A Time-Series Anomaly Detection Method for Industrial Internet Identifier Resolution

Abstract

This invention discloses a time-series anomaly detection method for industrial internet identifier resolution, comprising: S1, constructing a time-series anomaly detection model, including a feature construction module, a feature extraction module, and a result output module; wherein, the feature construction module is used to construct data from the time-series dataset into data that can be input into the time-series anomaly detection model; the feature extraction module is used to extract features from the input data, and combine various features to characterize deeper features; the result output module merges the output data of the feature extraction module, and realizes data dimensionality reduction, while preventing overfitting of the model during training, and outputs the binary classification result of anomaly detection; S2, training the time-series anomaly detection model; S3, using the trained time-series anomaly detection model for time-series anomaly detection. This invention can more accurately detect anomalies in the industrial internet.

Description

Technical Field

[0001] This invention belongs to the field of industrial internet technology, specifically relating to a time-series anomaly detection method for industrial internet identifier resolution. Background Technology

[0002] The Industrial Internet is an emerging field that combines traditional industrial systems with advanced information technologies such as the Internet, cloud computing, the Internet of Things (IoT), and big data. Industrial Internet identifier resolution refers to the process of mapping object identifiers to all production factors within the Industrial Internet, including equipment, machines, and materials, and obtaining the information needed for services. The Industrial Internet identifier resolution system is a crucial component of the Industrial Internet network architecture, serving as the nerve center supporting interconnectivity. However, due to the complex network interactions involved in real-time data transmission and device connection resolution, the Industrial Internet identifier resolution system faces a series of security threats and challenges, such as distributed denial-of-service (DDoS) attacks, malware and virus infections, and zero-day exploits. The complexity and severity of these threats necessitate that experts from Industrial Identifier Resolution Service providers continuously enhance their security awareness and implement corresponding defense and protection measures.

[0003] Time-series anomaly detection technology for Industrial Internet Identifier Resolution Services (IIIS) is a key technology for identifying abnormal behavior in IIIS systems. It analyzes and models time-series data of actively probed and passively resolved IIIS traffic generated within the system to detect abnormal patterns and behaviors, thereby identifying potential security threats early. However, while existing time-series anomaly detection technologies are effective, they suffer from shortcomings in false alarm rate, false negative rate, and detection efficiency. Achieving high anomaly detection accuracy while maintaining high efficiency remains a significant challenge.

[0004] The main shortcomings of current time series anomaly detection methods are:

[0005] 1. Limited Feature Selection: Most anomaly detection techniques rely primarily on the analysis of raw time-series data, lacking diversified exploration of deeper features and insufficient consideration of feature analysis.

[0006] 2. Insufficient feature information mining: Existing anomaly detection techniques that analyze from the frequency domain perspective do not fully mine the information in the selected features. The mined frequency domain information not only fails to capture frequency correlations but also discards temporal correlations, making it difficult for anomaly detection techniques to effectively improve detection capabilities.

[0007] 3. Inappropriate model selection: Some existing anomaly detection technologies use inappropriate models, which prevents the models from effectively learning the characteristics of time series based on the constructed features, making it difficult to better capture the inherent patterns of time series. Summary of the Invention

[0008] The main objective of this invention is to overcome the shortcomings and deficiencies of existing technologies and propose a time-series anomaly detection method for industrial internet identifier resolution.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A method for detecting time-series anomalies in industrial internet identifier resolution includes the following steps:

[0011] S1. Construct a time series anomaly detection model, including a feature construction module, a feature extraction module, and a result output module;

[0012] Among them, the feature construction module is used to construct time series datasets into data that can be input into the time series anomaly detection model;

[0013] The feature extraction module consists of a compressed excitation network and a long short-term memory neural network. These two networks are used to extract features from the input data and combine various features to characterize deeper features, outputting feature vectors containing time series patterns.

[0014] The output module consists of a deep neural network, which includes a three-layer neural network structure, the Dropout algorithm, and a non-linear activation function. It is used to merge the output data of the feature extraction module, reduce the dimensionality of the data, prevent the model from overfitting during training, and output the binary classification results of anomaly detection.

[0015] S2. Train the time series anomaly detection model;

[0016] S3. Use the trained time series anomaly detection model for time series anomaly detection.

[0017] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0018] 1. This invention utilizes frequency domain information from time series data and introduces time-related features to construct a matrix data containing both frequency and time information. This invention integrates time and frequency information into a single matrix, encompassing diverse time series features and allowing direct input into anomaly detection models for training. This eliminates the need to input the two types of information separately into the model, thereby improving both the training and detection speeds of the anomaly detection model.

