An abnormality detection and positioning method, device and storage medium of industrial control system

Abstract

The present invention discloses an abnormality detection and positioning method, device and storage medium for an industrial control system, and belongs to the field of information security technology of industrial control systems. The abnormality detection and positioning method includes: constructing a digital twin system of the industrial control system; extracting information of various entity nodes and constructing a twin process knowledge graph; extracting a subgraph of the twin process knowledge graph according to the demand target of abnormality detection, adding nodes of the target process to the subgraph, and reconstructing a twin data set; using the twin data set to train an abnormality detection model fused with GNN and LSTM; obtaining real-time process data of the industrial control system, inputting the target abnormality detection model, and if an abnormality is detected, semantic analysis and logical reasoning are performed on the relevant nodes according to the twin process knowledge graph, and abnormality tracing is performed on the abnormal nodes to determine the location of the abnormal source. Solve the problem of missing data features in complex environments, improve the accuracy of abnormality detection, and quickly locate the location of the abnormality to ensure the stable operation of the system.

Description

Technical Field

[0001] The present invention belongs to the field of information security of industrial control systems, and more specifically, relates to an abnormality detection and positioning method, device and storage medium for an industrial control system. Background Art

[0002] Industrial control systems are widely used in key areas such as petroleum, electricity, and energy. With the integration of emerging technologies such as cloud computing, big data, the Internet, and the Internet of Things, industrial control systems are transforming towards digitalization and intelligence. While improving the efficiency of industrial control systems, it also increases the possibility of the system being attacked by cyber attacks. Industrial control systems connect the cyber world and the physical world. Once attacked by cyber attacks, not only will important information be leaked and damaged, but physical equipment may also be damaged, people's lives and health may be damaged, and the environment may be destroyed. Therefore, using emerging technologies to ensure the security of industrial control systems has become a research focus.

[0003] With the rapid development of modeling technology, simulation technology, big data and supercomputing technology, the development of digital twins is becoming increasingly mature. Digital twins have ultra-real-time physical mapping, high-precision behavior simulation, and can build digital twin systems for industrial control systems. They can perform real-time mapping and process simulation of on-site system process behaviors, and realize real-time intrusion detection of industrial control systems based on knowledge compensation of mechanism models in the digital twin space. This can improve the accuracy of anomaly detection and locate abnormal locations, so that the system can eliminate the impact of attacks in a timely manner.

[0004] Anomaly detection collects and analyzes system behavior, security logs, network traffic, and several key information of the control system to check whether the system has any behavior that violates security policies and signs of being attacked. Early detection technology for on-site system attack behavior is the first barrier to information security protection. However, the equipment environment of the industrial control system is complex and harsh, and some state quantities cannot be measured. During the data collection and transmission process, some state quantities will be lost, and the collected data will lack some important features. Using these data to train the anomaly detection model, the detection accuracy cannot meet the requirements. Due to the complex scenarios of industrial control systems, it is also difficult to find the source of system anomalies.

[0005] Currently, in the case of missing data features, most methods use the middle value or average value to fill in the missing data features, or directly delete the missing feature data. These methods cannot completely restore the data, which affects the integrity and authenticity of the data, and thus affects the accuracy of system anomaly detection. Summary of the invention

[0006] In view of the defects of the related art, the purpose of the present invention is to provide an abnormality detection and positioning method, device and storage medium for an industrial control system, aiming to solve the problem of data loss in the data acquisition and transmission process of the industrial control system, and the difficulty of existing technology in supplementing and restoring data, which leads to low accuracy of system abnormality detection.

[0007] To achieve the above objectives, in a first aspect, the present invention provides an abnormality detection and positioning method for an industrial control system, comprising:

[0008] S1. Build a digital twin system for industrial control systems;

[0009] S2. Extracting various entity node information from the digital twin system, constructing a twin process knowledge graph, and associating the entity nodes of the twin process knowledge graph with corresponding historical process data;

[0010] S3. According to the demand target of anomaly detection, determine the target and scope of the subgraph of the twin process knowledge graph that needs to be extracted, associate the nodes of the subgraph with the corresponding process data, and obtain the twin process knowledge graph subgraph;

[0011] S4. Add nodes of the target process to the constructed twin process knowledge graph subgraph, use the mechanism model in the digital twin system to solve and obtain the process state data corresponding to the added nodes, fuse the process data of the expanded nodes with the process data of the original nodes, and reconstruct them into a twin data sample set with expanded dimensional space features;

[0012] S5. Perform feature processing on the twin data sample set, and associate the processed feature data with each node in the twin process knowledge graph subgraph; use GNN to capture the structural relationship between the nodes of the twin process knowledge graph subgraph, and output the node embedding relationship; use the node embedding relationship and the processed feature data to train the LSTM model for anomaly detection, and determine the detection threshold δ of anomaly detection according to the error between the predicted score output by LSTM and the true value, and obtain the target anomaly detection model;

[0013] S6. Obtain the real-time process data of the industrial control system and input it into the target anomaly detection model. If an anomaly is detected, perform semantic analysis on the detected abnormal node and its adjacent nodes to obtain the logical path of anomaly propagation. Infer the anomaly propagation path based on the structure of the twin process knowledge graph to obtain the potential path of anomaly propagation, and trace the anomaly based on the logical path and potential path.

