A method for rapid detection and identification of network attacks on water supply networks

Abstract

The present invention provides a method for rapid detection and identification of network attacks on a water supply network. The method constructs three network attack single-point anomaly detectors based on linear regression, Chebyshev and spatial clustering methods, performs anomaly detection on the real-time monitoring data of each PLC control unit in the water supply network, integrates the anomaly detection results of the three network attack single-point anomaly detectors to determine whether a network attack event has occurred in the water supply network, and determines the location, start time and duration of the network attack event. At the same time, in order to improve the efficiency of network attack detection and identification, the integrated network attack detection and identification method is encrypted online in the form of a time sliding window; the scheme can better identify all attacks in the network attack detection algorithm data set, and can effectively detect and accurately identify various network attack events in the water supply network, thereby ensuring the safety of urban water supply.

Description

Technical Field

[0001] The invention belongs to the field of pipe burst detection in urban water supply pipe networks, and in particular relates to a method for rapid detection and identification of network attacks on water supply pipe networks. Background Art

[0002] The water supply system is an important urban infrastructure. The normal operation and management of the water supply system depends on the Supervisory Control and Data Acquisition (SCADA) system and the Programmable Logic Controller (PLC). The SCADA system monitors the operating status of the water supply system and judges the operating status of the water supply system based on various monitoring data of the SCADA system. The PLC controls the operating status of each component of the water supply system (such as water pumps and valves) based on the monitoring data of the SCADA system, thereby ensuring that the various operating parameters of the water supply system are maintained within the normal range.

[0003] As an important infrastructure, the water supply system is vulnerable to various attacks that affect the normal water supply. The attacks suffered are mainly divided into physical attacks and cyber attacks. Physical attacks mainly refer to leakage, pipe bursts or pollutant invasion in the water supply system. When a physical attack occurs in the water supply system, it will cause a waste of water resources. Cyber ​​attacks refer to attacks on the monitoring data of the SCADA system, thereby changing the normal operation of the system. No matter what kind of attack the water supply system suffers, it will affect the normal operation of the water supply system. At present, people have adopted various attack detection methods.

[0004] Compared with the extensive research on physical attacks, there are fewer studies on cyber attacks. Cyber ​​attack detection methods mainly include model-based methods and data-driven methods. Model-based methods rely on the hydraulic model of the pipe network and combine anomaly detection algorithms to discover cyber attacks that cannot be identified by hydraulic rules alone. However, this method requires good knowledge of hydraulic models, which obviously limits the application of this method in practice. Data-driven methods rely entirely on the monitoring data of the SCADA system to detect and identify cyber attacks. This method does not require good knowledge of hydraulic models. Some methods predict the operating status of the water supply network through normal historical observation data and identify cyber attacks by combining anomaly detection algorithms of multiple modules. Although this method has achieved good detection results, its detection effect is completely dependent on the prediction results of the model. Obviously, simply using existing data to detect cyber attacks can achieve better detection results.

[0005] In addition, in addition to the abnormal monitoring data generated by the SCADA system due to cyber attacks, changes in the demand of each water user in the water supply network (i.e., water use fluctuations) will also cause the SCADA system to generate abnormal monitoring data. Obviously, if the network attack detection method does not have the changes in the demand of each water user, once the SCADA system monitoring data is abnormal, it will mislead the network attack detection results and cause a large number of false alarms. In the long run, the water supply company will doubt the accuracy of the network attack detection system, thereby limiting the application of this method in practice. If the abnormal monitoring data cannot be identified and cleaned, these data will affect the subsequent network attack detection after being imported into the database. Considering the impact of weather and seasonal changes on water demand, historical monitoring values ​​need to be updated irregularly, and the latest monitoring data is added to the historical database to replace the older historical monitoring data. When adding the latest monitoring data, the abnormal values ​​need to be cleaned to ensure that the historical monitoring data can accurately reflect the normal operating conditions of the network. Considering that the monitoring of the water supply network is an ongoing process, the update of the historical database and the cleaning of the latest monitoring data should also be an online process. At the same time, the data update and cleaning process should be efficient.

[0006] In summary, it is necessary to design a method for rapid detection and identification of water supply network network attacks to solve the above problems. Summary of the invention

[0007] The technical problem to be solved by the present invention is to provide a method for rapid detection and identification of network attacks on a water supply network. The method includes a regression detector, a Chebyshev base detector and a detector based on density clustering. The outliers of each PLC control unit in the water supply network are detected by an integrated method. A case study is conducted based on an example network hydraulic model C-Town, which can better identify all attacks in the network attack detection algorithm data set.

[0008] To achieve the above design, the technical solution adopted by the present invention is: a method for rapid detection and identification of network attacks on water supply networks, comprising the following steps:

[0009] S1, use EPANET to perform hydraulic simulation on the pipe network model to obtain monitoring data at each PLC control unit under normal working conditions of the pipe network and after various network attack events;

[0010] S2, using three outlier detection methods to detect anomalies in the monitoring data at each PLC control unit in the water supply network, to confirm whether the monitoring data at each moment is an outlier;

[0011] S3, integrates the three outlier detection methods, and detects and identifies various network attack events on the water supply network based on the detection results of the three outlier detection methods;

[0012] S4, performs online real-time detection and identification of network attacks on the water supply network, and performs online encryption on the three integrated network attack single-point anomaly detection methods to improve the detection efficiency of network attacks on the water supply network.

[0013] Furthermore, step S1 specifically includes:

[0014] S101, using EPANET to perform hydraulic simulation on the normal working condition of the water supply network, and obtain the time series monitoring data of each PLC control unit in the water supply network under normal working condition, the monitoring data mainly includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve and the discharge pressure of the pump;

[0015] S102, using EPANET to simulate various network attack events of the water supply network, changing the attack type, attack location, start time and duration of each network attack event, and obtaining time series monitoring data of each PLC control unit in the water supply network under the network attack state, the monitoring data mainly includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve and the discharge pressure of the pump;

[0016] Preferably, step S2 comprises:

[0017] S201, using a linear regression anomaly detection method to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network to confirm whether the real-time monitoring data of each PLC control unit has an abnormal value;

[0018] S202, using the Chebyshev anomaly detection method to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network to confirm whether the real-time monitoring data of each PLC control unit has an abnormal value;

[0019] S203, using a density-based clustering method to perform outlier detection on the time series monitoring data of each PLC control unit in the water supply network, to confirm whether the real-time monitoring data of each PLC control unit has an outlier.

[0020] Preferably, step S201 includes:

[0021] S2011, based on the linear regression anomaly detection method, a single-point anomaly detector is constructed to detect whether there are anomalies in the time series monitoring data of each PLC control unit in the water supply network; linear regression fits a straight line through a set of N points to minimize the sum of squared residuals of the model; the model aims to minimize the total vertical distance between the data set points and the fitted line; the linear regression modeling is shown in the following formula:

[0022] regression=βx+α;

[0023] Where x is the data set in the window; take the average of the distances between the y values ​​and the regression line, and calculate the deviation as:

[0024]

[0025] Where N is the number of data points; in addition, the upper threshold H and lower threshold L are derived, where:

[0026] H = βx + α + k × Dev;

[0027] L = βx - α + k × Dev;

[0028] Among them, β is the slope and α is the y-intercept;

[0029] If the monitoring data of the PLC control unit at a certain moment is within the range of the upper threshold value H and the lower threshold value L, the monitoring data at this moment is a normal value; conversely, if the monitoring data of the PLC control unit is greater than the upper threshold value H or less than the lower threshold value L, the monitoring data at this moment is an abnormal value;

[0030] S2012, using the constructed single-point anomaly detector based on linear regression to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network, to determine whether an abnormal value appears in each PLC control unit:

[0031] For the outlier detection of a single PLC control unit, the historical monitoring data cached in the single-point anomaly detector is used to generate a regression line, β is the slope, α is the y-axis intercept, and the upper threshold H and lower threshold L of the PLC control unit are calculated; then, the real-time monitoring value of the PLC control unit is compared with the upper threshold H and the lower threshold L; if the real-time monitoring value is greater than the upper threshold H or less than the lower threshold L, the real-time monitoring value is determined to be an abnormal value and is marked; otherwise, the real-time monitoring value is considered to be a normal value and is not marked;

[0032] S2013, update the historical monitoring data cached in each single-point anomaly detector, and perform anomaly detection on the monitoring values ​​of each PLC control unit of the water supply network at the next moment; after completing the anomaly detection of each control unit at time t, update the historical monitoring data cached in the single-point anomaly detector corresponding to each PLC control unit of each water supply network, and generate a new regression line to perform anomaly detection on the monitoring data of the PLC control unit at time t+1.

