A water supply network network attack detection and identification method based on simple lightweight neural network

Abstract

The present invention discloses a water supply network network attack detection and identification method based on a simple lightweight neural network, aiming to quickly detect and identify water supply network network attacks. The method uses historical monitoring data of the water supply network under normal working conditions to predict the real-time monitoring data of the water supply network, and discovers various network attack events by performing anomaly detection on the real-time monitoring data of the water supply network. In order to improve the accuracy and efficiency of network attack detection, the present invention uses the K‑S test to screen the features of training data and test data in order to find more stable features of training data and test data. At the same time, the present invention constructs a simple lightweight neural network based on a variational autoencoder, which can effectively shorten the time spent in the prediction process and improve the efficiency of network attack detection.

Description

Technical Field

[0001] The present invention belongs to the field of urban water supply network network attack detection, and particularly relates to a water supply network network attack detection and identification method based on a simple lightweight neural network. Background Art

[0002] The water supply system is an important urban infrastructure. The normal operation and management of the water supply system depends on the Supervisory Control and Data Acquisition (SCADA) system and the Programmable Logic Controller (PLC). The SCADA system monitors the operating status of the water supply system and judges the operating status of the water supply system based on various monitoring data of the SCADA system. The PLC controls the operating status of various components of the water supply system, such as water pumps and valves, based on the monitoring data of the SCADA system, thereby ensuring that the operating parameters of the water supply system are maintained within the normal range.

[0003] As an important infrastructure, the water supply system is vulnerable to various attacks that affect the normal water supply. The attacks suffered are mainly divided into physical attacks and network attacks. Physical attacks mainly refer to leakage, pipe burst or pollutant invasion in the water supply system. When a physical attack occurs in the water supply system, it will cause a waste of water resources. Network attacks refer to attacks on the monitoring data of the SCADA system, thereby changing the normal operation of the system. No matter what kind of attack the water supply system suffers, it will affect the normal operation of the water supply system. At present, people have adopted various attack detection methods.

[0004] Compared with the extensive research on physical attacks, there are fewer studies on cyber attacks. Cyber ​​attack detection methods mainly include model-based methods and data-driven methods. Model-based methods rely on the hydraulic model of the pipe network and combine anomaly detection algorithms to discover cyber attacks that cannot be identified by hydraulic rules alone; however, this method requires good knowledge of hydraulic models, which obviously limits the application of this method in practice, while data-driven methods rely entirely on the monitoring data of the SCADA system to detect and identify cyber attacks. This method does not require good knowledge of hydraulic models; some methods predict the operating status of the water supply network through normal historical observation data and combine anomaly detection algorithms of multiple modules to identify cyber attacks; these cyber attack detection methods usually assume that the historical observation data used for predictive model training has the same probability distribution as the test data; however, in practice, due to uncertain factors such as seasonal changes or changes in the characteristics of the water supply network itself, the probability distributions of training and test data are usually different; therefore, in order to improve the accuracy of cyber attack detection, more stable features of training data and test data should be found so that the predicted observation data can accurately reflect the future real operating status of the water supply network.

[0005] In addition, the water supply network follows the same operating rules under normal conditions, and the time series monitoring data of each PLC control unit presents the same change rules. Once the operating conditions of the water supply network change (for example, a cyber attack occurs), the time series monitoring data corresponding to each PLC control unit of the water supply network will change. Compared with the time series monitoring data of each PLC control unit under normal operating conditions of the water supply network, these changed time series monitoring data can be regarded as outliers. The data-driven network attack detection method detects network attack events through anomaly detection.

[0006] Therefore, when conducting network attack detection, it is necessary to use the historical time series monitoring data of each PLC control unit to predict the time series monitoring data of each PLC control unit under normal working conditions of the water supply network. Obviously, the shorter the time spent on the prediction process, the faster the detection efficiency of the network attack, which can minimize the challenges brought by network attack events to water supply security.

[0007] In summary, it is necessary to design a water supply network network attack detection and identification method based on a simple lightweight neural network to solve the above problems. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a water supply network network attack detection and identification method based on a simple lightweight neural network. The method uses the historical monitoring data of the water supply network under normal working conditions to predict the real-time monitoring data of the water supply network, and discovers various network attack events by performing anomaly detection on the real-time monitoring data of the water supply network.

[0009] To achieve the above design, the technical solution adopted by the present invention is: a water supply network network attack detection and identification method based on a simple lightweight neural network, comprising the following steps:

[0010] S1, use EPANET to perform hydraulic simulation on the pipe network model to obtain the monitoring data of each PLC control unit under normal working conditions of the pipe network and after a network attack;

[0011] S2, using simple lightweight neural networks to build a water supply network network attack detection and identification framework;

[0012] S3, prepare training data and determine the detection thresholds of each module of the water supply network network attack detection and identification framework;

[0013] S4, burst pipes are detected and identified using the proposed simple and lightweight neural network network attack detection and identification framework.

