Cyber-physical system cross-layer anomaly detection method based on information physical feature fusion

Abstract

The application discloses an industrial information physical system cross-layer anomaly detection method based on information physical feature fusion, acquires a data packet sequence of each communication event; for each data packet sequence, extracts coarse-grained features of a sequence level thereof, analyzes all data packets to obtain fine-grained features of a data packet level, and then fuses the coarse-grained features and the fine-grained features to obtain an overall feature vector of the sequence; taking the overall feature vector of the data packet sequence as observation data, projecting the observation data to a high-dimensional feature space by using a dictionary, learning the dictionary and a linear classifier; in online testing, obtaining an overall feature vector of a data packet sequence corresponding to a current communication event, obtaining sparse coding based on the dictionary, and outputting a current state label of the industrial system by using the linear classifier. The application improves real-time performance and accuracy of anomaly detection by effectively fusing information physical heterogeneous data.

Description

Technical Field

[0001] This invention belongs to the field of industrial system fault monitoring technology, specifically relating to a cross-layer anomaly detection method for industrial cyber-physical systems based on cyber-physical feature fusion. Background Technology

[0002] With the widespread application of Information and Communication Technologies (ICT), traditional Industrial Control Systems (ICS) are closely integrated with cyberspace, forming Industrial Cyber-Physical Systems (ICPS). ICPS mainly consists of a process layer, a control layer, a monitoring layer, and an enterprise layer. The process layer interacts with the control layer via a CAN-Bus, allowing the controller to collect production measurement data from process layer sensors and send control commands to the actuators (or servo mechanisms) in the process layer. The control layer communicates with the monitoring layer devices via Industrial Ethernet, enabling the monitoring host (engineering station or operator station) to track the production process's operational status in real time and adjust controller parameters according to production needs. The monitoring layer typically connects to the enterprise layer via the Internet to fully utilize the computing and storage resources of an industrial cloud platform to complete tasks such as intelligent decision-making and complex model training. Under the standard communication mode of ICPS, Operational Technology (OT) and Information Technology (IT) are deeply integrated and highly collaborative to accomplish intelligent manufacturing tasks.

[0003] Compared to traditional Industrial Control Systems (ICS), while the widespread application of ICT technologies has made ICPS (Industrial Control Systems) more intelligent and efficient, it has also led to increasingly complex security issues. On the one hand, the harsh production environment in industrial settings causes frequent physical process failures, such as sensor drift and actuator sticking. On the other hand, inherent vulnerabilities in communication protocols and hardware / software devices make the system susceptible to various types of malicious attacks, such as Denial-of-Service (DoS) attacks and spoofing attacks. Therefore, ICPS faces multiple anomaly threats from both the physical and network layers. To ensure the safe and stable operation of ICPS production processes, an effective anomaly detection method is urgently needed. Currently, anomaly detection in ICPS has received widespread attention, but most research proposes anomaly detection methods from the perspective of the physical or network layers, such as:

[0004] (1) Physical layer-based anomaly detection usually detects abnormal states based on sensor measurements or actuator control values. For example, Aboelwafa et al. [1] used the temporal and spatial correlation of sensor data to identify anomalies. Yang et al. [2] considered the process architecture and divided it into multiple regions for anomaly detection. However, although these methods can detect abnormal states in the physical space to a certain extent, they cannot defend against malicious attacks from cyberspace. This is because, on the one hand, there is a delay between the start of a network attack and the physical impact, and physical layer-based anomaly detection methods lack early identification of attack signals, resulting in severe detection lag; on the other hand, physical layer-based anomaly detection methods cannot detect attacks that do not directly cause physical impact but are still potentially threatening, such as eavesdropping attacks and scanning attacks.