[0033] Preferably, step S202 includes:

[0034] S2021, based on Chebyshev’s theorem, builds a single-point anomaly detector to detect whether there are anomalies in the time series monitoring data of each PLC control unit in the water supply network:

[0035] Chebyshev's theorem establishes a lower bound on the percentage of data that lies within k standard deviations. In the case of a normal distribution, 95% of the data falls within two standard deviations of the mean; this means that 5% of the data is expected to lie outside two standard deviations of the mean. Single-point anomaly detectors use Chebyshev's inequality to identify outliers:

[0036] P(|X-μ|≤kσ)≥(1-1 / k^2);

[0037] Among them, X represents the data to be detected input into the single-point anomaly detector by each PLC control unit of the water supply network, μ is the average value of the normal historical monitoring data cached in the single-point anomaly detector, σ is the standard deviation of the normal historical monitoring data cached in the single-point anomaly detector, and k represents the standard deviation of the average value; the Chebyshev inequality is used to obtain the optimal parameter k, which is used for the anomaly value detection of each PLC control unit in the water supply network, and the upper threshold H and lower threshold L of the single-point anomaly detector are obtained:

[0038] H = μ + k * σ;

[0039] L = μ - k * σ;

[0040] If the monitoring data of the PLC control unit at a certain moment is within the range of the upper threshold value H and the lower threshold value L, the monitoring data at this moment is a normal value; conversely, if the monitoring data of the PLC control unit is greater than the upper threshold value H or less than the lower threshold value L, the monitoring data at this moment is an abnormal value;

[0041] S2022, using the constructed single-point anomaly detector based on Chebyshev's theorem to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network, and determining whether each PLC control unit has an abnormal value;

[0042] For the abnormal value detection of a single PLC control unit, the historical monitoring data cached in the single-point abnormality detector is used to obtain the optimal k value, and the upper threshold H and lower threshold L of the PLC control unit are calculated; then, the real-time monitoring value of the PLC control unit is compared with the upper threshold H and the lower threshold L; if the real-time monitoring value is greater than the upper threshold H or less than the lower threshold L, the real-time monitoring value is determined to be an abnormal value and is marked; otherwise, the real-time monitoring value is considered to be a normal value and is not marked;

[0043] S2023, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit of the water supply network at the next moment:

[0044] After completing the abnormal value detection of each control unit at time t, the historical monitoring data cached in the single-point anomaly detector corresponding to each PLC control unit of each water supply network is updated, and the new upper threshold H and lower threshold L are calculated to perform abnormal value detection on the monitoring data of the PLC control unit at time t+1.

[0045] Preferably, step S203 includes:

[0046] S2031, a single-point anomaly detector is constructed using a density-based spatial clustering method to detect noisy outliers and missing data in the time series monitoring data of each PLC control unit. Density-based spatial clustering methods are best suited to finding anomalies in "irregular" shaped clusters, which may not be captured by linear regression and Chebyshev-based detectors;

[0047] S2032, using the constructed density spatial clustering single point anomaly detector to perform outlier detection on the time series monitoring data of each PLC control unit in the water supply network, to determine whether each PLC control unit has an outlier:

[0048] For outlier detection of a single PLC control unit, the monitoring data set corresponding to the PLC control unit is used. Two parameters, ∈ for radius and Min_point for minimum number of points within the distance, are obtained to characterize the core points; these points have at least the minimum number of data points among the neighboring points within the distance; if two core points are located in a dense neighborhood of each other, then they are said to be connected; clusters are identified as connected sequences of core nodes, and outliers are captured as clusters containing a small number of nodes;

[0049] S2033, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit in the water supply network at the next moment:

[0050] After completing the outlier detection of each control unit at time t, the historical monitoring data cached in the single-point anomaly detector corresponding to each PLC control unit in each water supply network is updated, and a new cluster is generated to perform outlier detection on the monitoring data of the PLC control unit at time t+1.

[0051] Preferably, step S3 comprises:

[0052] S301, integrate the three network attack single-point anomaly detectors to obtain the water supply network network attack detection and identification framework:

[0053] Given a set of real-time monitoring data of water supply network X=x1,…,x nand a set of basic anomaly detectors D1,…,D m , the water supply network network attack detection and identification framework is trained and tested using the monitoring data of each PLC control unit in the water supply network under normal working conditions and when a network attack event occurs, and the thresholds and weights of three network attack single-point anomaly detectors are determined;

[0054] S302, using the constructed water supply network network attack detection and identification framework to perform anomaly detection on the real-time monitoring data of each PLC control unit in the water supply network, timely discover various network attack events, and accurately determine the location, attack type and duration of the attack event.

[0055] Preferably, step S301 is specifically as follows:

[0056] S3011, using the monitoring data of each PLC control unit in the water supply network under various network attack events to train three network attack single point anomaly detectors, and calculate the vector F of each anomaly value score j , where F i [j] represents the network attack single point anomaly detector D i The monitoring data obtained is x j The abnormal score of

[0057] S3012, normalize the anomaly scores of the three network attack single-point anomaly detectors to their probability interpretation. For each network attack single-point anomaly detector D i and the outlier score F i , it will F i Transformed into a normalized vector F i ′ , where each score F i [j]∈F i Normalized to the corresponding score F i ′ [j]∈F i ′ , so that F i ′ [j]∈[0,1];

[0058] When training the water supply network network attack detection and identification framework, each network attack single point anomaly detector D i Get a series of abnormal value scores F on the monitoring data X i , different network attack single-point anomaly detectors can calculate outlier scores in different ranges; in order to better determine the weights of the outlier scores of each network attack single-point anomaly detector, each outlier score vector F i (i∈[1,m]) is normalized into a series of probability scores F i ′, each score F i ′ [j]∈[0,1] represents the estimated probability P(O|F i [j]), that is, given the outlier value F i [j], the jth monitoring data x j The probability of being in the outlier class O instead of the normal class N; when normalizing the anomaly score, the Bernoulli distribution function is maximized;

[0059] Consider the outlier score vector F i and water supply network monitoring datax j ∈X, according to Bayes’ theorem, the Bernoulli distribution function can be expressed as:

[0060]

[0061]

[0062] In the formula, a i is the discriminant function, which converts x j Classify as outliers or normal points under Gaussian distribution with equal covariance matrix; i Simplified to a linear function a i =A*F i [j]+B, then the Bernoulli distribution function can be expressed as:

[0063]

[0064] The expectation maximization algorithm is used to learn the parameters A and B. After determining the parameters A and B, P(O|F i [j]) and determine the x obtained by each network attack single point anomaly detector j The normalized score of

[0065] S3013, train the water supply network network attack detection and identification framework through unsupervised learning to determine the weights of the anomaly value scores of each network attack single point anomaly detector:

[0066] After obtaining the normalized scores of each network attack single-point anomaly detector, the anomaly detection results of the three network attack single-point anomaly detectors are combined to detect and identify various network attack events in the water supply network, and determine the location, start time and duration of each network attack event. The present invention uses the maximum likelihood estimation algorithm to integrate each network attack single-point anomaly detector. The weight of each network attack single-point anomaly detector is determined by approximating the maximum likelihood estimation through the expected maximum algorithm, taking into account two basic assumptions:

[0067] All anomaly detectors can perform independent anomaly detection. In the absence of a basic detector as a reference, the majority voting results of each anomaly detector are used as a reference for model training.