[0014] Furthermore, the step S1 specifically includes:

[0015] Step S101, using EPANET to perform hydraulic simulation on the normal working condition of the water supply network, and obtain the time series monitoring data of each PLC control unit of the water supply network under normal working condition, the monitoring data mainly includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve and the discharge pressure of the pump;

[0016] Step S102, using EPANET to simulate various network attack events on the water supply network, changing the attack type, attack location, start time and duration of each network attack event, and obtaining the time series monitoring data of each PLC control unit in the water supply network under the network attack state. The monitoring data includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch status of the pump, the switch status of the valve and the discharge pressure of the pump.

[0017] Preferably, step S2 comprises:

[0018] S201, using KS test to perform feature selection on the time series monitoring data of each PLC control unit in the water supply network so that the training data can accurately represent the test data;

[0019] Furthermore, the burst pipe detection accuracy of the network attack detection method proposed in the present invention depends on the ability to model and predict the behavior of the water supply network system; obviously, the time series monitoring data of each PLC control unit in the water supply network must meet the following requirements, that is, the training data must represent the test data, specifically, the training data should contain all states and transitions between states that appear in the test data.

[0020] Existing network attack detection methods usually assume that the training and test data have the same probability distribution. However, in practice, due to uncertain factors such as seasonal changes or changes in the characteristics of the water supply network itself, the probability distributions of training and test data are usually different. In order to find more stable features so that the network attack detection accuracy of the proposed method is higher, the present invention adopts the KS test as a quantitative measure of the similarity between the probability distributions of training and test data; the KS test is non-parametric and is not based on any assumptions about the probability distribution of the tested data. Compared with other feature selection methods, such as t-test, mean and standard deviation, the KS test is more sensitive to feature changes and is applicable to multimodal and non-normal distributions. Feature selection of pressure monitoring data aims to determine the stable features of training and test data in order to obtain better pipe burst detection performance.

[0021] S202, performing frequency domain and time domain transformation on the time series monitoring data of each PLC control unit in the water supply network to obtain a frequency domain signal of the time series monitoring data of each PLC control unit in the water supply network;

[0022] Furthermore, a large number of monitoring devices are arranged in the water supply network, which can collect real-time monitoring data of each key position of the water supply network, such as the PLC control unit. These real-time monitoring data can accurately reflect the changes in the real-time operating state of the water supply network and timely discover the abnormal working conditions of the water supply network, such as network attack events; the time series monitoring data of each PLC control unit of the water supply network reflects the changing characteristics of the water supply network in the time domain. Although in most network attack detection methods, the time series monitoring data of each PLC control unit of the water supply network is directly used to detect network attack events, better results can be achieved by performing frequency domain analysis in signal processing. To this end, the present invention performs frequency domain analysis on the time series monitoring data of each PLC control unit of the water supply network when performing network attack detection; frequency domain analysis has the following advantages: frequency domain analysis provides a more compact representation of the main signal components of the pressure monitoring data; it can detect rapid changes in the operating conditions of the water supply network, such as pipe bursts; slow attacks that usually evade time domain detection methods will stand out in frequency analysis, but fast attacks will be difficult to detect in the frequency domain.

[0023] S203, constructing a simple lightweight neural network, using the time series historical monitoring data of each PLC control unit of the water supply network to predict the time series real-time monitoring data of the water supply network;

[0024] Furthermore, the water supply network follows the same operating rules under normal working conditions, and the time series monitoring data of each PLC control unit presents the same change rules; once the operating conditions of the water supply network change, such as a network attack event, the time series monitoring data corresponding to each PLC control unit of the water supply network will change. Compared with the time series monitoring data of each PLC control unit under normal operating conditions of the water supply network, these changed time series monitoring data can be regarded as abnormal values. The network attack detection method based on data-driven detects network attack events through abnormal detection. Therefore, when performing network attack detection, it is necessary to use the historical time series monitoring data of each PLC control unit to predict the time series monitoring data of each PLC control unit under normal working conditions of the water supply network; in order to improve the calculation efficiency, the present invention proposes a simple lightweight neural network for predicting the time series monitoring data of each PLC control unit in the water supply network.

[0025] In order to better predict the time series monitoring data of each PLC control unit of the water supply network, the present invention constructs a simple lightweight neural network based on the variational autoencoder, and modifies the network structure of the variational autoencoder: an optional corruption layer that applies Gaussian noise to the input sequence; an adjustment of the fully connected layer with a ReLU or tanh activation function that expands the input; the purpose of this layer is to expand the hypothesis space; a modification of the encoding layer, which flattens the input and uses a portion of the input size to produce its compact representation; in the present invention, the best results are achieved using a compact representation of 50% of the input size; a decoding layer that reconstructs the original sequence from its compact representation;

[0026] NN or PCA is used to predict the future values ​​of data features based on previous values ​​either in the time domain or frequency domain; thus, the network performs the following functions:

[0027]

[0028] Wherein l and m represent the input and output sequence lengths respectively, and h is the prediction range; the present invention allows prediction of future sequences of arbitrary length within a specified time range, for example, predicting 256 time steps starting from the fifth time step of the last input time.

[0029] S204, collecting the time series real-time monitoring data of each PLC control unit in the water supply network, and comparing it with the time series predicted monitoring data of each PLC control unit in the water supply network, and determining whether the water supply network has been attacked by a network by performing anomaly detection on the time series real-time monitoring data.