[0019] 2. This invention employs a compressed excitation network and a long short-term memory neural network, which can sequentially extract the spatial correlation features and temporal correlation features of frequency in network traffic data, summarize the time series characteristics of network traffic, and learn the inherent laws of the time series to obtain more potential positive anomaly information.

[0020] 3. This invention uses algorithms such as deep neural networks and Dropout to merge the extracted features. While extracting comprehensive features, it can effectively prevent model overfitting during training, thereby enabling more accurate detection of anomalies in the industrial internet. Attached Figure Description

[0021] Figure 1 This is a flowchart of the method of the present invention;

[0022] Figure 2 This is a network traffic time series diagram in an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the feature construction module in an embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the feature extraction module and the result output module in an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of the time series anomaly detection model in an embodiment of the present invention. Detailed Implementation

[0026] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0027] Example

[0028] like Figure 1 As shown, this invention provides a time-series anomaly detection method for industrial internet identifier resolution, comprising the following steps:

[0029] S1. Construct a time series anomaly detection model, including a feature construction module, a feature extraction module, and a result output module; such as Figure 5 The image shows a schematic diagram of a time series anomaly detection model.

[0030] Among them, the feature construction module is used to construct time series datasets into data that can be input into the time series anomaly detection model;

[0031] The feature extraction module consists of deep learning models such as a compression activation network and a long short-term memory neural network. The compression activation network mainly comprises compression and expansion structures. The compression structure uses convolution operations to convolve matrix data and compress the matrix for each channel. The expansion structure also uses convolution operations to expand the channels of the matrix, increasing the data dimension to its original size before compression. The long short-term memory neural network consists of recurrent units, which are gating mechanisms such as forget gates, input gates, and output gates. These two networks are used to extract features from the input data and combine various features to characterize deeper features, outputting feature vectors containing time-series patterns.

[0032] The output module consists of a deep neural network, which includes a three-layer neural network structure, the Dropout algorithm, and a non-linear activation function. It is used to merge the output data of the feature extraction module, reduce the dimensionality of the data, prevent the model from overfitting during training, and output the binary classification results of anomaly detection.

[0033] In this embodiment, let the time series based on network traffic be x = (x1, x2, ..., x...). L ), where L is the total length of the time series, x L This represents the Lth probe data in the time series. For example... Figure 2 The image shows a time series graph of network traffic.

[0034] like Figure 3 As shown, the feature construction module specifically includes constructing a network traffic matrix and constructing a network traffic frequency matrix;

[0035] The specific steps for constructing a network traffic matrix are as follows:

[0036] Let the first sequence sample be S = (x1,2,…, N ), where N is the length of the sequence in each sample, x N This refers to the Nth data point in the sample sequence.

[0037] For each sample sequence in the dataset, a sliding window with width T and step size 1 is used to divide each sample into a subsequence of length T. The matrix obtained for the first sample is:

[0038]

[0039] Where H = N - T + 1 represents the constructed network traffic matrix S t There are H flow sequences, each with a length of T;

[0040] The network traffic time-domain matrix constructed from the entire dataset is as follows:

[0041]

[0042] Where M = L - N + 1, it means that there are M samples in the entire time series dataset.

[0043] The frequency matrix of network traffic is constructed as follows:

[0044] The constructed network traffic time-domain matrix is ​​further converted into a frequency matrix. A discrete Fourier transform is then used to convert the continuous time-domain signal into a frequency-domain signal, as shown in the formula:

[0045]

[0046] y(n)=|X(n)|,=0,1,…,-1

[0047] Where (t) represents the t-th data point in the time-domain sequence, n is the frequency, and X(n) is the complex plane amplitude at frequency n. This value needs to be further calculated to obtain the real amplitude y(n) at frequency n. Since the amplitudes of frequencies n and Tn are equal, frequencies greater than Tn are used. The amplitude is discarded; according to the above formula, the frequency matrix converted from the first network traffic time domain matrix is:

[0048]

[0049] in This means that each constructed frequency matrix contains H network traffic frequency sequences, and the length of each frequency sequence is F+1;

[0050] The network traffic frequency matrix constructed from the entire time series dataset is as follows:

[0051]

[0052] like Figure 4 As shown, the feature extraction module specifically includes a compressed excitation network for feature extraction and a long short-term memory neural network for feature extraction.