[0068] For each standardized outlier score F i [j], by setting a threshold between [0,1], we get a binary label f ij ; The present invention sets the threshold to 0.95: if F i [j]≥0.95, then f ij =1, indicating D i The reported outlier value; otherwise, it represents a normal data point; the maximum likelihood estimation algorithm converts the monitoring data X of each PLC control unit of the water supply network of the three network attack single point anomaly detectors and their corresponding binary labels f i The outlier vector of (i∈[1,m]) is used as input, and the single-point anomaly detection results of each PLC control unit are integrated; on each observed water supply network monitoring data x∈X, the possibility of the label y of x determined by all network attack single-point anomaly detectors independently predicted by each network attack single-point anomaly detector can be written as:

[0069] ∏ i∈[1,n] Pr(f i (x)|y);

[0070] Assuming that each network attack single-point anomaly detector makes an independent decision, the possibility can be expressed as f i The product of the probabilities is as follows:

[0071]

[0072] It can be further approximated as i The weighted sum of binary values ​​of , whose weights are determined by the sensitivity and specificity of the three network attack single-point anomaly detectors:

[0073]

[0074] Where sign(·) is a sign function that returns the sign of a numeric vector element, and is a class label indicating whether it is an outlier or not; the parameter α i and β i is the weight of model training, which is determined by the anomaly detector D i Determination of accuracy:

[0075]

[0076]

[0077] Where sensitivity ψ is the fraction of correctly identified outliers; specificity η is the fraction of correctly identified non-outliers.

[0078] Preferably, step S302 is specifically:

[0079] S3021, collect the real-time monitoring data of each PLC control unit of the water supply network, prepare the normal historical monitoring data of each PLC control unit at the corresponding time, input the real-time and historical monitoring data of each PLC control unit into three network attack single-point anomaly detectors, confirm whether the real-time monitoring data of each PLC control unit is an abnormal value, and obtain the abnormal score of the monitoring data of each PLC control unit;

[0080] S3022, integrating the abnormal detection results of the three network attack single-point abnormal detectors to confirm whether the monitoring data of each PLC control unit is an abnormal value; if the monitoring data of a certain PLC control unit at a certain moment is an abnormal value, it is marked, and the abnormal detection results of the three network attack single-point abnormal detectors are continuously integrated. When the number of marked abnormal values ​​reaches a certain value, a network attack alarm is issued;

[0081] S3023, if a network attack event occurs, determine the start time, duration and location of the network attack based on the integrated results of anomaly detection at multiple times by the three network attack single-point anomaly detectors; if no network attack event occurs, repeat step S3022.

[0082] Preferably, step S4 comprises:

[0083] S401, at timestamp l, the sliding window buffers N data points of each PLC control unit of the water supply network into a single data point, and calls the proposed learning algorithm to train each network attack single point anomaly detector of the water supply network network attack detection and identification framework, and determines the threshold and weight of each network attack single point anomaly detector;

[0084] S402, at timestamp t, input the real-time monitoring data of each PLC control unit of the water supply network at time t and the historical monitoring data of the past N days into the water supply network network attack detection and identification framework to determine whether the real-time monitoring data of each PLC control unit of the water supply network at time t is an abnormal value;

[0085] S403, after acquiring new monitoring data of each PLC control unit of the water supply network, observe the aggregate changes of various parameters such as α and β of each network attack single-point anomaly detector; remember the original values ​​of various parameters, and use the majority voting method to obtain the benchmark value to obtain the new value of each parameter; if the new values ​​of various parameters are slightly different from the old values, there is no need to retrain the various parameters of each network attack single-point anomaly detector; conversely, if the new values ​​of various parameters of a certain network attack single-point anomaly detector are significantly different from the old values, then the various parameters of the network attack single-point anomaly detector are retrained.

[0086] Preferably, in step S3013, when training the water supply network network attack detection and identification framework, it includes:

[0087] Use majority voting to make a “preliminary guess” about the ground truth and get preliminary results for cyber attack detection;

[0088] Estimate ψ and η for each base detector using the ground truth, and initialize α and β;

[0089] Apply the expected maximum algorithm to iteratively update α i and β i , improve the likelihood estimate until convergence;

[0090] Return to the training results of the water supply network network attack detection and identification framework

[0091] The beneficial effects of the present invention are as follows:

[0092] The present invention aims to include a regression detector, a Chebyshev-based detector and a detector based on density clustering, and adopts an integrated method to detect outliers of each PLC control unit in the water supply network. A case study is conducted based on the example network hydraulic model C-Town. The scheme can better identify all attacks in the network attack detection algorithm data set, and can effectively detect and accurately identify various network attack events in the water supply network to ensure the safety of urban water supply. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] Figure 1 It is a schematic diagram of a flow chart of the present invention;

[0094] Figure 2 It is a schematic diagram of the C-town pipe network topology structure and a PLC schematic diagram in the second embodiment of the present invention;

[0095] Figure 3 It is a time series curve of monitoring data of each PLC unit under normal working conditions in the second embodiment of the present invention;

[0096] Figure 4It is a time series curve of monitoring data of each PLC unit after a network attack occurs in the second embodiment of the present invention;

[0097] Figure 5 A schematic diagram of detecting various outliers using three outlier detection methods in Embodiment 2 of the present invention;

[0098] Figure 6 This is a schematic diagram of anomaly detection principle of a network attack single-point anomaly detector based on linear regression in Embodiment 2 of the present invention;

[0099] Figure 7 This is a schematic diagram of anomaly detection principle of a network attack single-point anomaly detector based on a density-based spatial clustering method in Embodiment 2 of the present invention;

[0100] Figure 3 In the figure, (a) is the water level in the water tank; (b) is the pump flow rate; (c) is the pump suction pressure; (d) is the pump discharge pressure;

[0101] Figure 4 In the figure, (a) is the water level in the water tank; (b) is the pump flow rate; (c) is the pump suction pressure; and (d) is the pump discharge pressure. DETAILED DESCRIPTION

[0102] Embodiment 1:

[0103] like Figure 1 A method for rapid detection and identification of network attacks on a water supply network includes the following steps:

[0104] S1, use EPANET to perform hydraulic simulation on the pipe network model to obtain monitoring data at each PLC control unit under normal working conditions of the pipe network and after various network attack events;

[0105] S2, using three outlier detection methods to detect anomalies in the monitoring data at each PLC control unit in the water supply network, to confirm whether the monitoring data at each moment is an outlier;

[0106] S3, integrates the three outlier detection methods, and detects and identifies various network attack events on the water supply network based on the detection results of the three outlier detection methods;

[0107] S4, performs online real-time detection and identification of network attacks on the water supply network, and performs online encryption on the three integrated network attack single-point anomaly detection methods to improve the detection efficiency of network attacks on the water supply network.