[0030] Preferably, step S3 comprises:

[0031] S301, preparing time series monitoring data of each PLC control unit when the pipeline network is in normal working condition and after being attacked by the network;

[0032] S302, preparing time series monitoring data of each PLC control unit when the pipeline network is in normal working conditions, and using a simple lightweight neural network to predict and obtain time series prediction monitoring data of each PLC control unit when the pipeline network is in normal working conditions;

[0033] S303, comparing the time series prediction monitoring data of each PLC control unit of the water supply network, the time series monitoring data of the water supply network under normal working conditions, and the time series monitoring data of the water supply network after being attacked by a network, to determine a detection threshold of the water supply network network attack;

[0034] S304, based on the maximum scoring method, the network attack detection performance of the proposed method is evaluated.

[0035] Preferably, step S4 comprises:

[0036] S401, using the proposed method to detect the pipe network in a normal working condition and the pipe network under a network attack, and obtaining the detection results under various working conditions;

[0037] S402, evaluating the network attack detection performance of the proposed method according to the detection and identification results of various network attack events.

[0038] Preferably, in step S402, the evaluation mainly includes three aspects:

[0039] Network attack detection delay, which is the time from when a network attack occurs to when it is detected;

[0040] The network attack event detection rate is the ratio of the number of detected network attack events to the total number of network attack events;

[0041] The false alarm rate of network attack events is the ratio of the number of events in which the pipeline network is in normal operating conditions to the total number of events in which network attack alarms are issued.

[0042] Preferably, step S201 includes:

[0043] S2011, using the time series monitoring data of each PLC control unit under normal working conditions of the water supply network obtained by simulation, it is divided into two groups: training data and test data, and the empirical cumulative distribution function of the training data and the test data is calculated. The maximum difference between the empirical cumulative distribution function of the training data and the test data is used to represent the KS test statistic:

[0044] KS = sup|F1(x)-F2(x)|;

[0045] Where F1 and F2 are the empirical cumulative distribution functions of the training and test data; the empirical cumulative distribution function can be calculated by the following formula:

[0046]

[0047] In the formula, X i represents the i-th training data or test data, and x represents the maximum value of the training data or test data;

[0048] S2012, the KS test was modified: when the mean of the distribution is slightly shifted on the x-axis, using the maximum value as the statistic makes the KS test very sensitive to small differences in the cumulative distribution function, which is used to obtain a concise measure for filtering features that are not suitable for modeling;

[0049] The KS test statistic of the training and test data is calculated by using the area between the cumulative distribution functions of the training data and the test data, which is used to improve the robustness of KS detection and ensure that the characteristics of the training data can accurately reflect the characteristics of the test, thereby further improving the accuracy of network attack detection; the formula is as follows:

[0050] KS * =∫|F1(x)-F2(x)|dx;

[0051] In the formula, S * Represents statistics of training data and test data.

[0052] Preferably, step S202 includes:

[0053] S2021, using a discrete fast Fourier transform to determine the dominant frequency of each signal, i.e., the frequency with the highest energy;

[0054] S2022, determining a short-time Fourier transform window based on the main frequency period, wherein the optimal window is between one and two periods of the main frequency;

[0055] S2023, converting the pressure monitoring data into a frequency representation;

[0056] Preferably, in step S2023, the method for converting the pressure monitoring data into frequency representation is:

[0057] The entire signal is divided into overlapping windows; a short-time Fourier transform is performed on each window; the entire short-time Fourier transform spectrum is binarized into multiple bins, and the total energy value of the signal in each bin is calculated; and at least one bin with the largest energy is selected, and the energy value represents the frequency domain characteristics of the corresponding time window.

[0058] Preferably, step S304 includes:

[0059] S3041, normalize the residuals of the time series monitoring data at each PLC control unit of the water supply network by dividing the residuals by the maximum residual of each feature of the validation set data, and compare the maximum value of the normalized residuals with the threshold τ:

[0060]

[0061] In the formula, represents the normalized value of the residual of the time series monitoring data, represents the residual of time series monitoring data, Represents the maximum residual of time series monitoring data;

[0062] S3042, determine the abnormal alarm of each PLC control unit in the water supply network at time i

[0063] To prevent false alarms of short-term deviations, the residual exceeds the threshold at least within the specified time window w; the abnormal alarm at time i Determined by the following formula:

[0064]

[0065] S3043, determining hyperparameters τ and w by setting the maximum acceptable false alarm rate of the verification data at each PLC control unit in the water supply network:

[0066]

[0067] In the formula, τ n and ω n are the threshold and the window value normalized to the range of (0, 1), is a set of anomalies detected using a specific threshold and window value, FP max is the maximum number of false alarms allowed in the validation data.

[0068] Preferably, in step S3043, the hyperparameter value does not generate more than the allowed number of false alarms while minimizing the sum of its normalized values.

[0069] Furthermore, the hyperparameter values ​​sought by the present invention will not generate more than the allowed number of false alarms while minimizing the sum of their normalized values. Using normalized values ​​can ensure that the two hyperparameters are optimized with equal weights regardless of their absolute values; minimizing the sum of normalized values ​​enables us to strike a balance between the detection sensitivity controlled by the threshold and the detection delay controlled by the window size.