[0005] (2) Information layer-based anomaly detection usually uses the characteristics of network traffic packets to determine whether the system is under attack. For example, Schneider et al. [3] proposed using stacked denoising autoencoders to detect anomalies in the raw byte stream of network traffic. Kwon et al. [4] used DNP packets as network features of the power system for anomaly detection. However, anomaly detection methods based on single packets are difficult to deal with attacks designed based on packet sequences, such as Man-In-The-Middle (MITM) attacks. Therefore, Jamdagni et al. [5] used N-GRAM text classification technology to extract the raw features of network traffic packet sequences and converted them into feature vectors for anomaly detection. Casas et al. [6] defined artificial features within the time sliding window of the packet sequence. However, information layer-based anomaly detection methods cannot identify abnormal states in the physical space because existing studies usually use fixed sliding windows or fixed time intervals for packet sequences. However, the network environment of real systems is often highly uncertain, resulting in highly dynamic network traffic, especially the extremely uneven distribution of packets containing physical layer data. The lack of comprehensive physical layer features makes it difficult for the system to detect abnormal states occurring at the physical layer.

[0006] Fully integrating the feature information of the network and physical layers of ICPS is key to achieving comprehensive anomaly detection. However, there is significant heterogeneity between the physical and network layer data in ICPS, making integration difficult. Physical layer data is typically time-series data sampled from SCADA systems in industrial settings. Combined with an industrial data acquisition module (DAM), the controller can periodically read operational data from different production equipment, thus giving physical layer data a structured characteristic. Network layer data, on the other hand, is usually a record of inter-device communication behavior, typically recorded as network traffic packets in routing or auditing systems. Affected by factors such as latency, packet loss, and retransmission in the network environment, network layer data is highly dynamic and unstructured. Therefore, the main challenges in integrating physical and network layer data in ICPS to achieve comprehensive anomaly detection include... Summary of the Invention

[0007] To address the issues of weak real-time performance and low detection accuracy in existing anomaly detection methods in ICPS, which lack comprehensive mining and effective utilization of cyber-physical layer information, this invention provides a cross-layer anomaly detection method for industrial cyber-physical systems based on cyber-physical feature fusion. By effectively fusing heterogeneous cyber-physical data, the real-time performance and accuracy of anomaly detection are improved.

[0008] To achieve the above technical objectives, the present invention adopts the following technical solution:

[0009] A cross-layer anomaly detection method for industrial cyber-physical systems based on cyber-physical feature fusion, comprising:

[0010] Offline training:

[0011] Obtain the data packet sequence of multiple communication events, with each communication event corresponding to one data packet sequence;

[0012] For each data packet sequence, extract its coarse-grained features at the sequence level and parse all data packets to obtain fine-grained features at the data packet level. Then, fuse the coarse-grained features at the sequence level and the fine-grained features at the data packet level to obtain the overall feature vector of the data packet sequence.

[0013] Using the overall feature vector of the data packet sequence as the observation data, a dictionary is used to project the observation data into a high-dimensional feature space, and the dictionary and a linear classifier are learned.

[0014] Online testing: Obtain the data packet sequence of the current communication event, obtain its overall feature vector using the same method as the offline training phase, and obtain the sparse encoding of the overall feature vector based on the learned dictionary. Then, input the sparse encoding into the linear classifier, and the output is the current state label of the industrial system.

[0015] Furthermore, when parsing data packets, each data packet is classified into dedicated data packets or general data packets according to the communication protocol type: if the data packet depends on a dedicated industrial communication protocol, the data packet is classified as a dedicated data packet; if the data packet depends on a general communication protocol, the data packet is classified as a general data packet.

[0016] If the data packet is a dedicated data packet, which includes payload data from the physical process, the fine-grained features obtained from the parsing include information layer features and physical layer features;

[0017] If the data packet is a general data packet, the fine-grained features obtained from parsing only include information layer features.

[0018] Furthermore, during feature fusion, the data packet sequence is... The data packet set is divided into a dedicated data packet subset, a general unicast data packet subset, and a general broadcast data packet subset. The physical layer features of all data packets in the dedicated data packet subset are concatenated to obtain... The information layer features of all data packets in the dedicated data packet subset are concatenated to obtain... The information layer features of all data packets in the subset of general unicast data packets are concatenated to obtain... The information layer features of all data packets in the subset of general broadcast data packets are concatenated to obtain... For data packet sequences Sequence-level feature concatenation Finally, the above spliced ​​results , , , Coarse-grained features of data packet sequences Stacking them together yields the overall feature vector of the sequence. :

[0019] .