[0108] Furthermore, step S1 specifically includes:

[0109] S101, using EPANET to perform hydraulic simulation on the normal working condition of the water supply network, and obtain the time series monitoring data of each PLC control unit in the water supply network under normal working condition, the monitoring data mainly includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve and the discharge pressure of the pump;

[0110] S102, using EPANET to simulate various network attack events of the water supply network, changing the attack type, attack location, start time and duration of each network attack event, and obtaining time series monitoring data of each PLC control unit in the water supply network under the network attack state, the monitoring data mainly includes the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve and the discharge pressure of the pump;

[0111] Preferably, step S2 comprises:

[0112] S201, using a linear regression anomaly detection method to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network to confirm whether the real-time monitoring data of each PLC control unit has an abnormal value;

[0113] S202, using the Chebyshev anomaly detection method to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network to confirm whether the real-time monitoring data of each PLC control unit has an abnormal value;

[0114] S203, using a density-based clustering method to perform outlier detection on the time series monitoring data of each PLC control unit in the water supply network, to confirm whether the real-time monitoring data of each PLC control unit has an outlier.

[0115] Preferably, step S201 includes:

[0116] S2011, based on the linear regression anomaly detection method, a single-point anomaly detector is constructed to detect whether there are anomalies in the time series monitoring data of each PLC control unit in the water supply network; linear regression fits a straight line through a set of N points to minimize the sum of squared residuals of the model; the model aims to minimize the total vertical distance between the data set points and the fitted line; the linear regression modeling is shown in the following formula:

[0117] regression=βx+α;

[0118] Where x is the data set in the window; take the average of the distances between the y values ​​and the regression line, and calculate the deviation as:

[0119]

[0120] Where N is the number of data points; in addition, the upper threshold H and lower threshold L are derived, where:

[0121] H = βx + α + k × Dev;

[0122] L = βx - α + k × Dev;

[0123] Among them, β is the slope and α is the y-intercept;

[0124] If the monitoring data of the PLC control unit at a certain moment is within the range of the upper threshold value H and the lower threshold value L, the monitoring data at this moment is a normal value; conversely, if the monitoring data of the PLC control unit is greater than the upper threshold value H or less than the lower threshold value L, the monitoring data at this moment is an abnormal value;

[0125] S2012, using the constructed single-point anomaly detector based on linear regression to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network, to determine whether an abnormal value appears in each PLC control unit:

[0126] For the outlier detection of a single PLC control unit, the historical monitoring data cached in the single-point anomaly detector is used to generate a regression line, β is the slope, α is the y-axis intercept, and the upper threshold H and lower threshold L of the PLC control unit are calculated; then, the real-time monitoring value of the PLC control unit is compared with the upper threshold H and the lower threshold L; if the real-time monitoring value is greater than the upper threshold H or less than the lower threshold L, the real-time monitoring value is determined to be an abnormal value and is marked; otherwise, the real-time monitoring value is considered to be a normal value and is not marked;

[0127] S2013, update the historical monitoring data cached in each single-point anomaly detector, and perform anomaly detection on the monitoring values ​​of each PLC control unit of the water supply network at the next moment; after completing the anomaly detection of each control unit at time t, update the historical monitoring data cached in the single-point anomaly detector corresponding to each PLC control unit of each water supply network, and generate a new regression line to perform anomaly detection on the monitoring data of the PLC control unit at time t+1.

[0128] Preferably, step S202 includes:

[0129] S2021, based on Chebyshev’s theorem, builds a single-point anomaly detector to detect whether there are anomalies in the time series monitoring data of each PLC control unit in the water supply network:

[0130] Chebyshev's theorem establishes a lower bound on the percentage of data that lies within k standard deviations. In the case of a normal distribution, 95% of the data falls within two standard deviations of the mean; this means that 5% of the data is expected to lie outside two standard deviations of the mean. Single-point anomaly detectors use Chebyshev's inequality to identify outliers:

[0131] P(|X-μ|≤kσ)≥(1-1 / k^2);

[0132] Among them, X represents the data to be detected input into the single-point anomaly detector by each PLC control unit of the water supply network, μ is the average value of the normal historical monitoring data cached in the single-point anomaly detector, σ is the standard deviation of the normal historical monitoring data cached in the single-point anomaly detector, and k represents the standard deviation of the average value; the Chebyshev inequality is used to obtain the optimal parameter k, which is used for the anomaly value detection of each PLC control unit in the water supply network, and the upper threshold H and lower threshold L of the single-point anomaly detector are obtained:

[0133] H = μ + k * σ;

[0134] L = μ - k * σ;

[0135] If the monitoring data of the PLC control unit at a certain moment is within the range of the upper threshold value H and the lower threshold value L, the monitoring data at this moment is a normal value; conversely, if the monitoring data of the PLC control unit is greater than the upper threshold value H or less than the lower threshold value L, the monitoring data at this moment is an abnormal value;

[0136] S2022, using the constructed single-point anomaly detector based on Chebyshev's theorem to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network, and determining whether each PLC control unit has an abnormal value;

[0137] For the abnormal value detection of a single PLC control unit, the historical monitoring data cached in the single-point abnormality detector is used to obtain the optimal k value, and the upper threshold H and lower threshold L of the PLC control unit are calculated; then, the real-time monitoring value of the PLC control unit is compared with the upper threshold H and the lower threshold L; if the real-time monitoring value is greater than the upper threshold H or less than the lower threshold L, the real-time monitoring value is determined to be an abnormal value and is marked; otherwise, the real-time monitoring value is considered to be a normal value and is not marked;

[0138] S2023, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit of the water supply network at the next moment:

[0139] After completing the abnormal value detection of each control unit at time t, the historical monitoring data cached in the single-point anomaly detector corresponding to each PLC control unit of each water supply network is updated, and the new upper threshold H and lower threshold L are calculated to perform abnormal value detection on the monitoring data of the PLC control unit at time t+1.

[0140] Preferably, step S203 includes:

[0141] S2031, a single-point anomaly detector is constructed using a density-based spatial clustering method to detect noisy outliers and missing data in the time series monitoring data of each PLC control unit. Density-based spatial clustering methods are best suited to finding anomalies in "irregular" shaped clusters, which may not be captured by linear regression and Chebyshev-based detectors;

[0142] S2032, using the constructed density spatial clustering single point anomaly detector to perform outlier detection on the time series monitoring data of each PLC control unit in the water supply network, to determine whether each PLC control unit has an outlier:

[0143] For outlier detection of a single PLC control unit, the monitoring data set corresponding to the PLC control unit is used. Two parameters, ∈ for radius and Min_point for minimum number of points within the distance, are obtained to characterize the core points; these points have at least the minimum number of data points among the neighboring points within the distance; if two core points are located in a dense neighborhood of each other, then they are said to be connected; clusters are identified as connected sequences of core nodes, and outliers are captured as clusters containing a small number of nodes;

[0144] S2033, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit in the water supply network at the next moment:

[0145] After completing the outlier detection of each control unit at time t, the historical monitoring data cached in the single-point anomaly detector corresponding to each PLC control unit in each water supply network is updated, and a new cluster is generated to perform outlier detection on the monitoring data of the PLC control unit at time t+1.

[0146] Preferably, step S3 comprises:

[0147] S301, integrate the three network attack single-point anomaly detectors to obtain the water supply network network attack detection and identification framework:

[0148] Given a set of real-time monitoring data of water supply network X=x1,…,x n and a set of basic anomaly detectors D1,…,D m, the water supply network network attack detection and identification framework is trained and tested using the monitoring data of each PLC control unit in the water supply network under normal working conditions and when a network attack event occurs, and the thresholds and weights of three network attack single-point anomaly detectors are determined;

[0149] S302, using the constructed water supply network network attack detection and identification framework to perform anomaly detection on the real-time monitoring data of each PLC control unit in the water supply network, timely discover various network attack events, and accurately determine the location, attack type and duration of the attack event.