[0070] The beneficial effects of the present invention are as follows:

[0071] The present invention utilizes historical monitoring data of a water supply network under normal working conditions to predict real-time monitoring data of the water supply network, and discovers various network attack events by performing anomaly detection on the real-time monitoring data of the water supply network. In order to improve the accuracy and efficiency of network attack detection, the present invention uses a KS test to screen the features of training data and test data in order to find more stable features of the training data and test data. At the same time, the present invention constructs a simple lightweight neural network based on a variational autoencoder, which can effectively shorten the time spent in the prediction process and improve the efficiency of network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 It is a schematic diagram of a flow chart of the present invention;

[0073] Figure 2 It is a schematic diagram of the C-town pipe network topology structure and a PLC schematic diagram in the second embodiment of the present invention;

[0074] Figure 3 It is a time series curve of monitoring data of each PLC unit under normal working conditions in the second embodiment of the present invention;

[0075] Figure 4 It is a time series curve of monitoring data of each PLC unit after a network attack occurs in the second embodiment of the present invention;

[0076] Figure 5 This is a schematic diagram of the simple lightweight neural network structure proposed in the second embodiment of the present invention;

[0077] Figure 6 This is a schematic diagram of the prediction of the time series monitoring data of the PLC control unit in the second embodiment of the present invention;

[0078] Figure 3 In the figure, (a) is the water level in the water tank; (b) is the pump flow rate; (c) is the pump suction pressure; (d) is the pump discharge pressure;

[0079] Figure 4 In the figure, (a) is the water level in the water tank; (b) is the pump flow rate; (c) is the pump suction pressure; and (d) is the pump discharge pressure. DETAILED DESCRIPTION

[0080] Embodiment 1:

[0081] like Figure 1 In the present invention, a water supply network network attack detection and identification method based on a simple lightweight neural network includes the following steps:

[0082] S1, use EPANET to perform hydraulic simulation on the pipe network model to obtain the monitoring data of each PLC control unit under normal working conditions of the pipe network and after a network attack;

[0083] S2, using simple lightweight neural networks to build a water supply network network attack detection and identification framework;

[0084] S3, prepare training data and determine the detection thresholds of each module of the water supply network network attack detection and identification framework;

[0085] S4, burst pipes are detected and identified using the proposed simple and lightweight neural network network attack detection and identification framework.

[0086] Furthermore, the step S1 specifically includes:

[0087] Step S101, using EPANET to perform hydraulic simulation on the normal working condition of the water supply network, and obtain the time series monitoring data of each PLC control unit of the water supply network under normal working condition, the monitoring data mainly includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve and the discharge pressure of the pump;

[0088] Step S102, using EPANET to simulate various network attack events on the water supply network, changing the attack type, attack location, start time and duration of each network attack event, and obtaining the time series monitoring data of each PLC control unit in the water supply network under the network attack state. The monitoring data includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch status of the pump, the switch status of the valve and the discharge pressure of the pump.

[0089] Preferably, step S2 comprises:

[0090] S201, using KS test to perform feature selection on the time series monitoring data of each PLC control unit in the water supply network so that the training data can accurately represent the test data;

[0091] Furthermore, the burst pipe detection accuracy of the network attack detection method proposed in the present invention depends on the ability to model and predict the behavior of the water supply network system; obviously, the time series monitoring data of each PLC control unit in the water supply network must meet the following requirements, that is, the training data must represent the test data, specifically, the training data should contain all states and transitions between states that appear in the test data.

[0092] Existing network attack detection methods usually assume that the training and test data have the same probability distribution. However, in practice, due to uncertain factors such as seasonal changes or changes in the characteristics of the water supply network itself, the probability distributions of training and test data are usually different. In order to find more stable features so that the network attack detection accuracy of the proposed method is higher, the present invention adopts the KS test as a quantitative measure of the similarity between the probability distributions of training and test data; the KS test is non-parametric and is not based on any assumptions about the probability distribution of the tested data. Compared with other feature selection methods, such as t-test, mean and standard deviation, the KS test is more sensitive to feature changes and is applicable to multimodal and non-normal distributions. Feature selection of pressure monitoring data aims to determine the stable features of training and test data in order to obtain better pipe burst detection performance.

[0093] S202, performing frequency domain and time domain transformation on the time series monitoring data of each PLC control unit in the water supply network to obtain a frequency domain signal of the time series monitoring data of each PLC control unit in the water supply network;

[0094] Furthermore, a large number of monitoring devices are arranged in the water supply network, which can collect real-time monitoring data of each key position of the water supply network, such as the PLC control unit. These real-time monitoring data can accurately reflect the changes in the real-time operating state of the water supply network and timely discover the abnormal working conditions of the water supply network, such as network attack events; the time series monitoring data of each PLC control unit of the water supply network reflects the changing characteristics of the water supply network in the time domain. Although in most network attack detection methods, the time series monitoring data of each PLC control unit of the water supply network is directly used to detect network attack events, better results can be achieved by performing frequency domain analysis in signal processing. To this end, the present invention performs frequency domain analysis on the time series monitoring data of each PLC control unit of the water supply network when performing network attack detection; frequency domain analysis has the following advantages: frequency domain analysis provides a more compact representation of the main signal components of the pressure monitoring data; it can detect rapid changes in the operating conditions of the water supply network, such as pipe bursts; slow attacks that usually evade time domain detection methods will stand out in frequency analysis, but fast attacks will be difficult to detect in the frequency domain.

