An industrial control system anomaly detection method based on a variational autoencoder

Abstract

The application provides an industrial control system anomaly detection method based on a variational autoencoder, and belongs to the technical field of industrial control systems.The application comprises the following steps: S1: collecting industrial control system data; S2: pre-processing the collected data; S3: constructing a neural network model and training the model using the processed normal data; S4: setting a detection threshold; S5: detecting the test data, determining whether the data is abnormal according to the comparison result of the score and the detection threshold, and outputting the result.The application can effectively model the data in the industrial control system, and the constructed model can learn the time correlation between the data, so that the normal behavior and the abnormal behavior can be more accurately distinguished; the application also uses a Gaussian mixture model to model the low-dimensional representation of the data and the distribution of the reconstruction error, comprehensively considers the influence of the low-dimensional representation of the data and the reconstruction error, and enhances the anomaly detection effect.

Description

Technical Field

[0001] This invention belongs to the field of industrial control system technology, and mainly relates to an anomaly detection method for industrial control systems based on variational autoencoders. Background Technology

[0002] Industrial Control Systems (ICS) are primarily responsible for real-time data acquisition, system monitoring, automatic control, and management of industrial processes. ICS are involved in critical sectors such as transportation, water treatment, manufacturing, power, and metallurgy, and are a vital component of national critical infrastructure. With the development of information technology, ICS have become increasingly information-driven and intelligent. Consequently, they face a growing number of cyberattacks. Attackers can manipulate system operating parameters by attacking network communication access points, various physical sensors, and actuators, causing the ICS to deviate from its normal operating state, triggering system anomalies, and leading to production disruptions or even safety accidents. Because ICS contain numerous production devices with complex coupling relationships, manual monitoring alone is insufficient for timely anomaly detection. Therefore, research into anomaly detection theories and technologies for ICS is essential.

[0003] Anomaly detection algorithms based on machine learning and deep learning are currently the mainstream in anomaly detection research due to their advantages, such as not requiring precise modeling of industrial control systems and being able to handle large-scale data. Learning-based detection algorithms can be divided into three types: supervised learning, semi-supervised learning, and unsupervised learning. Although supervised and semi-supervised learning-based anomaly detection have achieved significant results in detection performance, the data from industrial control systems is high-dimensional and massive in quantity, requiring substantial human and material resources to label anomalous data, which presents a significant cost challenge in practice. To address this issue, developing detection algorithms based on unsupervised learning has become particularly important because it does not rely on labeled anomalous data, effectively reducing costs. Through unsupervised learning, neural networks can learn normal patterns from large amounts of normal data and generate indicators different from normal patterns when inputting data tampered with by an attacker, thereby detecting anomalies. Currently, unsupervised detection methods based on deep networks, such as autoencoders (AEs), variational autoencoders (VAEs), and generative adversarial networks (GANs), have achieved certain results in applications.

[0004] However, existing technologies often have the following problems when solving anomaly detection in industrial control systems: 1) The temporal correlation between data at different times is not considered when performing anomaly detection, or although the sliding window technique is used to process data, the network needs to process data from multiple times within the window, which increases the number of network parameters and makes training more difficult; 2) When performing anomaly detection based on encoder-decoder framework, only reconstruction error is considered as the detection index, and the information contained in the low-dimensional representation extracted by the encoder is not fully utilized. Summary of the Invention

[0005] The purpose of this invention is to provide an anomaly detection method for industrial control systems based on variational autoencoders, so as to overcome the shortcomings of existing technologies that do not consider the temporal correlation between data at different times and do not make full use of the information contained in the low-dimensional representation of data, so as to achieve unsupervised anomaly detection for industrial control systems.

[0006] The technical solution to achieve the purpose of this invention is as follows:

[0007] An anomaly detection method for industrial control systems based on variational autoencoders includes the following steps:

[0008] S1: Acquire data from industrial control systems;

[0009] S2: Preprocess the collected industrial control system data, including converting the label data into numerical values, performing minimum-maximum normalization on the data, and dividing the training dataset and test dataset.