[0014] Optionally, S1 specifically includes:

[0015] S11, obtaining basic information of the industrial control system, wherein the basic information includes equipment, topological connection, control logic, process operation and historical process data of a specific process controlled by the industrial control system;

[0016] S12. Constructing a twin model based on the basic information of the industrial control system, where the twin model includes a 3D model and a mechanism model;

[0017] S13. Perform data management on the industrial control system and the twin model to build a digital twin system.

[0018] Optionally, S2 specifically includes:

[0019] S21. Analyze the needs of the twin process knowledge graph, determine the goals of the twin process knowledge graph, extract various entity node information of the digital twin system according to the goals, and construct the twin process knowledge graph in a top-down manner;

[0020] S22. Determine the entity nodes and entity relationships of the twin process knowledge graph according to the specific process scenario of the digital twin system, and use a graph structure to represent the relationship between the entity nodes; wherein the entity nodes include physical entities in the industrial control system, and the edges represent the relationship between the entity nodes;

[0021] S23. Obtain the historical process status data of the detected physical entity from the industrial control system, and associate the entity nodes in the twin process knowledge graph with their corresponding process data.

[0022] Optionally, S4 specifically includes:

[0023] S41. Based on the target requirements of anomaly detection and the process mechanism of the digital twin object, the nodes of the target process are expanded on the constructed twin process knowledge graph subgraph;

[0024] S42, solving the process state data corresponding to the expanded node on the mechanism model in the digital twin system to obtain the expanded node process data;

[0025] S43, storing the calculated augmented node process data in a database, and associating it with the augmented node;

[0026] S44: Fuse the expanded node process data with the original node process data to reconstruct a twin data sample set with expanded dimensional space features.

[0027] Optionally, S5 specifically includes:

[0028] S51. Perform data cleaning and normalization preprocessing on the reconstructed twin data sample set.

[0029] S52, associating the preprocessed feature data with each node in the twin process knowledge graph subgraph, and using GNN to capture the relationship and dependency between the twin process knowledge graph subgraphs, and outputting the node embedding relationship;

[0030] S54. Use the node embedding relationship output by GNN and the corresponding time series data to train the LSTM model for anomaly detection, select a suitable optimizer and loss function to iteratively optimize the model parameter structure until the model meets the detection requirements, and determine the detection threshold δ of anomaly detection based on the error between the predicted score output by LSTM and the true value; when the predicted score of the LSTM model exceeds the threshold δ, it is determined that the system is abnormal.

[0031] Optionally, S6 specifically includes:

[0032] S61, obtaining real-time process data of the industrial control system and inputting the target anomaly detection model. If the industrial control system detects an anomaly, the detected abnormal node features are analyzed to determine the abnormal node type, and the adjacent nodes of the abnormal node and the attribute information of the edges between the nodes are analyzed to determine whether the adjacent nodes have anomalies and potential abnormal propagation paths;

[0033] S62. Combine the process flow and equipment relationship, perform semantic analysis on the abnormal node and its adjacent nodes, and determine the logical path of abnormal propagation;

[0034] S63. Use a graph search algorithm based on the structure of the twin process knowledge graph to obtain the potential path for exception propagation. Combined with the logical path obtained by semantic analysis, determine the accurate exception propagation path, as well as the location of the exception source and the entity node to which it belongs.

[0035] Optionally, after S6, it also includes:

[0036] The location of the abnormal source point is displayed on the 3D model of the digital twin system.

[0037] In a second aspect, the present invention further provides an abnormality detection and positioning device for an industrial control system, which is used to execute the method as described in any one of the first aspects, including:

[0038] Digital twin system building module, used to build the digital twin system of the industrial control system;

[0039] A process knowledge graph construction module is used to extract various entity node information of the digital twin system, construct a twin process knowledge graph, and associate the entity nodes of the twin process knowledge graph with the corresponding historical process data;

[0040] A subgraph extraction module is used to determine the target and scope of the subgraph of the twin process knowledge graph to be extracted according to the demand target of anomaly detection, and associate the nodes of the subgraph with the corresponding process data to obtain the subgraph of the twin process knowledge graph;

[0041] The twin data reconstruction module is used to add nodes of the target process to the constructed twin process knowledge graph subgraph, use the mechanism model in the digital twin system to solve the process status data corresponding to the added nodes, fuse the process data of the expanded nodes with the process data of the original nodes, and reconstruct them into a twin data sample set with expanded dimensional space features;