[0150] Preferably, step S301 is specifically as follows:

[0151] S3011, using the monitoring data of each PLC control unit in the water supply network under various network attack events to train three network attack single point anomaly detectors, and calculate the vector F of each anomaly value score j , where F i [j] represents the network attack single point anomaly detector D i The monitoring data obtained is x j The abnormal score of

[0152] S3012, normalize the anomaly scores of the three network attack single-point anomaly detectors to their probability interpretation. For each network attack single-point anomaly detector D i and the outlier score F i , it will F i Transformed into a normalized vector F i ′ , where each score F i [j]∈F i Normalized to the corresponding score F i ′ [j]∈F i ′ , so that F i ′ [j]∈[0,1];

[0153] When training the water supply network network attack detection and identification framework, each network attack single point anomaly detector D i Get a series of abnormal value scores F on the monitoring data X i , different network attack single-point anomaly detectors can calculate outlier scores in different ranges; in order to better determine the weights of the outlier scores of each network attack single-point anomaly detector, each outlier score vector F i (i∈[1,m]) is normalized into a series of probability scores F i ′ , each score F i′ [j]∈[0,1] represents the estimated probability P(O|F i [j]), that is, given the outlier value F i [j], the jth monitoring data x j The probability of being in the outlier class O instead of the normal class N; when normalizing the anomaly score, the Bernoulli distribution function is maximized;

[0154] Consider the outlier score vector F i and water supply network monitoring datax j ∈X, according to Bayes’ theorem, the Bernoulli distribution function can be expressed as:

[0155]

[0156]

[0157] In the formula, a i is the discriminant function, which converts x j Classify as outliers or normal points under Gaussian distribution with equal covariance matrix; i Simplified to a linear function a i =A*F i [j]+B, then the Bernoulli distribution function can be expressed as:

[0158]

[0159] The expectation maximization algorithm is used to learn the parameters A and B. After determining the parameters A and B, P(O|F i [j]) and determine the x obtained by each network attack single point anomaly detector j The normalized score of

[0160] S3013, train the water supply network network attack detection and identification framework through unsupervised learning to determine the weights of the anomaly value scores of each network attack single point anomaly detector:

[0161] After obtaining the normalized scores of each network attack single-point anomaly detector, the anomaly detection results of the three network attack single-point anomaly detectors are combined to detect and identify various network attack events in the water supply network, and determine the location, start time and duration of each network attack event. The present invention uses the maximum likelihood estimation algorithm to integrate each network attack single-point anomaly detector. The weight of each network attack single-point anomaly detector is determined by approximating the maximum likelihood estimation through the expected maximum algorithm, taking into account two basic assumptions:

[0162] All anomaly detectors can perform independent anomaly detection. In the absence of a basic detector as a reference, the majority voting results of each anomaly detector are used as a reference for model training.

[0163] For each standardized outlier score F i [j], by setting a threshold between [0,1], we get a binary label f ij ; The present invention sets the threshold to 0.95: if F i [j]≥0.95, then f ij =1, indicating D i The reported outlier value; otherwise, it represents a normal data point; the maximum likelihood estimation algorithm converts the monitoring data X of each PLC control unit of the water supply network of the three network attack single point anomaly detectors and their corresponding binary labels f i The outlier vector of (i∈[1,m]) is used as input, and the single-point anomaly detection results of each PLC control unit are integrated; on each observed water supply network monitoring data x∈X, the possibility of the label y of x determined by all network attack single-point anomaly detectors independently predicted by each network attack single-point anomaly detector can be written as:

[0164] ∏ i∈[1,n] Pr(f i (x)|y);

[0165] Assuming that each network attack single-point anomaly detector makes an independent decision, the possibility can be expressed as f i The product of the probabilities is as follows:

[0166]

[0167] It can be further approximated as i The weighted sum of binary values ​​of , whose weights are determined by the sensitivity and specificity of the three network attack single-point anomaly detectors:

[0168]

[0169] Where sign(·) is a sign function that returns the sign of a numeric vector element, and is a class label indicating whether it is an outlier or not; the parameter α i and β i is the weight of model training, which is determined by the anomaly detector D i Determination of accuracy:

[0170]

[0171]

[0172] Where sensitivity ψ is the fraction of correctly identified outliers; specificity η is the fraction of correctly identified non-outliers.

[0173] Preferably, step S302 is specifically:

[0174] S3021, collect the real-time monitoring data of each PLC control unit of the water supply network, prepare the normal historical monitoring data of each PLC control unit at the corresponding time, input the real-time and historical monitoring data of each PLC control unit into three network attack single-point anomaly detectors, confirm whether the real-time monitoring data of each PLC control unit is an abnormal value, and obtain the abnormal score of the monitoring data of each PLC control unit;

[0175] S3022, integrating the abnormal detection results of the three network attack single-point abnormal detectors to confirm whether the monitoring data of each PLC control unit is an abnormal value; if the monitoring data of a certain PLC control unit at a certain moment is an abnormal value, it is marked, and the abnormal detection results of the three network attack single-point abnormal detectors are continuously integrated. When the number of marked abnormal values ​​reaches a certain value, a network attack alarm is issued;

[0176] S3023, if a network attack event occurs, determine the start time, duration and location of the network attack based on the integrated results of anomaly detection at multiple times by the three network attack single-point anomaly detectors; if no network attack event occurs, repeat step S3022.

[0177] Preferably, step S4 comprises:

[0178] S401, at timestamp l, the sliding window buffers N data points of each PLC control unit of the water supply network into a single data point, and calls the proposed learning algorithm to train each network attack single point anomaly detector of the water supply network network attack detection and identification framework, and determines the threshold and weight of each network attack single point anomaly detector;

[0179] S402, at timestamp t, input the real-time monitoring data of each PLC control unit of the water supply network at time t and the historical monitoring data of the past N days into the water supply network network attack detection and identification framework to determine whether the real-time monitoring data of each PLC control unit of the water supply network at time t is an abnormal value;

[0180] S403, after acquiring new monitoring data of each PLC control unit of the water supply network, observe the aggregate changes of various parameters such as α and β of each network attack single-point anomaly detector; remember the original values ​​of various parameters, and use the majority voting method to obtain the benchmark value to obtain the new value of each parameter; if the new values ​​of various parameters are slightly different from the old values, there is no need to retrain the various parameters of each network attack single-point anomaly detector; conversely, if the new values ​​of various parameters of a certain network attack single-point anomaly detector are significantly different from the old values, then the various parameters of the network attack single-point anomaly detector are retrained.

[0181] Preferably, in step S3013, when training the water supply network network attack detection and identification framework, it includes:

[0182] Use majority voting to make a “preliminary guess” about the ground truth and get preliminary results for cyber attack detection;

[0183] Estimate ψ and η for each base detector using the ground truth, and initialize α and β;

[0184] Apply the expected maximum algorithm to iteratively update α i and β i , improve the likelihood estimate until convergence;

[0185] Return to the training results of the water supply network network attack detection and identification framework

[0186] Embodiment 2:

[0187] In this embodiment, a water supply network network attack and rapid detection and identification method includes the following steps:

[0188] Step (1) uses EPANET to perform hydraulic simulation on the pipe network model to obtain monitoring data at each PLC control unit under normal working conditions of the pipe network and after various network attack events. The step (1) specifically includes:

[0189] Step (1.1), performing hydraulic simulation on the normal working condition of the pipe network, obtaining the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switching state of the pump, the switching state of the valve and the discharge pressure of the pump under the normal working condition of the pipe network;

[0190] like Figure 2 As shown, the pipe network model C-Town of the embodiment of the present invention includes 388 nodes, which are connected by 388 pipes. The water storage and distribution of the entire pipe network are provided by seven water tanks (T1-T7). The water levels of the water tanks are controlled by 11 pumps (PU1-PU11), which are divided into five pumping stations (PS1-PS5) and a control valve (V2).