[0010] S3: Construct a neural network model based on variational autoencoders and train the model using processed normal data: Construct a GRU-VAEGMM network, consisting of a GRU-VAE network and an estimation network. The GRU-VAE network is used to extract the low-dimensional representation of the data and reconstruction error as feature variables, while the estimation network is used to model the distribution of the feature variables in conjunction with GMM. The GRU-VAE network is based on the variational autoencoder network framework, with a skip connection layer composed of GRU networks added between the encoder and decoder. The estimation network is used in conjunction with GMM to model the distribution of the feature variables.

[0011] S4: Using the trained neural network model, obtain the feature variables and reconstruction error of the data, use GMM to calculate the sample energy of the feature variables, and use the sum of the sample energy and reconstruction error as the score of the data. Then set the detection threshold according to the distribution of the scores of normal data.

[0012] S5: Use the trained neural network model to detect the test data and obtain the score of the test data. If the score is less than the detection threshold, it means that the data is normal. If the score is greater than the detection threshold, it means that the data is abnormal and the data may have been tampered with by attackers.

[0013] The significant advantages of this invention compared to existing technologies are:

[0014] 1) Considering the temporal correlation of data in industrial control systems, by adding a skip connection layer composed of a GRU network to the encoder and decoder of the variational autoencoder, the neural network model's ability to learn the temporal correlation of data is enhanced. Furthermore, this invention does not use a sliding window to process data, reducing the model's parameters and making the model more lightweight.

[0015] 2) Using a Gaussian mixture model to model the low-dimensional representation and reconstruction error of the data can comprehensively consider both factors, thereby enhancing the anomaly detection effect. Attached Figure Description

[0016] Figure 1 This is a flowchart of the anomaly detection method for industrial control systems based on variational autoencoders according to the present invention.

[0017] Figure 2 This is a network structure diagram of the GRU-VAEGMM network of the present invention;

[0018] Figure 3 This is a structural diagram of the GRU network in the GRU-VAE network of the present invention. Detailed Implementation

[0019] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0020] To make the technical solution of the present invention clearer, the following description, in conjunction with the accompanying drawings, further elaborates on an anomaly detection method for an industrial control system based on a variational autoencoder. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the invention. The present invention is implemented in the following steps:

[0021] S1: Acquire data from industrial control systems:

[0022] The collected data includes multivariate time-series data generated by various industrial sensors and actuators in the industrial control system. This invention uses data from the industrial control system under normal operating conditions as training data and data from when the industrial control system is under attack as test data. The training data is used to train the algorithm model, and the test data is used to verify the effectiveness of the method. This invention uses the SWaT (Secure Water Treatment) dataset to practically verify the feasibility of the model. This dataset includes 7 days of normal operation data obtained from a real wastewater treatment experimental platform and 4 days of attacked data, which can be used to evaluate the effectiveness of attack detection. The SWaT dataset contains 51-dimensional sensor and actuator data, and 1-dimensional labels. This invention removes the first 100,000 records from the first 7 days of normal data, which correspond to the period before the system enters normal operating conditions. In addition, data from 7 actuators is also removed because these data remain unchanged in both normal and attacked data, constituting redundant data and detrimental to network training.

[0023] S2: Preprocess the collected industrial control system data, specifically including the following steps:

[0024] S21: Convert the label column of the dataset to numbers, where the label of normal data is converted to 0 and the label of abnormal data is converted to 1. Then, perform min-max normalization on the data other than the label column to normalize the value range of each feature dimension to [0,1].

[0025] S22: Divide the dataset into training and testing datasets. The training dataset contains only the data from when the system is running normally, i.e., the data from the first 7 days of the processed SWaT dataset. The testing dataset uses the data from the last 4 days of the processed SWaT dataset that were attacked.

[0026] S3: Construct a neural network model based on variational autoencoders and train the neural network model using processed normal data. This includes the following steps:

[0027] S31: Construct a GRU-VAEGMM (Gate Recurrent Unit-Variational AutoEncoders Gaussian Mixture Models) network, such as Figure 2 As shown, the GRU-VAEGMM network of the present invention comprises two parts: a GRU-VAE network and an estimation network. The GRU-VAE network is used to extract the low-dimensional representation of the data and the reconstruction error as feature variables, while the estimation network is used to model the distribution of the feature variables in conjunction with GMM.