[0042] The anomaly detection model training module is used to perform feature processing on the twin data reconstructed from the twin data sample set, and associate the processed feature data with each node in the twin process knowledge graph subgraph; use GNN to capture the structural relationship between the nodes of the twin process knowledge graph subgraph, and output the node embedding relationship; use the node embedding relationship and the processed feature data to train the LSTM model for anomaly detection, and determine the detection threshold δ of anomaly detection based on the error between the predicted score output by LSTM and the true value, to obtain the target anomaly detection model;

[0043] The anomaly detection and positioning module is used to obtain real-time process data of the industrial control system and input the target anomaly detection model. If an anomaly is detected, semantic analysis is performed on the detected abnormal node and its adjacent nodes to obtain the logical path of anomaly propagation. The anomaly propagation path is inferred based on the structure of the twin process knowledge graph to obtain the potential path of anomaly propagation, and the anomaly is traced based on the logical path and potential path.

[0044] In a third aspect, a computer-readable storage medium stores computer instructions, wherein the computer instructions are used to enable a processor to implement the method for detecting and locating anomalies of an industrial control system as described in any one of the first aspects when executed.

[0045] Compared with the prior art, the above technical solution conceived by the present invention can achieve the following beneficial effects:

[0046] 1. The present invention provides an abnormality detection and positioning method for an industrial control system, constructs a digital twin system and a digital twin process knowledge graph, adds corresponding graph nodes to missing features, reproduces the process scene through the process mechanism model of the digital twin system, solves the missing feature nodes, and can perform data compensation and reconstruction on the collected incomplete data. Based on the reconstructed twin data, a hybrid anomaly detection model is trained, GNN is used to process the structural relationship between graph nodes, the complex relationship and dependency between graph structures are captured, and LSTM is used to obtain the spatiotemporal dependency and dynamic changes of time series data. The trained anomaly detection model can make full use of the structural information of the knowledge graph and the dynamic characteristics of the time series data to achieve efficient anomaly detection of the industrial control system and reduce the false alarm rate. At the same time, the detected abnormal nodes are analyzed, and the abnormality is traced based on the twin process knowledge graph reasoning, so that the abnormal nodes can be quickly and accurately located, thereby quickly eliminating the adverse effects caused by the abnormality and ensuring the stable operation of the system.

[0047] 2. The present invention provides an anomaly detection and location method for an industrial control system, which expands on the data features contained in the original data, increases the spatial dimension of the data, can improve the sensitivity of the data to anomalies, and improves the detection accuracy in the scene of minor anomalies and unknown anomalies. In the case where some features of the data set are missing, the twin model can be used to solve the missing data features and restore the incomplete data set.

[0048] 3. The present invention provides an abnormality detection and positioning method for an industrial control system, which displays the detected abnormal nodes in a digital twin three-dimensional scene, helping on-site personnel to discover abnormalities in a timely manner, eliminate the negative impacts caused by abnormalities, and ensure the safe and stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The present invention provides a flowchart of an abnormality detection and positioning method for an industrial control system.

[0050] Figure 2 It is a schematic diagram of the twin process knowledge graph construction method.

[0051] Figure 3 This is a schematic diagram of the anomaly detection method of GNN-LSTM fusion.

[0052] Figure 4 It is a schematic diagram of abnormality location and display method.

[0053] Figure 5 It is a schematic diagram of the abnormality detection and positioning method of the fractionation unit.

[0054] Figure 6 It is a schematic diagram of the process knowledge graph nodes of the distillation unit.

[0055] Figure 7 is a schematic diagram of the anomaly propagation of the fractionation unit. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0057] The contents involved in the above embodiment are described below in conjunction with a preferred embodiment.

[0058] Embodiment 1

[0059] The present invention provides an abnormality detection and positioning method for an industrial control system, comprising:

[0060] S1. Build a digital twin system for industrial control systems;

[0061] S2. Extracting various entity node information from the digital twin system, constructing a twin process knowledge graph, and associating the entity nodes of the twin process knowledge graph with corresponding historical process data;

[0062] S3. According to the demand target of anomaly detection, determine the target and scope of the subgraph of the twin process knowledge graph that needs to be extracted, associate the nodes of the subgraph with the corresponding process data, and obtain the twin process knowledge graph subgraph;

[0063] S4. Add nodes of the target process to the constructed twin process knowledge graph subgraph, use the mechanism model in the digital twin system to solve and obtain the process state data corresponding to the added nodes, fuse the process data of the expanded nodes with the process data of the original nodes, and reconstruct them into a twin data sample set with expanded dimensional space features;

[0064] S5. Perform feature processing on the twin data sample set, and associate the processed feature data with each node in the twin process knowledge graph subgraph; use GNN to capture the structural relationship between the nodes of the twin process knowledge graph subgraph, and output the node embedding relationship; use the node embedding relationship and the processed feature data to train the LSTM model for anomaly detection, and determine the detection threshold δ of anomaly detection according to the error between the predicted score output by LSTM and the true value, and obtain the target anomaly detection model;

[0065] S6. Obtain the real-time process data of the industrial control system and input it into the target anomaly detection model. If an anomaly is detected, perform semantic analysis on the detected abnormal node and its adjacent nodes to obtain the logical path of anomaly propagation. Infer the anomaly propagation path based on the structure of the twin process knowledge graph to obtain the potential path of anomaly propagation, and trace the anomaly based on the logical path and potential path.