[0053] Specifically, the features extracted by the compressed excitation network are as follows:

[0054] For the constructed network traffic frequency matrix sample, a suitable deep learning model is used for training to extract the corresponding features, so that the model can learn the inherent laws of the time series. In the constructed frequency matrix sample, each row of the frequency matrix represents the frequency of the time series in a certain period. The frequencies in each period may have corresponding correlations, that is, the i-th frequency may be related to the j-th frequency.

[0055] A compressed activation network is used to extract frequency correlation features of data in the frequency matrix within each time period. The compressed activation network is a channel attention mechanism network of convolutional neural networks. It mainly uses convolution and pooling operations and scales the convolution channels to focus on the channels that have a greater impact on the features, thereby achieving better model fitting results.

[0056] To construct a frequency matrix sample For example, the compressed excitation network first convolves adjacent frequencies within each time period in the matrix to obtain... Where W is the frequency dimension after convolution, and C is the channel dimension.

[0057] The matrix of each channel in U is compressed according to the following formula to obtain:

[0058]

[0059] Where P c These are 1×1 matrices; merging them yields a tensor.

[0060] Compressing and expanding P according to the channel dimension yields tensors of the same size. Each channel vector in U and After performing the calculation, we get:

[0061]

[0062] Where tanh is the activation function, and the symbol * represents the Hadamard product;

[0063] Finally, each channel vector V is... H×W spliced ​​into tensors This tensor captures the frequency and channel dependencies in the network traffic frequency matrix, enabling the model to better fit time series data and learn deeper patterns in the time series.

[0064] The Long Short-Term Memory (LSTM) neural network extracts features specifically as follows:

[0065] Based on the tensor V constructed from the compressed excitation network, the frequencies may exhibit time dependencies, meaning that frequencies across different time periods are correlated. To fully extract the frequency correlations between different time periods, we first transform the H time-dimensional matrices in V... As H time steps, they are concatenated into a one-dimensional vector z of size W×X. t Then it is input into the long short-term memory neural network;

[0066] Long Short-Term Memory (LSTM) neural networks consist of a recurrent unit containing a forgetting gate f.t Input gate i t Output gate o t Cell state c t and hidden state h t During training, the input data at each time step is processed cyclically. The forget gate selectively forgets unimportant information from the previous cell state; the input gate retains important information from the input data to obtain a new cell state; and the output gate determines the important information that can be output from the current cell state to obtain a new hidden state. The corresponding formula is:

[0067] f t =σ(W f [h t-1 ,z t ]+b f )

[0068] i t =σ(W i [h t-1 ,z t ]+b i )

[0069] o t =σ(W o [h t-1 ,z t ]+b o )

[0070]

[0071]

[0072] h t =o t *tanh(c t )

[0073] Wherein, the hidden state h t This is the vector output by the Long Short-Term Memory Neural Network. This vector stores the temporal correlation information in the tensor V, enabling the model to capture the inherent patterns of time series data more deeply.

[0074] The results output module specifically includes the following steps:

[0075] Based on the one-dimensional vector h output by the feature extraction module t We use deep neural networks to reduce the dimensionality of the data in order to extract important information while discarding redundant information.

[0076] Because deep neural networks are prone to learning features that lack generalization ability during training, leading to overfitting and affecting the accuracy of anomaly detection in unknown data, Dropout and non-linear activation functions are introduced into deep neural networks to avoid overfitting. Dropout randomly discards a certain proportion of neurons during training, temporarily preventing them from participating in training. This allows for fine-tuning of parameters that cause overfitting, making the model more generalizable. Non-linear activation functions improve the model's non-linear fitting ability, also giving the model better generalization ability.

[0077] Finally, a fully connected layer containing two neurons outputs the anomaly detection binary classification result.

[0078] S2. Train the time series anomaly detection model; the training of the time series anomaly detection model specifically involves:

[0079] The training process is divided into forward inference and backpropagation;

[0080] In forward inference, the raw data is used to construct feature data by the feature construction module. The feature data is then input into the feature extraction module, where the compressed excitation network and the long short-term memory neural network extract the frequency correlation information of the data within the same time period and between different time periods, respectively. The result output module outputs the anomaly probability of the training data.

[0081] The cross-entropy loss function is used to calculate the outlier probability p of the output. i With real labels y i Perform the calculation:

[0082]

[0083] In backpropagation, the partial derivative of the loss function is calculated to reduce the loss value. The parameters of each layer of the network are adjusted sequentially from back to front, so that the time series anomaly detection model learns the positive anomaly information in the data.