[0020] Furthermore, the physical layer features in all data packets within the dedicated data packet subset are directly concatenated, as follows:

[0021]

[0022] in, It is the first Data packet sequence The Middle The first dedicated data packet 3D physical layer features Representing the Data packet sequence The corresponding physical layer feature vector obtained by concatenation.

[0023] Furthermore, when splicing the information layer features of each target splicing subset—specifically, a subset of dedicated data packets, a subset of general unicast data packets, and a subset of general broadcast data packets—the text data within the information layer features is spliced. Specifically, the device address splicing method for the text data is as follows:

[0024] Let the total number of devices in the industrial system be... Each device corresponds to a device address; statistically, during the sequential communication events, in the target splicing subset, using the device addresses of every two devices as the source device address and the target device address respectively, the following relationship matrix regarding IP addresses is obtained:

[0025]

[0026] Then, the device address relationship matrix is ​​vectorized to obtain the feature encoding vector of the target concatenated subset with respect to device addresses. .

[0027] Furthermore, on the other hand, the categorical data in the information layer features is concatenated. The specific concatenation method for the protocol types in the categorical data is as follows: Let the number of communication protocol types used in the industrial system be... The statistical target splicing subset adopts the first The number of data packets for each communication protocol is used to derive the protocol type relationship vector. Then, the protocol type relation vector is converted into a feature encoding vector. .

[0028] Furthermore, after obtaining the feature encoding vectors for each type of textual data and each type of categorical data in the target concatenation subset, these vectors are concatenated to obtain the information layer feature vector of the target concatenation subset:

[0029]

[0030]

[0031]

[0032] in, It is an information layer feature vector extracted from a subset of dedicated data packets. and These represent the information layer feature vectors extracted from the subsets of general unicast data packets and general broadcast data packets, respectively.

[0033] Furthermore, the extracted coarse-grained features at the sequence level refer to those reflecting macroscopic changes in network traffic, including: the number of data packets in the sequence, the duration of communication in the sequence, and the bit rate of the sequence.

[0034] Furthermore, a dictionary is used to project the observed data into a high-dimensional feature space, and the dictionary and a linear classifier are learned. The process of projecting the observed data into a high-dimensional feature space using a dictionary, and learning a reconstructed discriminative dictionary and a linear classifier using supervised information from the input signal, employs the KSVD algorithm (LC-KSVD) considering label consistency constraints. The learning objective function is constructed as follows:

[0035]

[0036] in, Represents the reconstruction error term. Represents the input signal. The dictionary represents the dictionary to be learned. Sparse coding representing the input signal; This represents the error term for identifying sparse coding. Discriminative sparse coding representing the input signal, This represents a linear transformation matrix that transforms the sparse coding in the original feature space to the discriminative sparse coding space. Represents the classification error term. Represents classifier parameters, A category label representing the input signal; and The penalty factor constant represents each item; Represents the sparsity constraint constant; Representing vectors The 0 norm, Representation matrix The Frobenius norm;

[0037] To optimize, the above formula can be rewritten as:

[0038]

[0039] make , The above formula can be simplified to:

[0040]

[0041] The above formula has been transformed into the form of a traditional dictionary learning optimization function. At this point, the parameters can be directly updated using the K-SVD method. and Thus, an optimized solution for the dictionary is obtained. Optimization solution of linear classifier ;

[0042] However, due to and It is calculated together in the above formula and belongs to the column. Standardization, therefore, further transformation yields the final learned dictionary. and linear classifier :

[0043]

[0044]

[0045] During the online testing phase, for a sample to be tested... First, use the dictionary you have learned. Calculate the corresponding sparse code :

[0046]

[0047] Finally, a linear classifier is used. Calculate the corresponding label c test :

[0048] .

[0049] Beneficial effects

[0050] The proposed cross-layer anomaly detection method for industrial cyber-physical systems based on cyber-physical heterogeneous data fusion technology can be applied to information security protection in the industrial field. This invention: (1) collects cyber-physical data in the global scope of the system based on network traffic partitioning technology triggered by communication events, and realizes the alignment of cyber-physical heterogeneous data on the time scale; (2) fully mines feature information at different levels and obtains structured feature representation based on feature extraction and fusion technology of deep packet inspection; (3) realizes the discrimination of abnormal state of the system by learning the representation of high-dimensional data through kernel-based singular value decomposition technology with label constraints.

