomaly detection based on the sensor anomaly detection model and actuator anomaly detection based on the actuator anomaly detection model; A fusion module is used to fuse the sensor anomaly detection with the actuator anomaly detection; The anomaly detection model construction module is specifically used for: An aggregation function is designed using historical sensor information and actuator change information, and a sensor GNN prediction model based on the node relationship graph of the sensor is constructed to predict the operating rules. An aggregation function is designed based on historical sensor information and changing trends, and an actuator GNN prediction model for control rules is constructed based on the node relationship graph for the actuator.

8. A computer device comprising a memory and a processor, the memory storing computer-readable instructions, wherein the processor, when executing the computer-readable instructions, implements the steps of the dual-model fusion anomaly detection method for distinguishing between sensors and actuators as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the dual-model fusion anomaly detection method for distinguishing between sensors and actuators as described in any one of claims 1 to 7.

Images