[0066] Digital twins are high-fidelity dynamic virtual models that digitally construct multi-dimensional spatiotemporal scales of physical entities and contain internal mechanisms. They can reproduce the behavior scenarios of physical entities in real environments and provide optimized decisions to guide the safe operation of physical entities throughout their life cycle. By building a knowledge graph based on the digital twin system, simulating process scenarios through the twin process mechanism model, compensating for missing data features, and performing anomaly detection and location using graphs, the accuracy of anomaly detection can be improved and the location of anomalies can be located.

[0067] Due to the harsh industrial field environment and sensor cost issues, some measurement quantities are difficult to detect directly, and the data collected by the industrial control system may lack some important features. For the anomaly detection method with missing data sample features, the embodiment of the present invention provides a new idea and solution, which constructs a knowledge graph of the digital twin, adds corresponding graph nodes to the missing features, solves the missing feature nodes through the process mechanism model of the digital twin system, and uses the reconstructed twin data set to train the GNN-LSTM anomaly detection model, wherein the GNN can obtain the node dependency relationship between the graph nodes, and the LSTM obtains the spatiotemporal dependency and dynamic changes of the time series data. This method can greatly improve the anomaly detection accuracy of the system, analyze the abnormal nodes, trace the abnormal positions with the knowledge graph, and display the abnormal node positions in the digital twin three-dimensional scene to quickly locate the anomalies, thereby quickly eliminating the adverse effects caused by the anomalies and ensuring the stable operation of the system.

[0068] In view of the fact that data features of industrial control systems are missing and it is difficult to find abnormal locations, the original data is fused and reconstructed, anomaly detection is performed based on the twin fusion reconstructed data set, abnormal nodes are located based on knowledge graph reasoning, and the locations of abnormal nodes are displayed in the three-dimensional scene of the digital twin system.

[0069] Optionally, S1 specifically includes:

[0070] S11, obtaining basic information of the industrial control system, wherein the basic information includes equipment, topological connection, control logic, process operation and historical process data of a specific process controlled by the industrial control system;

[0071] S12. Constructing a twin model based on the basic information of the industrial control system, where the twin model includes a 3D model and a mechanism model;

[0072] S13. Perform data management on the industrial control system and the twin model to build a digital twin system.

[0073] The construction of a high-precision digital twin system for the industrial control system includes the acquisition of the physical entity information of the industrial control system, the construction of the twin model and the data management of the twin system, which can simulate and reproduce the specific process behavior controlled by the industrial control system with high precision. The basic information of the physical entity of the industrial control system is obtained, including the specific process controlled, key equipment, topological connection, control logic, process operation and historical process data; the twin model includes a 3D model and a process mechanism model. The 3D model of the equipment is modeled using 3D max software, and the process mechanism model is modeled using Ansys and Aspen Plus; the data management of the twin system includes data acquisition, data processing, data fusion, and data storage.

[0074] Optionally, S2 specifically includes:

[0075] S21. Analyze the needs of the twin process knowledge graph, determine the goals of the twin process knowledge graph, extract various entity node information of the digital twin system according to the goals, and construct the twin process knowledge graph in a top-down manner;

[0076] S22. Determine the entity nodes and entity relationships of the twin process knowledge graph according to the specific process scenario of the digital twin system, and use a graph structure to represent the relationship between the entity nodes; wherein the entity nodes include physical entities in the industrial control system, and the edges represent the relationship between the entity nodes;

[0077] S23. Obtain the historical process status data of the detected physical entity from the industrial control system, and associate the entity nodes in the twin process knowledge graph with their corresponding process data.

[0078] refer to Figure 2 , the construction process of the twin process knowledge graph of the digital twin system. Analyze the needs of the twin process knowledge graph, determine the goals and uses of the twin process knowledge graph, and clarify the specific process objects involved in the industrial control system and the various data types generated in industrial production. Simplify the complex production process of the industrial control system, extract information knowledge from the twin system process, determine the entity nodes of the twin process knowledge graph, and determine the entity relationships of the twin process knowledge graph. Use a graph structure to represent the relationship between entity nodes, associate industrial process data with graph entity nodes, select a graph database to store the knowledge graph, and provide a node attribute query interface to extract the required subgraphs.

[0079] According to the demand objectives of anomaly detection, determine the target and scope of the subgraph to be extracted from the twin process knowledge graph, that is, determine the type of nodes and the attributes of edges. For example, select nodes including sensors, control instructions and state variables; select edge attributes including connection, measurement, etc.; extract process state data from the twin process knowledge graph to obtain the twin process knowledge graph subgraph.

