Deep learning method, device, storage medium and computer equipment for abnormal detection of industrial control systems

Abstract

The present invention discloses a deep learning method, device, working medium and computer equipment for abnormality detection in industrial control systems. The neural network model constructed by the method uses one-dimensional convolution and linear layers to extract the time-dependent features of sensor nodes. The physical flow chart divides the sensor nodes into subgraphs, and extracts local dependency features by setting it as a complete graph and a graph attention network, generates physical process embedding by pooling, and applies the graph attention network to capture the global dependency between processes. The control chart extracts the communication features of sensors in the controller through the graph attention network, generates controller embedding by pooling, and then applies the graph attention network to capture the information flow between controllers. Through the joint modeling of the physical flow chart and the controller communication graph, multi-level dependencies are effectively captured. The early stopping mechanism is used to avoid overfitting, and anomaly location based on anomaly scores is supported. The method can efficiently detect and locate anomalies in industrial control systems and ensure the safe and stable operation of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control systems, and in particular to a deep learning method, device, storage medium and computer equipment for anomaly detection in industrial control systems. Background Art

[0002] Industrial control systems are the backbone of modern manufacturing and process industries, playing a key role in automating and optimizing complex processes. During normal operation, abnormal conditions may occur due to failures in physical components (such as sensors or actuators) or cyber attacks (such as tampering with sensor data or controller control signals). These abnormal conditions may cause huge economic losses. In order to ensure the safe and reliable operation of industrial control systems, it is of great significance to develop effective anomaly detection models to reduce unplanned system failures.

[0003] There are many methods for detecting anomalies in industrial control systems. Traditional methods are mostly based on statistics, distance, and density. These methods are easily affected by noise and the detection effect is unstable. Most machine learning-based methods cannot capture the dependencies between sensors and do not have the ability to locate anomalies. Deep learning-based methods such as GDN (Deng A, Hooi B. Graph neural network-based anomaly detection in multivariate time series [C] / / Proceedings of the AAAI conference on artificial intelligence. 2021, 35 (5): 4027-4035.)

[0004] A graph construction method based on cosine similarity is adopted. Although it can learn potential relationships, this method depends on the quality of sensor embedding. When the embedding is inaccurate or interfered with, the constructed graph structure may be inaccurate, affecting the model's anomaly detection ability. At the same time, it does not pay attention to the time dependency in the time series. Summary of the invention

[0005] The purpose of the present invention is to overcome the deficiencies of the above prior art and provide a deep learning method for anomaly detection in industrial control systems. This deep learning method for anomaly detection in industrial control systems effectively improves the accuracy and robustness of anomaly detection and can work stably in a dynamically changing environment.

[0006] The second object of the present invention is to provide a deep learning device for anomaly detection in industrial control systems.

[0007] A third object of the present invention is to provide a storage medium.

[0008] A fourth object of the present invention is to provide a computer device.

[0009] The first object of the present invention is achieved by the following technical solution: a deep learning method for abnormality detection of industrial control systems, comprising the following steps:

[0010] S1. In the industrial control system that needs to be protected or detected, a data acquisition system is used to collect sensor data in real time, and the collected data is processed to obtain a data set, which includes a training set, a validation set, and a test set;

[0011] S2. Construct a neural network model. The neural network model includes:

[0012] Node encoder, used to extract local temporal dependencies;

[0013] A physical flow graph-oriented attention network module is used to capture the dependencies of sensors in the physical process;

[0014] A controller graph attention network module to capture the sensor information flow relationship between controllers;

[0015] The predictor is used to predict the expected value of the sensor at the next timestamp;

[0016] S3, using an early stopping mechanism to train the neural network model to optimize the neural network model;

[0017] S4. Deploy the optimized neural network model to perform abnormal diagnosis on the industrial control system being protected or detected and obtain the diagnosis result.

[0018] Preferably, the node encoder includes a one-dimensional convolution layer and a linear layer. The one-dimensional convolution layer performs one-dimensional convolution on each node along the time dimension on the data input by the sliding window to capture the local time dependency in the input sequence, thereby obtaining the vectorized result after the convolution, and then inputting the vectorized result into the linear layer to encode each node.