[0028] S311: Construct a GRU-VAE network to extract low-dimensional representations of data and reconstruct errors. The GRU-VAE network is based on the traditional variational autoencoder network framework, adding a skip connection layer composed of GRUs between the encoder and decoder, enabling the network to better learn the temporal correlations between data. Figure 3 As shown, the GRU network uses reset gates and update gates to control the flow and filtering of information, thereby enabling the modeling of long-term dependencies. The forward propagation formula of the GRU network is:

[0029] u t =σ(W z x t +U z h t-1 +b z )

[0030] r t =σ(W r x t +U r h t-1 +b r )

[0031]

[0032]

[0033] Among them, u t Indicates the update gate, r t Indicates resetting the door, h t-1 This represents the hidden state at the previous moment. h represents the hidden state of the candidate at time t. t x represents the hidden state output at the current time t. t W represents the data at time t. z U z W r U r W h and U h These are the weight parameters of the GRU network, b z b r and b h These are the bias parameters of the GRU network, and σ(*) represents the nonlinear activation function. This represents the Hadamard product operation. Reset gate r t It can control the relationship between the current input and the previous state, thereby avoiding the vanishing and exploding gradient problems, and updating the gate u. t It can control the degree to which the state of the previous moment is preserved, thereby enabling the modeling of long-term dependencies.

[0034] S312: As Figure 2 As shown, the encoder and decoder of the GRU-VAE network of this invention are both composed of three fully connected layers. Two GRU networks are used to process the outputs of the first two layers of the encoder to obtain the hidden state. and Then the hidden state and The vectors are concatenated with the input variables of the last two layers of the GRU-VAE decoder, and then fed into the last two fully connected layers of the GRU-VAE decoder. The GRU-VAE network learns the temporal correlation between data using the GRU network, through methods such as... Figure 2 The skip connection layer shown passes information from the encoder to the decoder, enabling the entire network to learn the temporal correlation of data and allowing the fusion of characteristic information from different layers.

[0035] S313: As Figure 2 As shown, the encoder of the GRU-VAE network obtains data x. t Low-dimensional representation mean μ t and variance σ t Then, using resampling techniques, we obtain x. t Low-dimensional representation Then the reconstructed sample is obtained through the decoder.

[0036] [μ t ,σ t ]=h(x t ;θ h )

[0037]

[0038]

[0039] Where, x t This represents the data at time t. Let h(*) represent the reconstructed sample, g(*) represent the encoder's encoding function, g(*) represent the decoder's decoding function, and θ represent the reconstructed sample. h and θ g ε represents the network parameters of the encoder and decoder, respectively. t From the standard normal distribution The sampled data, ε t and σ t Having the same dimension, here ε t The subscript indicates that a new ε is generated at each time step. t .

[0040] S314: Obtain the data xt and reconstructed samples 2-norm Similarity to cosine Here, · represents calculating the dot product of vectors, and ||*|| represents calculating the L2 norm. For example... Figure 2 The figure shows the 2-norm. Cosine similarity and low-dimensional representation By concatenating these components, we obtain the feature variables:

[0041]

[0042] Among them, z t This represents the feature variables extracted by the GRU-VAE network.

[0043] S315: Construct an estimation network to combine the feature variable z extracted by the GRU-VAE network with the GMM. t The distribution is modeled. Assuming the Gaussian Mixture Model (GMM) contains K Gaussian sub-models, and the GMM is a linear combination of these K sub-models, an estimation network is used to obtain the relationship between different Gaussian sub-models of the GMM and the feature variable z. t Response rate:

[0044]

[0045] in, This indicates that the GMM applies to the feature variable z. t The responsiveness, MLN(*) represents a multilayer neural network, is Figure 2 The main part of the network is estimated, θ m This represents the parameters of a multilayer neural network, and softmax(*) represents the normalization process, ensuring that the K Gaussian sub-models of the GMM are consistent with the feature variable z. t The sum of the responsiveness is 1.