[0084] S3. Apply the trained time series anomaly detection model to time series anomaly detection, specifically as follows:

[0085] Once the time series anomaly detection model has been trained, the adjusted model and parameters will be saved.

[0086] For unknown network traffic to be tested, the traffic sequence is truncated into a subsequence of length N. The feature construction module constructs feature data, the feature extraction module extracts features, and finally the result output module outputs the anomaly probability.

[0087] Regarding the probability of anomalies, if the probability exceeds a preset threshold, it is considered an anomaly in the time series data. Generally, an anomaly probability exceeding 0.5 can be defined as an anomaly, or the level of the anomaly probability can be used to define the current level of internet security.

[0088] The feature construction module of this invention analyzes network traffic from the Internet, fully mining the frequency domain information of network traffic and introducing temporal correlation to construct a network traffic frequency matrix with both time and frequency information. The feature extraction module employs a deep learning model suitable for extracting combined features such as time and frequency information to effectively learn time series features and thus summarize the inherent patterns of the time series. The result output module uses a basic deep learning model while incorporating algorithms to prevent overfitting, accurately determining whether current network traffic is abnormal. This invention's method is adaptable to anomaly detection in different scenarios within the Industrial Internet, enabling rapid and effective identification of positive anomalies in network traffic. It can detect anomalies in real time based on network traffic, achieving security monitoring of the Industrial Internet.

[0089] It should also be noted that, in this specification, terms such as "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0090] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A time-series anomaly detection method for industrial internet identifier resolution, characterized in that, Includes the following steps: S1. Construct a time series anomaly detection model, including a feature construction module, a feature extraction module, and a result output module; The feature construction module is used to construct the time series dataset into data that can be input into the time series anomaly detection model; the time series dataset specifically includes: Let the time series based on network traffic be x = (x1, x2, ..., x...). L ), where L is the total length of the time series, x L This represents the Lth detection data point in the time series. The feature construction module specifically includes constructing a network traffic matrix and constructing a network traffic frequency matrix; The specific steps for constructing a network traffic matrix are as follows: Let the first sequence sample be S = (x1, x2, ..., x...). N ), where N is the length of the sequence in each sample, x N This refers to the Nth data point in the sample sequence. For each sequence sample in the dataset, a sliding window with width T and step size 1 is used to divide each sample into subsequences of length T. The matrix obtained for the first sequence sample is: Where H = N - T + 1 represents the constructed network traffic matrix S t There are H subsequences, each of length T; The network traffic time-domain matrix constructed from the entire time series dataset is as follows: Where M = L - N + 1, it means that there are M samples in the entire time series dataset; The frequency matrix of network traffic is constructed as follows: The constructed network traffic time-domain matrix is ​​further converted into a frequency matrix. A discrete Fourier transform is then used to convert the continuous time-domain signal into a frequency-domain signal, as shown in the formula: y(n) = |X(n)|, n = 0, 1, ..., T-1 Where x(t) is the t-th data point in the time-domain sequence, n is the frequency, and X(n) is the complex plane amplitude at frequency n. This value needs to be further calculated to obtain the real amplitude y(n) at frequency n. Since the amplitudes of frequencies n and Tn are equal, frequencies greater than Tn are used. The amplitude is discarded; according to the above formula, the frequency matrix converted from the first network traffic time domain matrix is: in H indicates that each constructed frequency matrix contains H network traffic frequency sequences, and the length of each frequency sequence is F+1; The network traffic frequency matrix constructed from the entire time series dataset is as follows: The feature extraction module consists of a compressed excitation network and a long short-term memory neural network. These two networks are used to extract features from the input data and combine various features to characterize deeper features, outputting feature vectors containing time series patterns. The output module consists of a deep neural network, which includes a three-layer neural network structure, the Dropout algorithm, and a non-linear activation function. It is used to merge the output data of the feature extraction module, reduce the dimensionality of the data, prevent the model from overfitting during training, and output the binary classification results of anomaly detection. S2. Train the time series anomaly detection model; S3. Use the trained time series anomaly detection model for time series anomaly detection.

2. The time series anomaly detection method for industrial internet identifier resolution according to claim 1, characterized in that, The compressed excitation network consists of a compression structure and an expansion structure. The compression structure is composed of convolution operations, which convolve the matrix data and compress the matrix of each channel. The expansion structure is also composed of convolution operations, which expand the channels of the matrix and expand the dimensions of the data to the size before compression. The long short-term memory neural network is composed of recurrent units, which consist of a forget gate, an input gate, and an output gate.