[0191] Table 1 shows the various PLC units and their controlled variables in C-Town, and Table 2 shows the pumps included in each pump station in C-Town.

[0192] The system uses smart water network technology, with a set of remote sensors and actuators to monitor and control the operation of all water tanks, working valves and pumping stations. These sensors and actuators are connected to nine PLCs, which transmit data to a centralized SCADA system that coordinates network operations in real time.

[0193] Table 1: C-Town PLC units and their control variables

[0194]

[0195] Table 2: Pumps included in each pumping station in C-Town

[0196]

[0197] like Figure 3 As shown in Figure 1, under normal operating conditions, the monitoring data time series curves of various variables of the PLC unit follow a specific periodic pattern and show certain regular changes.

[0198] Step (1.2), simulating various cyber attack scenarios of the water supply network, and obtaining the water level of each water tank, the flow rate of the pump, the flow rate of the valve, the switch state of the pump, the switch state of the valve, and the discharge pressure of the pump after the cyber attack on the network occurs;

[0199] like Figure 4 As shown in Figure 2, after the water supply network was attacked by a network attack, the monitoring data time series curves of each variable of each PLC unit changed, which is consistent with Figure 3 In comparison, both the individual values ​​of the monitoring data and their time series have changed.

[0200] Step (2), such as Figure 5 , Figure 6 and Figure 7 As shown, three abnormal value detection methods are used to detect abnormalities in the monitoring data at each PLC control unit of the water supply network to confirm whether the monitoring data at each moment is an abnormal value. The step (2) specifically includes:

[0201] Step (2.1) uses the linear regression anomaly detection method to detect outliers in the time series monitoring data of each PLC control unit in the water supply network to confirm whether there are outliers in the real-time monitoring data of each PLC control unit. The input variables are mainly divided into the following parts:

[0202] (a) Water level monitoring data of each water tank, numbered T1, T2, T3, T4, T5, T6 and T7;

[0203] (b) Flow monitoring data of each pump and valve, numbered PU1, PU2, PU3, PU4, PU5, PU6, PU7, PU8, PU9, PU10, PU11 and V2;

[0204] (c) The suction pressure of each pump, numbered J280, J300, J289, J302, J307 and J14;

[0205] (d) The discharge pressure of each pump, numbered J269, J256, J415, J306, J317 and J422;

[0206] Step (2.2) uses the Chebyshev anomaly detection method to detect outliers in the time series monitoring data of each PLC control unit in the water supply network to confirm whether there are outliers in the real-time monitoring data of each PLC control unit. The input variables are mainly divided into the following parts:

[0207] (a) Water level monitoring data of each water tank, numbered T1, T2, T3, T4, T5, T6 and T7;

[0208] (b) Flow monitoring data of each pump and valve, numbered PU1, PU2, PU3, PU4, PU5, PU6, PU7, PU8, PU9, PU10, PU11 and V2;

[0209] (c) The suction pressure of each pump, numbered J280, J300, J289, J302, J307 and J14;

[0210] (d) The discharge pressure of each pump, numbered J269, J256, J415, J306, J317 and J422;

[0211] Step (2.3) uses a density-based clustering method to detect outliers in the time series monitoring data of each PLC control unit in the water supply network to confirm whether there are outliers in the real-time monitoring data of each PLC control unit. The input variables are mainly divided into the following parts:

[0212] (a) Water level monitoring data of each water tank, numbered T1, T2, T3, T4, T5, T6 and T7;

[0213] (b) Flow monitoring data of each pump and valve, numbered PU1, PU2, PU3, PU4, PU5, PU6, PU7, PU8, PU9, PU10, PU11 and V2;

[0214] (c) The suction pressure of each pump, numbered J280, J300, J289, J302, J307 and J14;

[0215] (d) The discharge pressure of the pumps numbered J269, J256, J415, J306, J317 and J422.

[0216] Step (3): Integrate the three outlier detection methods, and detect and identify various network attack events of the water supply network according to the detection results of the three outlier detection methods. The step (3) specifically includes:

[0217] Step (3.1), integrate the three network attack single point anomaly detectors to obtain the water supply network network attack detection and identification framework. Given a set of water supply network real-time monitoring data X = x1,…,x n and a set of basic anomaly detectors D1,…,D m , the water supply network network attack detection and identification framework is trained and tested using the monitoring data of each PLC control unit in the water supply network under normal working conditions and when a network attack event occurs, and the thresholds and weights of three network attack single-point anomaly detectors are determined;

[0218] Taking the water level monitoring data of water tank T1 after the cyber attack as an example, the water supply network cyber attack detection and identification framework is trained and tested.

[0219] Take the water level monitoring data of water tank T1 at 1:00 on January 21, 2014 as an example to detect whether it exceeds the normal threshold limit. The historical water level monitoring data of water tank T1 in the past 15 days [0.41, 2.88, 3.86, 1.01, 0.62, 3.77, 3.34, 0.4, 2.8, 1.01, 2.17, 0.89, 0.71, 4.07, 0.59] and the real-time monitoring data 3.81 are input into three network attack anomaly detectors.

[0220] Step (3.1.1), input the historical water level monitoring data of water tank T1 in the past 15 days [0.41, 2.88, 3.86, 1.01, 0.62, 3.77, 3.34, 0.4, 2.8, 1.01, 2.17, 0.89, 0.71, 4.07, 0.59] and the real-time monitoring data 3.81 after the network attack incident into the three network attack single point anomaly detectors, and calculate the vector F of each anomaly value score j , where F i [j] represents the network attack single point anomaly detector D i The monitoring data obtained is x j The abnormal score of

[0221] Step (3.1.2), normalize the anomaly scores of the three network attack single-point anomaly detectors to their probability interpretation, for each network attack single-point anomaly detector D i and the outlier score F i , it will F i Transformed into a normalized vector F i ′ , where each score F i [j]∈F i Normalized to the corresponding score F i ′ [j]∈F i ′ , so that F i ′ [j]∈[0,1];

[0222] Step (3.1.3), train the water supply network network attack detection and identification framework through unsupervised learning, determine the weight of the anomaly value score of each network attack single point anomaly detector, and ensure that the water supply network network attack detection and identification framework can accurately detect the water level change of water tank T1 after the network attack event occurs;

[0223] Step (3.2) uses the constructed water supply network network attack detection and identification framework to perform anomaly detection on the real-time monitoring data of each PLC control unit in the water supply network, timely discover various network attack events, and accurately determine the location, attack type and duration of the attack event. For example, after detecting that the water level monitoring data of water tank T1 is abnormal, it can be determined that a network attack event has occurred in the PLC2 control unit.