[0019] Preferably, the physical flow chart-oriented attention network module includes:

[0020] Divide the physical subgraph and divide each node into node sets to form a physical flow graph;

[0021] Generate a physical subgraph, assign different weights to each node based on the adaptive attention mechanism, and perform average pooling on the features of each node in the physical flow chart;

[0022] The physical graph attention layer performs graph attention operations on the average pooled physical process graph to obtain the features of adjacent physical processes to capture the dependencies of sensors in the physical process.

[0023] Preferably, the controller-oriented graph attention network module comprises:

[0024] Divide the controller subgraph and divide each node into node sets to form a control graph;

[0025] Generate a controller subgraph, assign different weights to each node based on the adaptive attention mechanism, and perform average pooling on the features of each node in the control graph;

[0026] The control graph attention layer performs graph attention operation on the average pooled control graph to obtain the features of adjacent physical processes to capture the information flow between controllers.

[0027] Preferably, step S3 comprises the following steps:

[0028] S31, initializing the neural network model according to the dimension d of the embedding vector of the graph attention network and the number n of neurons in the fully connected layer, and initializing the patience value m;

[0029] S32. In each round of training, a sliding window is used to input the training set into the neural network model for training and learning. The loss function uses the square error loss function:

[0030] ,

[0031] in, is the size of the sliding window of input samples, is the total timestamp of the training set, It means that the model predicts the value of each sensor at time t, express The actual value of each sensor at the moment;

[0032] S33. After each round of training, verify on the validation set:

[0033] If the validation set loss in the current round is lower than the previously recorded optimal loss value, the optimal loss is updated and the current model parameters are saved; otherwise, the patience counter is increased; if the patience counter exceeds the set patience parameter m, the training process will stop and return to the model parameters when the validation set loss is optimal.

[0034] Preferably, the abnormality diagnosis method in step S4 is:

[0035] S41. Let the abnormal score of the i-th sensor at time t be:

[0036] ,

[0037] in, is the expected value of the i-th sensor at time t, is the observation value of the i-th sensor at time t;

[0038] S42, performing robust normalization processing on the error value of each sensor:

[0039] ,

[0040] in, and Respectively The median and quartiles of all times on the validation set, Indicates The robustly normalized anomaly scores of each sensor;

[0041] S43, using the maximum normalized anomaly score among all sensors at time t As the overall anomaly score, that is, the anomaly score of all sensors at time t Using the max function:

[0042] ;

[0043] A(t) is the maximum anomaly score among all sensors at time t;

[0044] S44, if ,in Represents the threshold for abnormal score determination; it is considered that an abnormality has occurred in the system and that the abnormality has occurred in the process of the sensor corresponding to A(t).

[0045] Preferably, after step S4, the following steps are also included:

[0046] S5. The diagnosis results are recorded as logs and saved in the central database, and the staff is notified to take a series of protective measures based on the diagnosis results.

[0047] The second object of the present invention is achieved by the following technical solution: a deep learning device for detecting abnormalities in an industrial control system, comprising:

[0048] A data collection module, used for collecting sensor data of industrial control systems to form a data set;

[0049] A data processing module is used to process the data set to obtain training samples;

[0050] A model construction module is used to train the neural network model using training samples to obtain a model for anomaly detection;

[0051] The abnormality diagnosis module is used to perform model reasoning on the data in the industrial control system being protected or detected, and output the diagnosis results, and then hand over the results to the result response module;

[0052] The result response module is used to record and save the test results to facilitate subsequent analysis and backtracking.

[0053] The third purpose of the present invention is achieved through the following technical solution: a storage medium stores a program, and when the program is executed by a processor, the deep learning method for industrial control system anomaly detection described in the first purpose is implemented.

[0054] The fourth purpose of the present invention is achieved through the following technical solution: a computer device includes a processor and a memory for storing a program executable by the processor. When the processor executes the program stored in the memory, the deep learning method for anomaly detection in an industrial control system described in the first purpose is implemented.

[0055] The present invention has the following advantages over the prior art:

[0056] The neural network in the present invention uses physical process information and controller information to model the graph structure, so that the neural model can more accurately reflect the physical process, the multi-level dependencies between the controller and the sensor, and then combined with the one-dimensional convolution layer, the linear layer and the graph neural network module, it can effectively extract the time dependency and better capture the dependency between sensors, thereby improving the accuracy and stability of anomaly detection. In addition, the present invention uses an early stopping mechanism to train the neural network model to prevent the neural network model from overfitting and improve the generalization ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a structural diagram of a neural network model of a deep learning method for detecting anomalies in an industrial control system according to the present invention.