[0051] This invention can detect abnormal behavior in Industrial Cyber-Physical Systems (ICPS) within a unified framework, including physical process failures and network attacks, thereby effectively improving the security protection capabilities of ICPS systems. Compared to traditional anomaly detection methods that rely solely on the physical layer, it can effectively identify network attacks with a detection latency of only 25%; compared to traditional anomaly detection methods that rely solely on the network layer, it can effectively identify physical faults with an 18% improvement in detection accuracy. Attached Figure Description

[0052] Figure 1 This is a conceptual diagram of the anomaly detection method described in the embodiments of this application;

[0053] Figure 2This is a schematic diagram of network traffic partitioning based on communication events as described in the embodiments of this application;

[0054] Figure 3 This is a schematic diagram of feature extraction and fusion based on deep packet parsing as described in the embodiments of this application. Detailed Implementation

[0055] The embodiments of the present invention will be described in detail below. These embodiments are based on the technical solutions of the present invention and provide detailed implementation methods and specific operation processes to further explain the technical solutions of the present invention.

[0056] This invention provides a cross-layer anomaly detection method for industrial cyber-physical systems based on cyber-physical feature fusion, mainly composed of two parts: offline training and online detection. The offline training includes traffic partitioning, feature extraction and fusion, and model training. Figure 1 As shown.

[0057] I. Offline Training

[0058] 1. Network traffic segmentation based on communication event-triggered (CAST)

[0059] Industrial systems always poll physical layer variables in a specific order, with the corresponding variable data recorded in dedicated data packets as payloads. For example, in an industrial system with only Temp and Flow variables, the controller will read from the memory buffer in the order of "Temp->Flow," then enter a listening state, waiting for the next read. Therefore, defining the reading of all dedicated data packets as a communication event allows network traffic packets to be divided into multiple packet sequences. Figure 2 This paper demonstrates a network traffic segmentation method based on communication events. In each communication event, the system reads all variables sequentially, and jumps to the next communication event once all variables have been read. The total network traffic packets are represented as a set. Therefore, the proposed network traffic segmentation method can segment multiple data packet sequences (samples):

[0060]

[0061] in, Representative set The number of sequences in the sequence, each sequence This includes network traffic data packets within that time period:

[0062]

[0063] in Represents a sequence of data packets The number of data packets. Note that due to the uncertainty of the network environment, the number of data packets in different sequences is not constant. Traditional network traffic segmentation methods rely on fixed time windows or fixed number of data packets, which may result in the loss of some information. In contrast, this patent proposes an innovative network traffic segmentation method based on communication event triggering, starting from the communication mode unique to industrial systems. This method can achieve the alignment of physical space data and network space data on the time scale while ensuring data integrity.

[0064] 2. Feature extraction and fusion based on deep packet inspection

[0065] After acquiring the data packet sequence, in order to fully consider the feature information of the information space and physical space, this embodiment adopts a feature extraction and fusion method based on deep packet parsing. For example... Figure 3 As shown, the method consists of the following modules:

[0066] a. Packet filtering: Different types of data packets typically record different device activity information. Based on the communication protocol type of the data packets, each sequence can be filtered... The included data packets are divided into dedicated data packet sets. (Dedicated packets) and general packet sets (Universal packets) ,in:

[0067] 1) Dedicated data packet set : Responsible for data packets that facilitate communication between industrial host units (engineering stations and operator stations, etc.) and controllers, relying on proprietary industrial communication protocols such as Modbus and S7comm, and typically carrying physical process-related data at the application layer.

[0068]

[0069] in Representing the The number of dedicated data packets in a data packet sequence.

[0070] 2) General Data Packet Set : Responsible for maintaining communication between other devices in the system, typically relying on standard communication protocols such as TCP and UDP.

[0071]

[0072] in Representing the The number of general data packets in a data packet sequence satisfies .