[0080] Optionally, S4 specifically includes:

[0081] S41. Based on the target requirements of anomaly detection and the process mechanism of the digital twin object, the nodes of the target process are expanded on the constructed twin process knowledge graph subgraph;

[0082] S42, solving the process state data corresponding to the expanded node on the mechanism model in the digital twin system to obtain the expanded node process data;

[0083] S43, storing the calculated augmented node process data in a database, and associating it with the augmented node;

[0084] S44: Fuse the expanded node process data with the original node process data to reconstruct a twin data sample set with expanded dimensional space features.

[0085] The steps of twin data reconstruction include: adding target nodes, solving the added node data, data storage and twin data fusion reconstruction. The process state data corresponding to the expanded nodes are solved on the twin mechanism model. The solution process is as follows: determine the process data attribute type corresponding to the added node, such as flow, pressure, temperature, etc., add virtual sensors and controllers to the corresponding positions of the twin process mechanism model, and run the process mechanism model to calculate the process data of the added node; store the calculated data in the database and associate it with the added node; fuse the node data solved by the twin model with the process data of the industrial control system to form a twin data sample set with expanded dimensional space characteristics.

[0086] Expanding on the data features contained in the original data and increasing the spatial dimension of the data can improve the sensitivity of the data to anomalies and improve the detection accuracy in scenarios with minor anomalies and unknown anomalies. In the case where some features of the data set are missing, the twin model can be used to solve the missing data features and restore the incomplete data set.

[0087] Optionally, S5 specifically includes:

[0088] S51. Perform data cleaning and normalization preprocessing on the reconstructed twin data sample set.

[0089] S52, associating the preprocessed feature data with each node in the twin process knowledge graph subgraph, and using GNN to capture the relationship and dependency between the twin process knowledge graph subgraphs, and outputting the node embedding relationship;

[0090] S54. Use the node embedding relationship output by GNN and the corresponding time series data to train the LSTM model for anomaly detection, select a suitable optimizer and loss function to iteratively optimize the model parameter structure until the model meets the detection requirements, and determine the detection threshold δ of anomaly detection based on the error between the predicted score output by LSTM and the true value; when the predicted score of the LSTM model exceeds the threshold δ, it is determined that the system is abnormal.

[0091] like Figure 3 As shown in the figure, building a GNN-LSTM fusion anomaly detection model includes: data processing of the twin data sample set, using GNN to extract the graph structure to obtain the node embedding relationship, and selecting LSTM to build an anomaly detection model.

[0092] When using GNN to capture the structural relationship between knowledge graph nodes, the information of neighboring nodes is aggregated through graph convolution operations, and the node status is updated using activation functions to capture the complex relationship and dependency between graph structures and output node embedding relationships. Using the node embedding relationship output by GNN and the corresponding time series data to train the LSTM model can capture the time dependency and dynamic changes of the data.

[0093] The detection threshold δ of anomaly detection is determined according to the error between the predicted score and the true value output during LSTM training. Specifically, the error between the predicted score and the true value is calculated, and then the mean and standard deviation of the error are calculated. Finally, the mean error plus twice the standard deviation is set as the detection threshold.

[0094] When using the anomaly detection model for detection, it is determined whether the prediction score of the LSTM model exceeds the threshold δ. If so, it is determined that an abnormality has occurred in the system.

[0095] Optionally, S6 specifically includes:

[0096] S61, obtaining real-time process data of the industrial control system and inputting the target anomaly detection model. If the industrial control system detects an anomaly, the detected abnormal node features are analyzed to determine the abnormal node type, and the adjacent nodes of the abnormal node and the attribute information of the edges between the nodes are analyzed to determine whether the adjacent nodes have anomalies and potential abnormal propagation paths;

[0097] S62. Combine the process flow and equipment relationship, perform semantic analysis on the abnormal node and its adjacent nodes, and determine the logical path of abnormal propagation;

[0098] S63. Use a graph search algorithm based on the structure of the twin process knowledge graph to obtain the potential path for exception propagation. Combined with the logical path obtained by semantic analysis, determine the accurate exception propagation path, as well as the location of the exception source and the entity node to which it belongs.

[0099] Optionally, after S6, it also includes:

[0100] The location of the abnormal source point is displayed on the 3D model of the digital twin.

[0101] like Figure 4 As shown, the features of the detected abnormal nodes are judged, and the types of abnormal nodes, such as sensors, actuators, controllers, etc., are determined to obtain the root location of the abnormal nodes, and the locations are displayed in a three-dimensional scene so that maintenance personnel can quickly locate and repair them, thereby quickly eliminating the adverse effects caused by the abnormalities and ensuring the stable operation of the system.