[0095] S203, constructing a simple lightweight neural network, using the time series historical monitoring data of each PLC control unit of the water supply network to predict the time series real-time monitoring data of the water supply network;

[0096] Furthermore, the water supply network follows the same operating rules under normal working conditions, and the time series monitoring data of each PLC control unit presents the same change rules; once the operating conditions of the water supply network change, such as a network attack event, the time series monitoring data corresponding to each PLC control unit of the water supply network will change. Compared with the time series monitoring data of each PLC control unit under normal operating conditions of the water supply network, these changed time series monitoring data can be regarded as abnormal values. The network attack detection method based on data-driven detects network attack events through abnormal detection. Therefore, when performing network attack detection, it is necessary to use the historical time series monitoring data of each PLC control unit to predict the time series monitoring data of each PLC control unit under normal working conditions of the water supply network; in order to improve the calculation efficiency, the present invention proposes a simple lightweight neural network for predicting the time series monitoring data of each PLC control unit in the water supply network.

[0097] In order to better predict the time series monitoring data of each PLC control unit of the water supply network, the present invention constructs a simple lightweight neural network based on the variational autoencoder, and modifies the network structure of the variational autoencoder: an optional corruption layer that applies Gaussian noise to the input sequence; an adjustment of the fully connected layer with a ReLU or tanh activation function that expands the input; the purpose of this layer is to expand the hypothesis space; a modification of the encoding layer, which flattens the input and uses a portion of the input size to produce its compact representation; in the present invention, the best results are achieved using a compact representation of 50% of the input size; a decoding layer that reconstructs the original sequence from its compact representation;

[0098] NN or PCA is used to predict the future values ​​of data features based on previous values ​​either in the time domain or frequency domain; thus, the network performs the following functions:

[0099]

[0100] Wherein l and m represent the input and output sequence lengths respectively, and h is the prediction range; the present invention allows prediction of future sequences of arbitrary length within a specified time range, for example, predicting 256 time steps starting from the fifth time step of the last input time.

[0101] S204, collecting the time series real-time monitoring data of each PLC control unit in the water supply network, and comparing it with the time series predicted monitoring data of each PLC control unit in the water supply network, and determining whether the water supply network has been attacked by a network by performing anomaly detection on the time series real-time monitoring data.

[0102] Preferably, step S3 comprises:

[0103] S301, preparing time series monitoring data of each PLC control unit when the pipeline network is in normal working condition and after being attacked by the network;

[0104] S302, preparing time series monitoring data of each PLC control unit when the pipeline network is in normal working conditions, and using a simple lightweight neural network to predict and obtain time series prediction monitoring data of each PLC control unit when the pipeline network is in normal working conditions;

[0105] S303, comparing the time series prediction monitoring data of each PLC control unit of the water supply network, the time series monitoring data of the water supply network under normal working conditions, and the time series monitoring data of the water supply network after being attacked by a network, to determine a detection threshold of the water supply network network attack;

[0106] S304, based on the maximum scoring method, the network attack detection performance of the proposed method is evaluated.

[0107] Preferably, step S4 comprises:

[0108] S401, using the proposed method to detect the pipe network in a normal working condition and the pipe network under a network attack, and obtaining the detection results under various working conditions;

[0109] S402, evaluating the network attack detection performance of the proposed method according to the detection and identification results of various network attack events.

[0110] Preferably, in step S402, the evaluation mainly includes three aspects:

[0111] Network attack detection delay, which is the time from when a network attack occurs to when it is detected;

[0112] The network attack event detection rate is the ratio of the number of detected network attack events to the total number of network attack events;

[0113] The false alarm rate of network attack events is the ratio of the number of events in which the pipeline network is in normal operating conditions to the total number of events in which network attack alarms are issued.

[0114] Preferably, step S201 includes:

[0115] S2011, using the time series monitoring data of each PLC control unit under normal working conditions of the water supply network obtained by simulation, it is divided into two groups: training data and test data, and the empirical cumulative distribution function of the training data and the test data is calculated. The maximum difference between the empirical cumulative distribution function of the training data and the test data is used to represent the KS test statistic:

[0116] KS = sup|F1(x)-F2(x)|;

[0117] Where F1 and F2 are the empirical cumulative distribution functions of the training and test data; the empirical cumulative distribution function can be calculated by the following formula:

[0118]

[0119] In the formula, X i represents the i-th training data or test data, and x represents the maximum value of the training data or test data;

[0120] S2012, the KS test was modified: when the mean of the distribution is slightly shifted on the x-axis, using the maximum value as the statistic makes the KS test very sensitive to small differences in the cumulative distribution function, which is used to obtain a concise measure for filtering features that are not suitable for modeling;

[0121] The KS test statistic of the training and test data is calculated by using the area between the cumulative distribution functions of the training data and the test data, which is used to improve the robustness of KS detection and ensure that the characteristics of the training data can accurately reflect the characteristics of the test, thereby further improving the accuracy of network attack detection; the formula is as follows:

[0122] KS * =∫|F1(x)-F2(x)|dx;

[0123] In the formula, S * Represents statistics of training data and test data.