[0073] b. Content Inspection: According to the Open Systems Interconnection (OSI) reference model defined in ISO / IEC 7498-1, computer network architecture can be divided into seven layers, each with specific functions and corresponding fields. To extract the characteristic information of different layers from dedicated and general data packets, parsing is required according to the encapsulation rules of the specific communication protocol.

[0074] 1) Characteristics of Specialized Packet Parsing: From a set of specialized packets The set of feature vectors obtained by parsing each data packet one by one can be represented as:

[0075]

[0076] in, Representative by the first The sequence in the th order The feature vector obtained by parsing a dedicated data packet. A key characteristic of dedicated data packets is that, in addition to information layer features, they also contain payload data from the physical processes. It includes information layer features and physical layer features, namely:

[0077]

[0078] in, Representing the The sequence in the th order The first dedicated data packet Features derived from the information layer Representing the The sequence in the th order The first dedicated data packet Features derived from the physical layer.

[0079] 2) Characteristics of general data packet parsing: General data packets are divided into unicast packets and broadcast packets, denoted as follows: and ,Right now:

[0080]

[0081] Among them, from unicast data packets The parsed information layer features are represented as follows:

[0082]

[0083] in, Representative by the first The sequence in the th order unicast data packets The feature vector obtained from the analysis only contains information layer features:

[0084]

[0085] in, Representative by the first The sequence in the th order unicast data packets The The characteristics originate from the information layer. Compared to unicast packets, broadcast packets lack information such as the destination IP address; therefore, broadcast packets... The parsed information layer feature information is represented as follows:

[0086]

[0087] in, Representative by the first The sequence in the th order broadcast data packets The feature vectors obtained from the analysis also only contain information layer features:

[0088]

[0089] in, Representative by the first The sequence in the th order unicast data packets The Dimensions are features derived from the information layer.

[0090] In addition to fine-grained features at the packet level, coarse-grained features at the sequence level should also be considered to reflect macroscopic changes in network traffic. For example, longer packet transmission intervals or changes in the number of packets may indicate some kind of anomaly. Consider packet sequences. Coarse-grained features at the sequence level:

[0091]

[0092] in, Represents a sequence of data packets The number of data packets in the data packet. Represents a sequence of data packets The duration of communication in the middle, Represents a sequence of data packets The bit rate is the amount of data transmitted per unit of time.

[0093] c. Feature Stack Fusion: Due to inconsistent sequence lengths, the parsed features cannot be directly encoded and feature-level fusion is required. Specifically, the features obtained from message parsing include continuous data, textual data, and categorical data. Continuous data refers to... Physical layer features, textual data, and categorical data refer to... , and Information layer features in the middle.

[0094] 1) For numerical data, using network traffic partitioning triggered by communication events ensures that each sequence contains physical layer features of the same dimension. Therefore, it can be directly concatenated. The physical layer characteristics in, that is, for the first Sequences ,have:

[0095]

[0096] in It is a data packet sequence The Middle The first dedicated data packet Dimensional physical layer characteristics.

[0097] 2) For text-based data, which mainly includes features such as device IP addresses and MAC addresses, the processing method will be explained using IP addresses as an example. Assume there are three types of shared... Units of equipment, including controllers The monitoring host has The other equipment includes a table. ,Right now The following matrix can be obtained regarding the relationship between IP addresses:

[0098]

[0099] in Representative with For source address and The number of data packets in the inter-device communication process at the destination address, where Represents a counting operator. The matrix... After vectorization, we can obtain the feature encoding vector of the IP address. , This represents the vectorization operator. Similarly, the same encoding operation is performed on other text-based data.