[0046] S32: Using GMM on feature variable z t The distribution is modeled, and the feature variable z is obtained based on the GRU-VAE network. t And the response obtained by estimating the network Estimating the parameters of the Gaussian Mixture Model (GMM) requires estimating the weight coefficients of different Gaussian submodels. mean Covariance Matrix

[0047]

[0048]

[0049]

[0050] Where N represents the feature variable z used to estimate the GMM parameters. t and responsiveness The number of times is denoted by t0, which represents the starting time of the data to be used in the calculation. N data points corresponding to t∈[t0,t0+N] are selected for the calculation. This indicates that the k-th Gaussian sub-model is related to the feature variable z. t responsiveness, express The k-th element, with superscript (*) T This indicates finding the transpose of a vector or matrix.

[0051] S33: Calculate the feature variable z based on the obtained GMM parameters. t Sample energy:

[0052]

[0053] Where E(z) t ) is the characteristic variable z t The sample energy, |*| denotes calculating the determinant of a matrix.

[0054] S34: Determine the loss function to use when training the neural network:

[0055]

[0056] Where L is the loss function, and the first term of L is... Representing data x t Reconstruction error, ||*|| 2 This means to first calculate the L2 norm and then the square. Expressing the request and Kullback-Leibler divergence, This represents the low-dimensional representation obtained by the encoder through the GRU-VAE network. The distribution This represents the expected low-dimensional representation. The distribution of L is set here as a standard normal distribution; in the second term of L, E(z) t ) is the characteristic variable z defined in step S33. t The sample energy; the third term of L is to avoid the covariance matrix during calculation. Singularity occurs, and small values ​​on the diagonal elements of the covariance matrix are penalized, where D represents the covariance matrix. The number of diagonal elements, Represents the covariance matrix The j-th value on the diagonal, K is the number of Gaussian sub-models in the GMM, and the parameters λ1 and λ2 represent the weight coefficients of the loss function L.

[0057] S35: The GRU-VAEGMM network is trained based on the loss function L of S34. Training stops after the set number of rounds is reached, and the trained neural network parameters are saved for use during detection.

[0058] S4: Using the trained neural network model, calculate the score of normal data and set the detection threshold according to its distribution. This includes the following steps:

[0059] S41: Using the trained GRU-VAEGMM network, calculate the response of normal data. Then, calculate the weight coefficients of each Gaussian sub-model of the GMM according to the formula in step S32. mean Covariance Matrix

[0060] S42: Calculate data x t Rating:

[0061]

[0062] Among them, S t Representing data x t The rating, E(z) t ) is the characteristic variable z defined in step S33. t Sample energy, It is data x t The reconstruction error. If x t If it is abnormal data, then x t and characteristic variable z t The distribution of z will deviate from the normal distribution, then the sample energy E(z) t ) and reconstruction error It will be a relatively large value, therefore the score S t It will also obtain a larger value; conversely, the score S for normal data will be smaller. t It will be relatively small, so it can be based on the rating S. t The size is used to determine whether the data is abnormal.

[0063] S43: Further, calculate the scores of all normal data used for training, and take the value at the 95th percentile as the detection threshold th.

[0064] S5: Use the trained neural network model to test the test data, such as... Figure 1 As shown in the anomaly detection process, the score S of the test data is calculated. tThen, based on the comparison result with the threshold th, it is determined whether an anomaly has occurred:

[0065]

[0066] Where Anomaly indicates abnormal data and Normal indicates normal data, if S t A score less than the detection threshold th indicates that the data is normal, such as a score S. t If the value is greater than or equal to the detection threshold th, it indicates that the data is abnormal and may have been tampered with by an attacker.