[0224] Step (4): Perform online real-time detection and identification of water supply network network attacks, and perform online encryption on the integrated anomaly detection method to improve the detection efficiency of water supply network network attacks. The specific implementation process of step (4) is as follows:

[0225] Step (4.1), using the monitoring data of each PLC control unit in the water supply network, calling the proposed learning algorithm to train each network attack single-point anomaly detector of the water supply network network attack detection and identification framework, and determine the threshold and weight of each network attack single-point anomaly detector. Taking the monitoring data anomaly detection at water tank T1 as an example, first collect the normal historical water level monitoring data of water tank T1 in the past 15 days, and simulate the abnormal water level monitoring data of water tank T1 after various network attack events occur in the water supply network; then, the historical water level monitoring data of water tank T1 in the past 15 days at a certain moment and the abnormal water level monitoring data after various network attack events, a total of 16 water level monitoring data, are input into the water supply network network attack detection and identification framework, and each network attack single-point anomaly detector is trained to determine the threshold and weight of each network attack single-point anomaly detector;

[0226] Step (4.2), after determining the thresholds and weights of each network attack single-point anomaly detector, use the "assembly line" method to perform online real-time detection and identification of water supply network network attacks. Taking the monitoring data of water tank T1 at time t as an example, the real-time water level monitoring data of water tank T1 at time t and the historical water level monitoring data at time t in the past 15 days are input into the water supply network network attack detection and identification framework to determine whether the water level monitoring data of water tank T1 at time t is an abnormal value. If the water level monitoring data of water tank T1 at time t is detected as an abnormal value, it is marked, and the water level monitoring data at the next moment is detected to be an abnormal value. When the abnormal value marking time reaches a certain length, a network attack alarm is issued;

[0227] Step (4.3), when performing online real-time detection and identification of water supply network network attacks, the thresholds and weights of each network attack single-point anomaly detector in the water supply network network attack detection and identification framework are also updated in a "semi-offline" manner. After collecting new monitoring data, observe the aggregate changes of various parameters (such as α and β) of each network attack single-point anomaly detector. Remember the original values ​​of various parameters, and use the majority voting method to obtain the benchmark value to obtain the new value of each parameter. If the new values ​​of various parameters are slightly different from the old values, there is no need to retrain the various parameters of each anomaly detector. Conversely, if the new values ​​of various parameters are significantly different from the old values, the various parameters of each network attack single-point anomaly detector are retrained.

Claims

1. A method for rapid detection and identification of network attacks on water supply networks, characterized in that: The following steps are involved: S1, use EPANET to perform hydraulic simulation on the pipe network model to obtain monitoring data at each PLC control unit under normal working conditions of the pipe network and after various network attack events; S2, using three outlier detection methods to detect anomalies in the monitoring data at each PLC control unit of the water supply network, to confirm whether the monitoring data at each moment is an outlier, including: S201, using a linear regression anomaly detection method to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network to confirm whether the real-time monitoring data of each PLC control unit has an abnormal value; S202, using the Chebyshev anomaly detection method to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network to confirm whether the real-time monitoring data of each PLC control unit has an abnormal value; S203, using a density-based clustering method to perform outlier detection on the time series monitoring data of each PLC control unit in the water supply network, to confirm whether the real-time monitoring data of each PLC control unit has an outlier; S3 integrates three outlier detection methods and detects and identifies various network attack events on the water supply network based on the detection results of the three outlier detection methods, including S301, integrate the three network attack single-point anomaly detectors to obtain the water supply network network attack detection and identification framework: Given a set of real-time monitoring data of water supply network and a set of basic anomaly detectors , the water supply network network attack detection and identification framework is trained and tested using the monitoring data of each PLC control unit in the water supply network under normal working conditions and when a network attack event occurs, and the thresholds and weights of three network attack single-point anomaly detectors are determined; S302, using the constructed water supply network network attack detection and identification framework to perform anomaly detection on the real-time monitoring data of each PLC control unit of the water supply network, timely discover various network attack events, and accurately determine the location, attack type and duration of the attack event; S4, performs online real-time detection and identification of network attacks on the water supply network, and performs online encryption on the three integrated network attack single-point anomaly detection methods to improve the detection efficiency of network attacks on the water supply network.

2. According to claim 1, a method for rapid detection and identification of network attacks on water supply networks is characterized in that: The step S201 includes: S2011, based on the linear regression anomaly detection method, a single-point anomaly detector is constructed to detect whether there are anomalies in the time series monitoring data of each PLC control unit in the water supply network; linear regression fits a straight line through a set of N points to minimize the sum of squared residuals of the model; the model aims to minimize the total vertical distance between the data set points and the fitted line; the linear regression modeling is shown in the following formula: ； Where x is the data set in the window; take the average of the distances between the y values ​​and the regression line, and calculate the deviation as: ； Where N is the number of data points; in addition, the upper threshold H and lower threshold L are derived, where: ； ； in, is the slope, is the y-intercept; If the monitoring data of the PLC control unit at a certain moment is within the range of the upper threshold H and the lower threshold L, the monitoring data at this moment is a normal value; conversely, if the monitoring data of the PLC control unit is greater than the upper threshold H or less than the lower threshold L, the monitoring data at this moment is an abnormal value; S2012, using the constructed single-point anomaly detector based on linear regression to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network, to determine whether each PLC control unit has an abnormal value: For outlier detection of a single PLC control unit, the regression line is generated using the historical monitoring data cached in the single-point anomaly detector. is the slope, is the y-axis intercept, and the upper threshold H and lower threshold L of the PLC control unit are calculated; then, the real-time monitoring value of the PLC control unit is compared with the upper threshold H and the lower threshold L; if the real-time monitoring value is greater than the upper threshold H or less than the lower threshold L, the real-time monitoring value is determined to be an abnormal value and is marked; otherwise, the real-time monitoring value is considered to be a normal value and is not marked; S2013, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit of the water supply network at the next moment; after completing the monitoring of each control unit After the abnormal value detection at the moment, the historical monitoring data cached in the single-point abnormality detector corresponding to each PLC control unit of each water supply network is updated, and a new regression line is generated for the PLC control unit. The monitoring data at each moment is used for outlier detection.

3. According to claim 1, a method for rapid detection and identification of network attacks on a water supply network is characterized in that: The step S202 includes: S2021, based on Chebyshev’s theorem, builds a single-point anomaly detector to detect whether there are anomalies in the time series monitoring data of each PLC control unit in the water supply network: Chebyshev's theorem establishes a lower bound on the percentage of data that lies within k standard deviations. In the case of a normal distribution, 95% of the data falls within two standard deviations of the mean; this means that 5% of the data is expected to lie outside two standard deviations of the mean. Single-point anomaly detectors use Chebyshev's inequality to identify outliers: P(|X-μ|≤kσ)≥(1-1 / k^2); in, represents the data to be detected input into the single-point anomaly detector by each PLC control unit of the water supply network, μ is the average value of the normal historical monitoring data cached in the single-point anomaly detector, σ is the standard deviation of the normal historical monitoring data cached in the single-point anomaly detector, and k represents the standard deviation of the average value; the Chebyshev inequality is used to obtain the optimal parameter k, which is used for the anomaly value detection of each PLC control unit in the water supply network, and the upper threshold H and lower threshold L of the single-point anomaly detector are obtained: ； ； If the monitoring data of the PLC control unit at a certain moment is within the range of the upper threshold H and the lower threshold L, the monitoring data at this moment is a normal value; conversely, if the monitoring data of the PLC control unit is greater than the upper threshold H or less than the lower threshold L, the monitoring data at this moment is an abnormal value; S2022, using the constructed single-point anomaly detector based on Chebyshev's theorem to perform anomaly detection on the time series monitoring data of each PLC control unit in the water supply network, and determining whether each PLC control unit has an abnormal value; For outlier detection of a single PLC control unit, the best approach is to use the historical monitoring data cached in the single-point anomaly detector. value, and calculate the upper threshold value H and the lower threshold value L of the PLC control unit; then, compare the real-time monitoring value of the PLC control unit with the upper threshold value H and the lower threshold value L; if the real-time monitoring value is greater than the upper threshold value H or less than the lower threshold value L, the real-time monitoring value is determined to be an abnormal value and is marked; otherwise, the real-time monitoring value is considered to be a normal value and is not marked; S2023, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit of the water supply network at the next moment: After completing each control unit After the abnormal value detection at the moment, the historical monitoring data cached in the single-point abnormality detector corresponding to each PLC control unit of each water supply network is updated, and the new upper threshold H and lower threshold L are calculated, and the PLC control unit The monitoring data at each moment is used for outlier detection.