3. The time series anomaly detection method for industrial internet identifier resolution according to claim 2, characterized in that, The feature extraction module includes a compressed excitation network for feature extraction and a long short-term memory neural network for feature extraction. Specifically, the features extracted by the compressed excitation network are as follows: For the constructed network traffic frequency matrix sample, a deep learning model is used for training to extract the corresponding features, so that the model can learn the inherent pattern of the time series. In the constructed frequency matrix sample, each row of the frequency matrix represents the frequency of the time series within a certain period. The frequencies within each period may have corresponding correlations, that is, the i-th frequency may be related to the j-th frequency. A compressed excitation network is used to extract the frequency correlation features of the data in the frequency matrix within each time period; Suppose we need to construct a frequency matrix sample The compressed excitation network first convolves adjacent frequencies within each time period in the matrix to obtain... Where W is the frequency dimension after convolution, and C is the channel dimension. The matrix of each channel in U is compressed according to the following formula to obtain: Among them, P c These are 1×1 matrices; merging them yields a tensor. Compressing and expanding P according to the channel dimension yields tensors of the same size. Each channel vector in U and After performing the calculation, we get: Where tanh is the activation function, and the symbol * represents the Hadamard product; Finally, each channel vector V is... H×W spliced ​​into tensors 4. The time series anomaly detection method for industrial internet identifier resolution according to claim 3, characterized in that, The Long Short-Term Memory (LSTM) neural network extracts features specifically as follows: Based on the tensor V constructed from the compressed excitation network, firstly, the H matrices in the time dimension of V are... As H time steps, they are concatenated to form a one-dimensional vector z of size W×C. t Then it is input into the long short-term memory neural network; Long Short-Term Memory (LSTM) neural networks consist of a recurrent unit containing a forgetting gate f. t Input gate i t Output gate o t Cell state c t and hidden state h t During training, the input data at each time step is processed cyclically. The forget gate discards unimportant information from the previous cell state; the input gate retains important information from the input data to obtain a new cell state; and the output gate determines the important information output from the current cell state to obtain a new hidden state. The corresponding formula is: f t =σ(W f [h t-1 ,z t ]+b f ) i t =σ(W i [h t-1 ,z t ]+b i ) about t =σ(W o [h t-1 ,With t ]+b o ) h t =o t *fishy(c) t ) Wherein, the hidden state h t This is the vector output by the Long Short-Term Memory Neural Network. This vector stores the temporal correlation information in the tensor V, enabling the model to capture the inherent patterns of time series data more deeply.

5. The time series anomaly detection method for industrial internet identifier resolution according to claim 4, characterized in that, The results output module specifically includes the following steps: Based on the one-dimensional vector h output by the feature extraction module t We used a deep neural network to reduce its dimensionality; To avoid overfitting, the Dropout algorithm and non-linear activation functions are introduced into deep neural networks. The Dropout algorithm randomly discards a certain proportion of neurons during model training, so that these neurons do not participate in training temporarily. This allows the parameters that cause overfitting to be fine-tuned, making the model more generalizable. Non-linear activation functions can improve the non-linear fitting ability of the model, which also makes the model have better generalization ability. Finally, a fully connected layer containing two neurons outputs the anomaly detection binary classification result.

6. The time series anomaly detection method for industrial internet identifier resolution according to claim 1, characterized in that, In step S2, the training of the time series anomaly detection model is specifically as follows: The training process is divided into forward inference and backpropagation; In forward inference, the raw data is used to construct feature data by the feature construction module. The feature data is then input into the feature extraction module, where the compressed excitation network and the long short-term memory neural network extract the frequency correlation information of the data within the same time period and between different time periods, respectively. The result output module outputs the anomaly probability of the training data. The cross-entropy loss function is used to calculate the outlier probability p of the output. i With real labels y i Perform the calculation: In backpropagation, the partial derivative of the loss function is calculated to reduce the loss value. The parameters of each layer of the network are adjusted sequentially from back to front, so that the time series anomaly detection model learns the positive anomaly information in the data.

7. The time series anomaly detection method for industrial internet identifier resolution according to claim 1, characterized in that, Step S3 is as follows: Once the time series anomaly detection model has been trained, save the model and parameters after adjustment. For an unknown network traffic sequence to be tested, input the time series anomaly detection model, cut the traffic sequence into a subsequence of length N, construct feature data by the feature construction module, extract features by the feature extraction module, and finally output the anomaly probability by the result output module. Regarding the probability of anomalies, if the probability of anomalies exceeds a preset threshold, it is determined to be a time series anomaly.

Images