[0100] 3) For categorical data, which mainly includes features such as protocol type, the processing method will be explained using protocol type as an example. Assume that the system contains... There are several communication protocols, among which dedicated communication protocols include Types (such as S7comm, Modbus, etc.) have standard communication protocols. Types (such as TCP, UDP, etc.), other protocols include Species (such as ARP, etc.), i.e. The relational vector regarding the communication protocol can be obtained as follows:

[0101]

[0102] in Representative of the first The number of data packets encapsulated by the communication protocol. Then, the feature vectors of the text data and the categorical data are concatenated to form the feature encoding vector of the information layer as follows:

[0103]

[0104]

[0105]

[0106] Finally, by stacking all the feature codes, a data packet sequence can be obtained. The corresponding overall feature encoding vector is as follows:

[0107]

[0108] in, and These are physical layer features and information layer features extracted from dedicated data packets. and These are information layer features extracted from general data packets. These are statistical features extracted from the data packet sequence.

[0109]

[0110] 3. Anomaly detection based on dictionary learning

[0111] Sparse coding has been successfully applied to various problems in computer vision and image analysis, including image denoising, image restoration, and image classification. For the anomaly detection task, this patent employs the KSVD algorithm (LC-KSVD) considering label consistency constraints. The goal is to learn a reconstructed discriminative dictionary and a linear classifier using supervised information from the input signal. Therefore, the learning objective function is as follows:

[0112]

[0113] in, Represents the reconstruction error term. Represents the input signal. The dictionary represents the dictionary to be learned. This represents the sparse coding of the input signal. This represents the error term for identifying sparse coding. Discriminative sparse coding representing the input signal, This represents a linear transformation matrix that transforms the sparse coding in the original feature space to the discriminative sparse coding space. Represents the classification error term. Represents classifier parameters, The category label represents the input signal. and This represents the penalty factor constant for each term. This represents the sparsity constraint constant. Representing vectors The 0 norm, Representation matrix The Frobenius norm. For optimization, the above equation can be rewritten as:

[0114]

[0115] make , The above formula can be simplified to:

[0116]

[0117] The above formula has been transformed into the form of a traditional dictionary learning optimization function, so the parameters can be directly updated using the K-SVD method during the training phase. and Thus, the target dictionary is obtained. and linear classifier However, due to , and It is calculated together in the above formula and belongs to the column. Standardization. Therefore, further transformation is required:

[0118]

[0119]

[0120] During the online testing phase, for a sample to be tested... First, use the dictionary you have learned. Calculate the corresponding sparse code :

[0121]

[0122] Finally, a linear classifier is used. Calculate the corresponding tags:

[0123]

[0124] The pseudocode for anomaly detection based on LC-KSVD is shown in Algorithm Table 2.

[0125]

[0126] The above embodiments are preferred embodiments of this application. Those skilled in the art can make various changes or improvements based on them. Without departing from the overall concept of this application, these changes or improvements should fall within the scope of protection claimed in this application.

Claims

1. A cross-layer anomaly detection method for industrial cyber-physical systems based on cyber-physical feature fusion, characterized in that, include: Offline training: Obtain the data packet sequence of multiple communication events, with each communication event corresponding to one data packet sequence; For each data packet sequence, extract its coarse-grained features at the sequence level and parse all data packets to obtain fine-grained features at the data packet level. Then, fuse the coarse-grained features at the sequence level and the fine-grained features at the data packet level to obtain the overall feature vector of the data packet sequence. Using the overall feature vector of the data packet sequence as the observation data, a dictionary is used to project the observation data into a high-dimensional feature space, and the dictionary and a linear classifier are learned. Online testing: Obtain the data packet sequence of the current communication event, obtain its overall feature vector using the same method as the offline training phase, and obtain the sparse encoding of the overall feature vector based on the learned dictionary. Then, input the sparse encoding into the linear classifier, and the output is the current state label of the industrial system. In the process of parsing data packets, each data packet is classified into dedicated data packets or general data packets according to the communication protocol type: if the data packet depends on a dedicated industrial communication protocol, the data packet is classified as a dedicated data packet; if the data packet depends on a general communication protocol, the data packet is classified as a general data packet. If the data packet is a dedicated data packet, which includes payload data from the physical process, the fine-grained features obtained from the parsing include information layer features and physical layer features; If the data packet is a general data packet, the fine-grained features obtained from parsing only include information layer features; In the process of feature fusion, the data packet sequence is... The data packet set is divided into a dedicated data packet subset, a general unicast data packet subset, and a general broadcast data packet subset. The physical layer features of all data packets in the dedicated data packet subset are concatenated to obtain... The information layer features of all data packets in the dedicated data packet subset are concatenated to obtain... The information layer features of all data packets in the subset of general unicast data packets are concatenated to obtain... The information layer features of all data packets in the subset of general broadcast data packets are concatenated to obtain... For data packet sequences Sequence-level feature concatenation Finally, the above spliced ​​results , , , Coarse-grained features of data packet sequences Stacking them together yields the overall feature vector of the sequence. : 。 2. The method according to claim 1, characterized in that, The physical layer features of all data packets in the dedicated data packet subset are directly concatenated and represented as follows: ； in, It is the first Data packet sequence The Middle The first dedicated data packet 3D physical layer features Representing the Data packet sequence The corresponding physical layer feature vector obtained by concatenation.