4. According to claim 1, a method for rapid detection and identification of network attacks on water supply networks is characterized in that: The step S203 includes: S2031, a single-point anomaly detector is constructed using a density-based spatial clustering method to detect noisy outliers and missing data in the time series monitoring data of each PLC control unit; the density-based spatial clustering method is most suitable for finding anomalies in "irregular" shaped clusters, which may not be captured by linear regression and Chebyshev-based detectors; S2032, using the constructed density spatial clustering single point anomaly detector to perform outlier detection on the time series monitoring data of each PLC control unit in the water supply network, to determine whether each PLC control unit has an outlier: For outlier detection of a single PLC control unit, the monitoring data set corresponding to the PLC control unit is used. Get two parameters, namely Core points are characterized by denoting radius and Min_point denoting the minimum number of points within the distance; these points have at least the minimum number of data points among their neighbors within the distance; two core points are said to be connected if they are located in a dense neighborhood of each other; clusters are identified as connected sequences of core nodes, and outliers are captured as clusters containing a small number of nodes; S2033, updating the historical monitoring data cached in each single-point anomaly detector, and performing anomaly detection on the monitoring values ​​of each PLC control unit in the water supply network at the next moment: After completing each control unit After the abnormal value detection at the moment, the historical monitoring data cached in the single-point abnormality detector corresponding to each PLC control unit of each water supply network is updated, and a new cluster is generated for the PLC control unit. The monitoring data at each moment is used for outlier detection.

5. According to claim 1, a method for rapid detection and identification of network attacks on a water supply network is characterized in that: The step S301 is specifically as follows: S3011, using the monitoring data of each PLC control unit in the water supply network under various network attack events to train three network attack single point anomaly detectors, and calculate the vector of each anomaly value score ,in Network attack single point anomaly detector The monitoring data obtained The abnormal score of S3012, normalize the anomaly scores of the three network attack single-point anomaly detectors to their probabilistic interpretations, for each network attack single-point anomaly detector and outlier score , it will Transform to normalized vector , where each score Normalized to the corresponding score , so that ; When training the water supply network network attack detection and identification framework, each network attack single point anomaly detector Get a series of abnormal value scores on the monitoring data X Different network attack single-point anomaly detectors can calculate outlier scores in different ranges; each outlier score vector Normalized to a series of probability scores , to determine the weight of the outlier score of each network attack single-point anomaly detector, each score Represents the estimated probability , that is, given an outlier , No. Monitoring data The probability of being in the outlier class O instead of the normal class N; when normalizing the anomaly score, the Bernoulli distribution function is maximized; Consider the outlier score vector and water supply network monitoring data , according to Bayes' theorem, the Bernoulli distribution function is expressed as: ； ； In the formula, is the discriminant function, which Classify as outliers or normal points under Gaussian distribution with equal covariance matrix; Simplified to a linear function , then the Bernoulli distribution function is expressed as: ； The expectation maximization algorithm is used to learn parameters A and B. After determining parameters A and B, the calculation is And determine the single point anomaly detector of each network attack The normalized score of S3013, train the water supply network network attack detection and identification framework through unsupervised learning to determine the weights of the anomaly value scores of each network attack single point anomaly detector: After obtaining the normalized scores of each network attack single-point anomaly detector, the anomaly detection results of the three network attack single-point anomaly detectors are combined to detect and identify various network attack events in the water supply network, and determine the location, start time and duration of each network attack event. The present invention uses the maximum likelihood estimation algorithm to integrate each network attack single-point anomaly detector; the maximum likelihood estimation is approximated by the expected maximum algorithm to determine the weight of each network attack single-point anomaly detector, and two basic assumptions are considered: All anomaly detectors can perform independent anomaly detection. In the absence of a basic detector as a reference, the majority voting results of each anomaly detector are used as a reference for model training. For each standardized outlier score , by setting a The threshold between , gets a binary label ; The present invention sets the threshold to 0.95: if ,but =1, indicating Outliers reported; otherwise, normal data points are indicated; The maximum likelihood estimation algorithm converts the monitoring data X of each PLC control unit in the water supply network of the three network attack single point anomaly detectors and their corresponding binary labels The outlier vector of (i∈[1,m]) is used as input, and the single-point anomaly detection results of each PLC control unit are integrated; in each observed water supply network monitoring data The likelihood of label y for x determined by all network attack single-point anomaly detectors making independent predictions is written as: ； Assuming that each network attack single-point anomaly detector makes an independent decision, the possibility is expressed as The product of the probabilities is as follows: ； It can be further approximated as The weighted sum of binary values ​​of , whose weights are determined by the sensitivity and specificity of the three network attack single-point anomaly detectors: ； in is a symbolic function that returns the sign of a numeric vector element, and is a class label indicating whether it is an outlier or not; the parameter and is the weight of model training, which is determined by the anomaly detector Determination of accuracy: ； ； Where sensitivity ψ is the fraction of outliers correctly identified; specificity is the fraction of correctly identified non-outliers.

6. According to claim 1, a method for rapid detection and identification of network attacks on water supply networks is characterized in that: The step S302 is specifically as follows: S3021, collect the real-time monitoring data of each PLC control unit of the water supply network, prepare the normal historical monitoring data of each PLC control unit at the corresponding time, input the real-time and historical monitoring data of each PLC control unit into three network attack single-point anomaly detectors, confirm whether the real-time monitoring data of each PLC control unit is an abnormal value, and obtain the abnormal score of the monitoring data of each PLC control unit; S3022, integrating the abnormal detection results of the three network attack single-point abnormal detectors to confirm whether the monitoring data of each PLC control unit is an abnormal value; if the monitoring data of a certain PLC control unit at a certain moment is an abnormal value, it is marked, and the abnormal detection results of the three network attack single-point abnormal detectors are continuously integrated. When the number of marked abnormal values ​​reaches a certain value, a network attack alarm is issued; S3023, if a network attack event occurs, determine the start time, duration and location of the network attack based on the integrated results of anomaly detection at multiple times by the three network attack single-point anomaly detectors; if no network attack event occurs, repeat step S3022.

7. According to claim 1, a method for rapid detection and identification of network attacks on a water supply network is characterized in that: The step S4 comprises: S401, at timestamp l, the sliding window buffers N data points of each PLC control unit of the water supply network into a single data point, and calls the proposed learning algorithm to train each network attack single point anomaly detector of the water supply network network attack detection and identification framework, and determines the threshold and weight of each network attack single point anomaly detector; S402, at timestamp t, input the real-time monitoring data of each PLC control unit of the water supply network at time t and the historical monitoring data of the past N days into the water supply network network attack detection and identification framework to determine whether the real-time monitoring data of each PLC control unit of the water supply network at time t is an abnormal value; S403, after acquiring new monitoring data of each PLC control unit of the water supply network, observe the aggregate changes of various parameters of each network attack single-point anomaly detector including α and β; remember the original values ​​of various parameters, and use the majority voting method to obtain the benchmark value to obtain the new value of each parameter; if the new values ​​of various parameters are slightly different from the old values, there is no need to retrain the various parameters of each network attack single-point anomaly detector; conversely, if the new values ​​of various parameters of a certain network attack single-point anomaly detector are significantly different from the old values, then the various parameters of the network attack single-point anomaly detector are retrained.

8. According to claim 5, a method for rapid detection and identification of network attacks on a water supply network is characterized in that: In step S3013, when training the water supply network network attack detection and identification framework, it includes: Use majority voting to make a "preliminary guess" about the ground truth and get preliminary results for network attack detection; Estimate ψ and η for each base detector using the ground truth, and initialize α and β; Apply the expected maximum algorithm to iteratively update and , improve the likelihood estimate until convergence; Return to the training results of the water supply network network attack detection and identification framework .

Images