[0102] like Figure 5As shown in the figure, the anomaly detection and positioning method of the fractionation unit is described by taking the catalytic cracking fractionation unit system as an example. It includes the extraction of fractionation unit entity information, the construction of the fractionation unit digital twin system, the fractionation unit twin knowledge graph, the extraction of the fractionation unit digital twin process knowledge graph, the expansion of the fractionation process nodes, the formation of the fusion reconstruction data set, the training of the GNN-LSTM anomaly detection model, and the location of the section where the abnormal node occurs if an anomaly is detected. To build the fractionation unit digital twin system, it is necessary to clarify the fractionation process mechanism, the key equipment of the fractionation unit, the fractionation section process and various process data. The fractionation process mechanism is the process of separating various mixtures by utilizing the different boiling points of the mixture. The key equipment includes the crude oil tank, the distillation tower, the stripping tower, and the oil-gas separator. The fractionation section process includes the bottom oil slurry circulation, the first middle circulation, the second middle section, the refining oil circulation and the top circulation. The process data of the fractionation system includes production process data, server log data, business data, etc. Simplify the complex production process of the distillation unit industrial control system, and extract information knowledge from the twin system process; construct the twin knowledge graph in a top-down manner; determine the entity nodes of the knowledge graph, where the entity nodes include: specific production process (process section), production equipment (distillation tower, pump, oil-gas separator), controller, process status data (temperature, pressure, flow), sensor, valve, etc.; simplify the complex production process of the industrial control system, extract information knowledge from the twin system process, determine the entity nodes of the process knowledge graph, determine the entity relationship of the process knowledge graph, associate the industrial process data with the entity nodes, provide a query interface, and be able to search and filter by node and edge attributes to find nodes and associations with specific attributes.

[0103] like Figure 6 As shown in the figure, the digital twin system of the fractionation unit extracts various node information knowledge (equipment, materials, sensors, control, etc.) to construct the knowledge spectrum of the fractionation unit twin (taking some simplified processes as an example). The fractionation unit mainly includes the key equipment nodes of the fractionation tower, stripping tower, and oil-gas separator. The fractionation tower equipment includes the bottom oil slurry circulation, the first circulation and other sections. There are corresponding temperature, flow, and liquid level controllers and sensors in these sections to control the target process status and collect data.

[0104] Based on the target requirements of anomaly detection and the process mechanism of the digital twin object, the nodes of the target process are expanded on the extracted process knowledge graph subgraph. The nodes are the corresponding sensors and controllers. The process data attribute types (flow, pressure, temperature, etc.) corresponding to the added nodes are determined, and virtual sensors and controllers are added to the corresponding positions of the digital twin process mechanism model of the distillation unit. After confirming that the addition is correct, the digital twin process mechanism model is run to calculate the process data of the expanded nodes; the calculated data is stored in the database and associated with the added nodes; the expanded node data solved by the twin model is fused with the process data of the distillation unit to reconstruct a twin data sample set containing more spatial features.

[0105] The anomaly detection model is trained using the reconstructed fractionation unit twin data training set, and the corresponding anomaly detection model is trained. If an anomaly is detected, the location where the system anomaly occurs is determined. The characteristics of the abnormal node and its adjacent nodes, as well as the attribute information of the edges between the nodes are analyzed; the semantic relationship between the abnormal node and the adjacent nodes is analyzed in combination with the process flow mechanism and the equipment topological connection relationship, and the logical path of the anomaly propagation is determined; the anomaly propagation path is inferred in combination with the knowledge graph topological structure and the safety knowledge between the nodes, and the location of the abnormal node and the process section or equipment location of the fractionation system to which it belongs are determined; the location of the abnormal node is displayed on the 3D model of the fractionation unit digital twin system, which can help on-site personnel detect anomalies early and make rapid emergency responses to ensure the safe and stable operation of the system.

[0106] like Figure 7 As shown, the features of the detected abnormal node TC01 and its adjacent nodes T01, T02, LC01, L01, L02, and PLC1 are analyzed. The semantic relationship between the abnormal node and the adjacent nodes is analyzed in combination with the process flow mechanism and the equipment topological connection relationship, and the logical path of abnormal propagation is determined; the red represents the detected abnormal node, and the abnormal propagation path is inferred by combining the knowledge graph topological structure and the safety knowledge between the nodes. The abnormal propagation is propagated from PLC1 to the temperature control loop TC01, and finally causes abnormalities in T01 and T02. It can be judged that the location of the occurrence is PLC01, and the equipment to which the abnormal location belongs is the distillation tower. The location where the abnormal node occurs is displayed on the 3D model of the digital twin system of the distillation unit.