3. The method according to claim 1, characterized in that, When concatenating information layer features of each target concatenation subset—specifically, a subset of dedicated data packets, a subset of general unicast data packets, and a subset of general broadcast data packets—the text data within the information layer features is concatenated. Specifically, the device address concatenation method for the text data is as follows: Let the total number of devices in the industrial system be... Each device corresponds to a device address; statistically, during the sequential communication events, in the target splicing subset, using the device addresses of every two devices as the source device address and the target device address respectively, the following relationship matrix regarding IP addresses is obtained: ； Then, the device address relationship matrix is ​​vectorized to obtain the feature encoding vector of the target concatenated subset with respect to device addresses. .

4. The method according to claim 3, characterized in that, On the other hand, the categorical data in the information layer features is concatenated. The specific concatenation method for the protocol types in the categorical data is as follows: Let the number of communication protocol types used in the industrial system be... The statistical target splicing subset adopts the first The number of data packets for each communication protocol is used to derive the protocol type relationship vector. Then, the protocol type relation vector is converted into a feature encoding vector. .

5. The method according to claim 4, characterized in that, After obtaining the feature encoding vectors for each type of textual data and each type of categorical data in the target concatenation subset, these vectors are then concatenated to obtain the information layer feature vector of the target concatenation subset: ； ； ； in, It is an information layer feature vector extracted from a subset of dedicated data packets. and These represent the information layer feature vectors extracted from the subsets of general unicast data packets and general broadcast data packets, respectively.

6. The method according to claim 1, characterized in that, The extracted coarse-grained features at the sequence level refer to those reflecting macroscopic changes in network traffic, including: the number of data packets in the sequence, the duration of communication in the sequence, and the bit rate of the sequence.

7. The method according to claim 1, characterized in that, The observed data is projected onto a high-dimensional feature space using a dictionary, and a dictionary and a linear classifier are learned. The process involves projecting the observed data onto a high-dimensional feature space using a dictionary, and using supervised information from the input signal to learn a reconstructed discriminative dictionary and a linear classifier. The KSVD algorithm, considering label consistency constraints, is employed, and the learning objective function is constructed as follows: ； in, Represents the reconstruction error term. Represents the input signal. The dictionary represents the dictionary to be learned. Sparse coding representing the input signal; This represents the error term for identifying sparse coding. Discriminative sparse coding representing the input signal, This represents a linear transformation matrix that transforms the sparse coding in the original feature space to the discriminative sparse coding space. Represents the classification error term. Represents classifier parameters, A category label representing the input signal; and The penalty factor constant represents each item; Represents the sparsity constraint constant; Representing vectors The 0 norm, Representation matrix The Frobenius norm; To optimize, the above formula can be rewritten as: ； make , The above formula can be simplified to: ； The above formula has been transformed into the form of a traditional dictionary learning optimization function. At this point, the parameters can be directly updated using the K-SVD method. and Thus, an optimized solution for the dictionary is obtained. Optimization solution of linear classifier ; However, due to and It is calculated together in the above formula and belongs to the column. Standardization, therefore, further transformation yields the final learned dictionary. and linear classifier : ； ； During the online testing phase, for a sample to be tested... First, use the dictionary you have learned. Calculate the corresponding sparse code : ； Finally, a linear classifier is used. Calculate the corresponding label c test : 。

Images