[0124] Preferably, step S202 includes:

[0125] S2021, using a discrete fast Fourier transform to determine the dominant frequency of each signal, i.e., the frequency with the highest energy;

[0126] S2022, determining a short-time Fourier transform window based on the main frequency period, wherein the optimal window is between one and two periods of the main frequency;

[0127] S2023, converting the pressure monitoring data into a frequency representation;

[0128] Preferably, in step S2023, the method for converting the pressure monitoring data into frequency representation is:

[0129] The entire signal is divided into overlapping windows; a short-time Fourier transform is performed on each window; the entire short-time Fourier transform spectrum is binarized into multiple bins, and the total energy value of the signal in each bin is calculated; and at least one bin with the largest energy is selected, and the energy value represents the frequency domain characteristics of the corresponding time window.

[0130] Preferably, step S304 includes:

[0131] S3041, normalize the residuals of the time series monitoring data at each PLC control unit of the water supply network by dividing the residuals by the maximum residual of each feature of the validation set data, and compare the maximum value of the normalized residuals with the threshold τ:

[0132]

[0133] In the formula, represents the normalized value of the residual of the time series monitoring data, represents the residual of time series monitoring data, Represents the maximum residual of time series monitoring data;

[0134] S3042, determine the abnormal alarm of each PLC control unit in the water supply network at time i

[0135] To prevent false alarms of short-term deviations, the residual exceeds the threshold at least within the specified time window w; the abnormal alarm at time i Determined by the following formula:

[0136]

[0137] S3043, determining hyperparameters τ and w by setting the maximum acceptable false alarm rate of the verification data at each PLC control unit in the water supply network:

[0138]

[0139] In the formula, τ n and ω n are the threshold and the window value normalized to the range of (0, 1), is a set of anomalies detected using a specific threshold and window value, FP max is the maximum number of false alarms allowed in the validation data.

[0140] Preferably, in step S3043, the hyperparameter value does not generate more than the allowed number of false alarms while minimizing the sum of its normalized values.

[0141] Furthermore, the hyperparameter values ​​sought by the present invention will not generate more than the allowed number of false alarms while minimizing the sum of their normalized values. Using normalized values ​​can ensure that the two hyperparameters are optimized with equal weights regardless of their absolute values; minimizing the sum of normalized values ​​enables us to strike a balance between the detection sensitivity controlled by the threshold and the detection delay controlled by the window size.

[0142] Embodiment 2:

[0143] In this embodiment, a water supply network network attack detection method based on a simple lightweight neural network includes the following steps:

[0144] Step (1), using EPANET to perform hydraulic simulation on the pipe network model, to obtain monitoring data at each PLC control unit under normal working conditions of the pipe network and after various network attack events; the step (1) specifically includes:

[0145] Step (1.1), performing hydraulic simulation on the normal working condition of the pipe network, obtaining the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switching state of the pump, the switching state of the valve and the discharge pressure of the pump under the normal working condition of the pipe network;

[0146] like Figure 2As shown, the pipe network model C-Town of the embodiment of the present invention includes 388 nodes, which are connected by 388 pipes. The water storage and distribution of the entire pipe network are provided by seven water tanks (T1-T7). The water levels of the water tanks are controlled by 11 pumps (PU1-PU11), which are divided into five pumping stations (PS1-PS5) and a control valve (V2).

[0147] Table 1 shows the various PLC units and their controlled variables in C-Town, and Table 2 shows the pumps included in each pump station in C-Town.

[0148] The system uses smart water network technology, with a set of remote sensors and actuators to monitor and control the operation of all water tanks, working valves and pumping stations; these sensors and actuators are connected to nine PLCs, which transmit data to a centralized SCADA system that coordinates network operations in real time.

[0149] Table 1: C-Town PLC units and their control variables

[0150]

[0151]

[0152] Table 2: Pumps included in each pumping station in C-Town

[0153]

[0154] like Figure 3 As shown in Figure 1, under normal operating conditions, the monitoring data time series curves of various variables of the PLC unit follow a specific periodic pattern and show certain regular changes.

[0155] Step (1.2), simulating various cyber attack scenarios of the water supply network, and obtaining the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve, and the discharge pressure of the pump after the cyber attack on the network occurs;

[0156] like Figure 4 As shown in Figure 2, the time series curves of monitoring data of each variable of each PLC unit change after a network attack on the water supply network; Figure 3 In comparison, both the individual values ​​of the monitoring data and their time series have changed.