[0107] The embodiment of the present invention constructs a digital twin system and a digital twin process knowledge graph, adds corresponding graph nodes to the missing features, reproduces the process scene through the process mechanism model of the digital twin system, solves the missing feature nodes, and can reconstruct the collected incomplete data through data compensation. Based on the reconstructed twin data, the hybrid anomaly detection model is trained, GNN is used to process the structural relationship between graph nodes, the complex relationship and dependency between graph structures are captured, and LSTM is used to obtain the spatiotemporal dependency and dynamic changes of time series data. The trained anomaly detection model can make full use of the structural information of the knowledge graph and the dynamic characteristics of the time series data to achieve efficient anomaly detection of the industrial control system and reduce the false alarm rate. At the same time, the detected abnormal nodes are analyzed, and the abnormality is traced based on the twin process knowledge graph reasoning, which can quickly and accurately locate the abnormal nodes, thereby quickly eliminating the adverse effects caused by the abnormality and ensuring the stable operation of the system.

[0108] Embodiment 2

[0109] The present invention further provides an abnormality detection and positioning device for an industrial control system, which is used to execute the method as described in the first embodiment, including:

[0110] Digital twin system building module, used to build the digital twin system of the industrial control system;

[0111] A process knowledge graph construction module is used to extract various entity node information of the digital twin system, construct a twin process knowledge graph, and associate the entity nodes of the twin process knowledge graph with the corresponding historical process data;

[0112] A subgraph extraction module is used to determine the target and scope of the subgraph of the twin process knowledge graph to be extracted according to the demand target of anomaly detection, and associate the nodes of the subgraph with the corresponding process data to obtain the subgraph of the twin process knowledge graph;

[0113] The twin data reconstruction module is used to add nodes of the target process to the constructed twin process knowledge graph subgraph, use the mechanism model in the digital twin system to solve the process status data corresponding to the added nodes, fuse the process data of the expanded nodes with the process data of the original nodes, and reconstruct them into a twin data sample set with expanded dimensional space features;

[0114] The anomaly detection model training module is used to perform feature processing on the twin data reconstructed from the twin data sample set, and associate the processed feature data with each node in the twin process knowledge graph subgraph; use GNN to capture the structural relationship between the nodes of the twin process knowledge graph subgraph, and output the node embedding relationship; use the node embedding relationship and the processed feature data to train the LSTM model for anomaly detection, and determine the detection threshold δ of anomaly detection based on the error between the predicted score output by LSTM and the true value, to obtain the target anomaly detection model;

[0115] The anomaly detection and positioning module is used to obtain real-time process data of the industrial control system and input the target anomaly detection model. If an anomaly is detected, semantic analysis is performed on the detected abnormal node and its adjacent nodes to obtain the logical path of anomaly propagation. The anomaly propagation path is inferred based on the structure of the twin process knowledge graph to obtain the potential path of anomaly propagation, and the anomaly is traced based on the logical path and potential path.

[0116] An abnormality detection and positioning device for an industrial control system provided by an embodiment of the present invention can execute an abnormality detection and positioning method for an industrial control system provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0117] Embodiment 3

[0118] A computer-readable storage medium stores computer instructions, wherein the computer instructions are used to enable a processor to implement the abnormality detection and positioning method of the industrial control system as described in any one of the first aspects when executed.

[0119] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting and locating abnormalities in an industrial control system, characterized in that: include: S1. Build a digital twin system for industrial control systems; S2. Extracting various entity node information from the digital twin system, constructing a twin process knowledge graph, and associating the entity nodes of the twin process knowledge graph with corresponding historical process data; S3. According to the demand target of anomaly detection, determine the target and scope of the subgraph of the twin process knowledge graph that needs to be extracted, associate the nodes of the subgraph with the corresponding process data, and obtain the twin process knowledge graph subgraph; S4. Add nodes of the target process to the constructed twin process knowledge graph subgraph, use the mechanism model in the digital twin system to solve and obtain the process state data corresponding to the added nodes, fuse the process data of the expanded nodes with the process data of the original nodes, and reconstruct them into a twin data sample set with expanded dimensional space features; S5. Perform feature processing on the twin data sample set, and associate the processed feature data with each node in the twin process knowledge graph subgraph; use GNN to capture the structural relationship between the nodes of the twin process knowledge graph subgraph, and output the node embedding relationship; use the node embedding relationship and the processed feature data to train the LSTM model for anomaly detection, and determine the detection threshold δ of anomaly detection according to the error between the predicted score output by LSTM and the true value, and obtain the target anomaly detection model; S6. Obtain the real-time process data of the industrial control system and input it into the target anomaly detection model. If an anomaly is detected, perform semantic analysis on the detected abnormal node and its adjacent nodes to obtain the logical path of anomaly propagation. Infer the anomaly propagation path based on the structure of the twin process knowledge graph to obtain the potential path of anomaly propagation, and trace the anomaly based on the logical path and potential path.

2. The method according to claim 1, characterized in that S1 specifically includes: S11, obtaining basic information of the industrial control system, wherein the basic information includes equipment, topological connection, control logic, process operation and historical process data of a specific process controlled by the industrial control system; S12. Constructing a twin model based on the basic information of the industrial control system, where the twin model includes a 3D model and a mechanism model; S13. Perform data management on the industrial control system and the twin model to build a digital twin system.