[0067] The above-disclosed content is merely a preferred embodiment of the present invention and does not constitute an exhaustive description of all details, nor is it limited to specific implementation methods. Various modifications and variations can be made based on the content of this specification. These embodiments are selected and specifically described in this specification to better elucidate the principles and practical applications of the present invention, so that those skilled in the art can fully understand and apply the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An anomaly detection method for industrial control systems based on variational autoencoders, characterized in that, Includes the following steps: S1: Acquire data from industrial control systems; S2: Preprocess the collected industrial control system data, including converting the label data into numerical values, performing minimum-maximum normalization on the data, and dividing the training dataset and test dataset. S3: Construct a neural network model based on variational autoencoders and train the model using processed normal data: Construct a GRU-VAEGMM network, consisting of a GRU-VAE network and an estimation network. The GRU-VAE network is used to extract the low-dimensional representation of the data and reconstruction error as feature variables, while the estimation network is used to model the distribution of the feature variables in conjunction with GMM. The GRU-VAE network is based on the variational autoencoder network framework, with a skip connection layer composed of GRU networks added between the encoder and decoder. The estimation network is used in conjunction with GMM to model the distribution of the feature variables. The encoder and decoder of the GRU-VAE network both consist of three fully connected layers. Two GRU networks are used to process the outputs of the first two layers of the encoder to obtain the hidden states. and Then the hidden state and The vectors are concatenated with the input variables of the last two layers of the GRU-VAE decoder, and then the concatenated vectors are input into the last two fully connected layers of the GRU-VAE decoder. S4: Using the trained neural network model, obtain the feature variables and reconstruction error of the data, use GMM to calculate the sample energy of the feature variables, and use the sum of the sample energy and reconstruction error as the score of the data. Then set the detection threshold according to the distribution of the scores of normal data. S5: Use the trained neural network model to detect the test data and obtain the score of the test data. If the score is less than the detection threshold, it means that the data is normal. If the score is greater than the detection threshold, it means that the data is abnormal and the data may have been tampered with by attackers.

2. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 1, characterized in that, Data is obtained through the encoder of the GRU-VAE network. Low-dimensional representation mean and variance Then get Low-dimensional representation Then, the reconstructed sample is obtained through the decoder. : in express Data at any given time Indicates the reconstructed sample. This represents the encoder's encoding function. This represents the decoding function of the decoder. and These represent the network parameters of the encoder and decoder, respectively. From the standard normal distribution The data obtained from sampling This indicates the operation of calculating the Hadamard product.

3. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 2, characterized in that, The feature variables extracted by the GRU-VAE network are represented as follows: in Representing data and reconstructed samples The 2-norm, Representing data and reconstructed samples cosine similarity, This represents finding the dot product of vectors. This indicates a search for the L2 norm; This represents the feature variables extracted by the GRU-VAE network.

4. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 3, characterized in that, The loss function of the constructed neural network model is: in, It is a loss function. This means to first calculate the L2 norm and then the square. Expressing the request and Kullback-Leibler divergence, This represents the low-dimensional representation obtained by the encoder through the GRU-VAE network. The distribution This represents the expected low-dimensional representation. The distribution Represents the covariance matrix The number of diagonal elements, Represents the covariance matrix The first on the diagonal One value, It represents the number of Gaussian sub-models in the GMM, and the parameters... and Represents the loss function Weighting coefficients; Indicates the start time of the data used in the calculation. Describes the characteristic variables used to estimate GMM parameters. Quantity, It is a characteristic variable The sample energy.

5. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 4, characterized in that, Feature variables Sample energy : in , , Let represent the weight coefficients, mean, and covariance matrix of the Gaussian sub-model, respectively; Indicates the number of Gaussian sub-models. Indicates the first A Gaussian sub-model, This indicates the calculation of the determinant of a matrix.

6. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 5, characterized in that, The formula for calculating the parameters of the Gaussian sub-model is as follows: in Indicates the first A Gaussian sub-model for feature variables Response rate.

7. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 6, characterized in that, The Gaussian mixture model obtained from the estimation network is relevant to the feature variables. The responsiveness is: in, This indicates that the Gaussian mixture model applies to the feature variables. responsiveness, Represents a multilayer neural network. The parameters representing a multilayer neural network, This indicates normalization processing. express The Each element.

8. The anomaly detection method for industrial control systems based on variational autoencoders according to claim 5, characterized in that, The formula for calculating the data score is: in, Representing data The rating.

Images