[0157] like Figure 5 and Figure 6As shown, step (2) uses a simple lightweight neural network to build a water supply network network attack detection and identification framework, uses the historical time series monitoring data of each PLC control unit in the water supply network to predict the predicted time series monitoring data of each PLC control unit in the water supply network, and compares it with the real-time time series monitoring data of each PLC control unit in the water supply network to detect whether a network attack event occurs in the water supply network; the specific implementation process of step (2) is as follows:

[0158] Step (2.1), get the time series monitoring data of each PLC control unit of the C-Town pipe network, and use KS detection to select features of the time series monitoring data. It mainly includes the following parts: (a) water level monitoring data of each water tank, numbered T1, T2, T3, T4, T5, T6 and T7; (b) flow monitoring data of each pump and valve, numbered PU1, PU2, PU3, PU4, PU5, PU6, PU7, PU8, PU9, PU10, PU11 and V2; (c) suction pressure of each pump, numbered J280, J300, J289, J302, J307 and J14; (d) discharge pressure of each pump, numbered J269, J256, J415, J306, J317 and J422. The time series monitoring data of each PLC control unit in the C-Town pipe network is divided into two parts: training data and test data, and the empirical cumulative distribution functions of the training data and test data are calculated, represented by F1(x) and F2(x) respectively. The following formula is used to select the features of the training data and test data:

[0159] KS * =∫|F1(x)-F2(x)|dx;

[0160] After the KS test, select the training data that can accurately reflect the regular changes in the characteristics of the test data.

[0161] Step (2.2), use frequency domain and time domain transformation to monitor the time series data of each PLC control unit in the C-Town pipeline network. Use discrete fast Fourier transform (DFFT) to determine the dominant frequency (frequency with the highest energy) of the time series monitoring data of each PLC control unit in the C-Town pipeline network, determine the window of short-time Fourier transform (STFT) based on the dominant frequency period, and convert the pressure monitoring data into its frequency representation, including: (a) dividing the entire signal into overlapping windows; (b) performing STFT on each window; (c) binarizing the entire STFT spectrum into multiple bins and calculating the total energy value of the signal in each bin; (d) selecting a small number of bins with the highest energy. The energy value will represent the frequency domain characteristics of the corresponding time window.

[0162] Step (2.3), using the proposed method to detect various network attack events on the C-Town pipe network;

[0163] Step (3), using the example pipe network model C-Town to simulate the time series monitoring data of each PLC control unit in the water supply pipe network under normal conditions and after a network attack event occurs, and determine the threshold value of each abnormal detection module of the method proposed in the present invention; the specific implementation process of step (3) is as follows:

[0164] Step (3.1), prepare the time series monitoring data of each PLC control unit of the C-Town pipeline network under normal operating conditions and after a network attack occurs in the pipeline network;

[0165] Step (3.2), prepare the time series monitoring data of each PLC control unit of the C-Town pipe network under normal working conditions, and use a simple lightweight neural network to predict the time series monitoring data of each PLC control unit of the C-Town pipe network under normal working conditions;

[0166] Step (3.3), comparing the predicted PLC control unit time series monitoring data, the PLC control unit time series monitoring data under normal working conditions of the pipeline network, and the PLC control unit time series monitoring data after a network attack event occurs in the pipeline network, to determine the network attack detection threshold;

[0167] Step (3.4), based on the maximum scoring method, the network attack detection performance of the proposed method is evaluated. The residual is normalized by dividing the residual by the maximum per-feature residual of the validation set data, and the maximum value of the normalized residual is compared with the threshold τ:

[0168] Step (4), considering the situation where the C-Town pipe network has a network attack and is in normal working conditions, the proposed method is used to detect various working conditions of the pipe network to determine the pipe burst detection performance of the method; the specific implementation process of step (4) is as follows:

[0169] Step (4.1), using the proposed method to detect the C-Town pipe network in normal working conditions and the C-Town pipe network undergoing network attack events. First, the abnormal detection results of the time series monitoring data of each PLC control unit in the C-Town pipe network are obtained, and then the abnormal detection results of the time series monitoring data of each PLC control unit are combined to obtain the detection results of various network attack events in the water supply pipe network;

[0170] Step (4.2), based on the network attack detection results of the C-Town network under various network attack events,

[0171] The network attack detection performance of the proposed method is evaluated. It mainly includes three aspects: (a) network attack detection delay time, that is, the time from the occurrence of a network attack event to the detection of the network attack event; (b) network attack event detection rate, that is, the ratio of the number of detected network attack events to the total number of network attack events; (c) network attack event false alarm rate, that is, the ratio of the number of events in which the pipeline network is in normal working conditions to the total number of events that issue network attack alarms.