3. The method according to claim 1, characterized in that S2 specifically includes: S21. Analyze the needs of the twin process knowledge graph, determine the goals of the twin process knowledge graph, extract various entity node information of the digital twin system according to the goals, and construct the twin process knowledge graph in a top-down manner; S22. Determine the entity nodes and entity relationships of the twin process knowledge graph according to the specific process scenario of the digital twin system, and use a graph structure to represent the relationship between the entity nodes; wherein the entity nodes include physical entities in the industrial control system, and the edges represent the relationship between the entity nodes; S23. Obtain the historical process status data of the detected physical entity from the industrial control system, and associate the entity nodes in the twin process knowledge graph with their corresponding process data.

4. The method according to claim 1, characterized in that S4 specifically includes: S41. Based on the target requirements of anomaly detection and the process mechanism of the digital twin object, the nodes of the target process are expanded on the constructed twin process knowledge graph subgraph; S42, solving the process state data corresponding to the expanded node on the mechanism model in the digital twin system to obtain the expanded node process data; S43, storing the calculated augmented node process data in a database, and associating it with the augmented node; S44: Fuse the expanded node process data with the original node process data to reconstruct a twin data sample set with expanded dimensional space features.

5. The method according to claim 1, characterized in that S5 specifically includes: S51. Perform data cleaning and normalization preprocessing on the reconstructed twin data sample set. S52, associating the preprocessed feature data with each node in the twin process knowledge graph subgraph, and using GNN to capture the relationship and dependency between the twin process knowledge graph subgraphs, and outputting the node embedding relationship; S54. Use the node embedding relationship output by GNN and the corresponding time series data to train the LSTM model for anomaly detection, select a suitable optimizer and loss function to iteratively optimize the model parameter structure until the model meets the detection requirements, and determine the detection threshold δ of anomaly detection based on the error between the predicted score output by LSTM and the true value; when the predicted score of the LSTM model exceeds the threshold δ, it is determined that the system is abnormal.

6. The method according to claim 1, characterized in that S6 specifically includes: S61, obtaining real-time process data of the industrial control system and inputting the target anomaly detection model. If the industrial control system detects an anomaly, the detected abnormal node features are analyzed to determine the abnormal node type, and the adjacent nodes of the abnormal node and the attribute information of the edges between the nodes are analyzed to determine whether the adjacent nodes have anomalies and potential abnormal propagation paths; S62. Combine the process flow and equipment relationship, perform semantic analysis on the abnormal node and its adjacent nodes, and determine the logical path of abnormal propagation; S63. Use a graph search algorithm based on the structure of the twin process knowledge graph to obtain the potential path for exception propagation. Combined with the logical path obtained by semantic analysis, determine the accurate exception propagation path, as well as the location of the exception source and the entity node to which it belongs.

7. The method according to claim 6, characterized in that After S6, it also includes: The location of the abnormal source point is displayed on the 3D model of the digital twin system.

8. An abnormality detection and positioning device for an industrial control system, used to execute the method according to any one of claims 1 to 7, characterized in that: include: Digital twin system building module, used to build the digital twin system of the industrial control system; A process knowledge graph construction module is used to extract various entity node information of the digital twin system, construct a twin process knowledge graph, and associate the entity nodes of the twin process knowledge graph with the corresponding historical process data; A subgraph extraction module is used to determine the target and scope of the subgraph of the twin process knowledge graph to be extracted according to the demand target of anomaly detection, and associate the nodes of the subgraph with the corresponding process data to obtain the subgraph of the twin process knowledge graph; The twin data reconstruction module is used to add nodes of the target process to the constructed twin process knowledge graph subgraph, use the mechanism model in the digital twin system to solve the process status data corresponding to the added nodes, fuse the process data of the expanded nodes with the process data of the original nodes, and reconstruct them into a twin data sample set with expanded dimensional space features; The anomaly detection model training module is used to perform feature processing on the twin data reconstructed from the twin data sample set, and associate the processed feature data with each node in the twin process knowledge graph subgraph; GNN is used to capture the structural relationship between nodes of the twin process knowledge graph subgraph and output the node embedding relationship. The node embedding relationship and the processed feature data are used to train the LSTM model for anomaly detection. The error between the predicted score and the true value output by LSTM is used to determine the detection threshold δ of anomaly detection and obtain the target anomaly detection model. The anomaly detection and positioning module is used to obtain real-time process data of the industrial control system and input the target anomaly detection model. If an anomaly is detected, semantic analysis is performed on the detected abnormal node and its adjacent nodes to obtain the logical path of anomaly propagation. The anomaly propagation path is inferred based on the structure of the twin process knowledge graph to obtain the potential path of anomaly propagation, and the anomaly is traced based on the logical path and potential path.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormality detection and positioning method of the industrial control system according to any one of claims 1 to 7 when executed.

Images