Claims

1. A water supply network network attack detection and identification method based on a simple lightweight neural network, characterized by: The following steps are involved: S1, use EPANET to perform hydraulic simulation on the pipe network model to obtain the monitoring data of each PLC control unit under normal working conditions of the pipe network and after a network attack; S2, using simple lightweight neural networks to build a water supply network network attack detection and identification framework, including: S201, using KS test to select features from the time series monitoring data of each PLC control unit in the water supply network, so that the training data can accurately represent the test data, including: S2011, using the time series monitoring data of each PLC control unit under normal working conditions of the water supply network obtained by simulation, it is divided into two groups: training data and test data, and the empirical cumulative distribution function of the training data and the test data is calculated. The maximum difference between the empirical cumulative distribution function of the training data and the test data is used to represent the KS test statistic: ； In the formula, and is the empirical cumulative distribution function of the training and test data; the empirical cumulative distribution function can be calculated by the following formula: ； In the formula, ; Indicates i training data or test data, Indicates the maximum value of training data or test data; S2012, the KS test was modified: when the mean of the distribution is slightly shifted on the x-axis, using the maximum value as the statistic makes the KS test very sensitive to small differences in the cumulative distribution function, which is used to obtain a concise measure for filtering features that are not suitable for modeling; The KS test statistics of the training and test data are calculated using the area between the cumulative distribution functions of the training data and the test data to improve the robustness of the KS test. The formula is as follows: ； In the formula, Represents statistics of training data and test data; S202, performing frequency domain and time domain transformation on the time series monitoring data of each PLC control unit of the water supply network to obtain a frequency domain signal of the time series monitoring data of each PLC control unit of the water supply network, including: S2021, using a discrete fast Fourier transform to determine the dominant frequency of each signal, i.e., the frequency with the highest energy; S2022, determining a short-time Fourier transform window based on the main frequency period, wherein the optimal window is between one and two periods of the main frequency; S2023, converting the pressure monitoring data into a frequency representation; S203, construct a simple lightweight neural network, use the time series historical monitoring data of each PLC control unit of the water supply network to predict the time series real-time monitoring data of the water supply network; the method of converting the pressure monitoring data into frequency representation is: The entire signal is divided into overlapping windows; a short-time Fourier transform is performed on each window; the entire short-time Fourier transform spectrum is binarized into multiple bins, and the total energy value of the signal in each bin is calculated; at least one bin with the largest energy is selected, and the energy value represents the frequency domain characteristics of the corresponding time window; S204, collecting the time series real-time monitoring data of each PLC control unit in the water supply network, and comparing it with the time series predicted monitoring data of each PLC control unit in the water supply network, and determining whether the water supply network has been attacked by a network by performing anomaly detection on the time series real-time monitoring data; S3, prepare training data and determine the detection thresholds of each module of the water supply network network attack detection and identification framework; S4, burst pipes are detected and identified using the proposed simple and lightweight neural network network attack detection and identification framework.

2. According to claim 1, a water supply network network attack detection and identification method based on a simple lightweight neural network is characterized in that: The step S3 comprises: S301, preparing time series monitoring data of each PLC control unit when the pipeline network is in normal working condition and after being attacked by the network; S302, preparing time series monitoring data of each PLC control unit when the pipeline network is in normal working conditions, and using a simple lightweight neural network to predict and obtain time series prediction monitoring data of each PLC control unit when the pipeline network is in normal working conditions; S303, comparing the time series prediction monitoring data of each PLC control unit of the water supply network, the time series monitoring data of the water supply network under normal working conditions, and the time series monitoring data of the water supply network after being attacked by a network, to determine a detection threshold of the water supply network network attack; S304, based on the maximum scoring method, the network attack detection performance of the proposed method is evaluated.

3. According to claim 1, a water supply network network attack detection and identification method based on a simple lightweight neural network is characterized in that: The step S4 comprises: S401, using the proposed method to detect the pipe network in a normal working condition and the pipe network under a network attack, and obtain the detection results under various working conditions; S402, evaluating the network attack detection performance of the proposed method according to the detection and identification results of various network attack events.

4. According to claim 3, a water supply network network attack detection and identification method based on a simple lightweight neural network is characterized in that: In step S402, the evaluation mainly includes three aspects: Network attack detection delay, which is the time from when a network attack occurs to when it is detected; The network attack event detection rate is the ratio of the number of detected network attack events to the total number of network attack events; The false alarm rate of network attack events is the ratio of the number of events in which the pipeline network is in normal operating conditions to the total number of events in which network attack alarms are issued.

5. According to claim 2, a water supply network network attack detection and identification method based on a simple lightweight neural network is characterized in that: The step S304 includes: S3041, normalize the residuals of the time series monitoring data at each PLC control unit of the water supply network by dividing the residuals by the maximum residual of each feature of the validation set data, and compare the maximum value of the normalized residuals with the threshold For comparison: ； In the formula, represents the normalized value of the residual of the time series monitoring data, represents the residual of time series monitoring data, Represents the maximum residual of time series monitoring data; S3042, determine the time of each PLC control unit in the water supply network Abnormal alarm : To prevent false alarms of short-term deviations, the residual exceeds the threshold for at least a specified time window w; Abnormal alarm Determined by the following formula: ； S3043, determining the hyperparameter by setting the maximum acceptable false alarm rate of the verification data at each PLC control unit of the water supply network and : ； In the formula, and are the threshold and the window value normalized to the range of (0, 1), respectively. is a set of anomalies detected using a specific threshold and window value, is the maximum number of false alarms allowed in the validation data.

6. According to claim 5, a water supply network network attack detection and identification method based on a simple lightweight neural network is characterized in that: In step S3043, the hyperparameter value will not generate more than the allowed number of false alarms, while minimizing the sum of its normalized values.

Images