[0058] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0059] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0060] Example 1

[0061] like Figure 1 and Figure 2 The deep learning method for anomaly detection in industrial control systems includes the following steps:

[0062] S1. In the industrial control system that needs to be protected or detected, a data acquisition system is used to collect sensor data in real time, and the collected data is processed to obtain a data set, which includes a training set, a validation set, and a test set; specifically, the data set of this embodiment adopts the SWaT data set. SWaT is a scaled-down version of a full-function water treatment system for network security research. It includes 51 sensors, composed of six subsystems and controlled by six controllers, including raw water supply, chemical dosing, ultrafiltration (UF), dechlorination, reverse osmosis (RO), backwashing and water circulation. The SWaT data set contains seven days of records of all subsystems under normal conditions and four days of attack scenario records, which are used as training data and test data respectively.

[0063] S2. Construct a neural network model. The neural network model includes:

[0064] A node encoder is used to extract local time dependencies; the node encoder includes a one-dimensional convolution layer and a linear layer. The one-dimensional convolution layer performs one-dimensional convolution on each node along the time dimension on the data input by the sliding window to capture the local time dependencies in the input sequence, thereby obtaining a vectorized result after the convolution, and then inputting the vectorized result into the linear layer to encode each node.

[0065] A physical flow graph-oriented attention network module is used to capture the dependency of sensors in a physical process; the physical flow graph-oriented attention network module includes:

[0066] Divide the physical subgraph and divide each node into node sets to form a physical flow graph;

[0067] Generate a physical subgraph, assign different weights to each node based on the adaptive attention mechanism, and perform average pooling on the features of each node in the physical flow chart;

[0068] The physical graph attention layer performs graph attention operation on the average pooled physical flow graph to obtain the features of adjacent physical processes to capture the dependencies between sensors.

[0069] The controller graph attention network module is used to extract the internal and external dependencies between processes and controllers. The controller graph attention network module includes:

[0070] Divide the controller subgraph and divide each node into node sets to form a control graph;

[0071] Generate a controller subgraph, assign different weights to each node based on the adaptive attention mechanism, and perform average pooling on the features of each node in the control graph;

[0072] The control graph attention layer performs graph attention operations on the average pooled control graph to obtain the features of adjacent physical processes to capture the information flow between controllers; the predictor is used to predict the expected value of the sensor at the next timestamp;

[0073] Therefore, through the joint modeling of physical flow charts and control charts, multi-level dependencies can be effectively captured and anomaly detection capabilities can be improved.

[0074] Specifically, in this embodiment, each node is divided into a physical flow chart according to the physical flow information and the controller information. and control charts The specific divisions are as follows:

[0075] Set sensor diagram ,in is a collection of nodes, Indicates nodes, Indicates no edge. According to the physical process and controller to which the node belongs, Divide into , for each subset , define the subgraph , yes The edge set on . Define the physical flow graph , It is a set of nodes consisting of subgraphs. yes The edge set on is defined by the path of product flow. Define the control chart , It is a set of nodes consisting of subgraphs. yes The edge set on is defined by the communication relationship of the controllers.

[0076] According to the above definition, the prediction of expected value is carried out through the following specific process:

[0077] S21. Input data Through a one-dimensional convolution layer (the convolution kernel size is 5) , and then through the linear layer to get As an embedding representation of a node;

[0078] S22, then divide the nodes into physical processes and controllers according to the above division to obtain ;

[0079] S23, According to the division The graph attention network layer is used in parallel to extract the dependencies between nodes and then pass through the pooling layer to obtain Embedding Representation .

[0080] S24, will According to , Parallel through the graph attention network layer to obtain , , and then , , According to the characteristics of the sensor and the corresponding process and control, it is obtained by connecting .

[0081] S25, The predictor predicts the value of the sensor at the next timestamp. .

[0082] S3, using an early stopping mechanism to train the neural network model to optimize the neural network model; step S3 includes the following steps:

[0083] S31, initializing the neural network model according to the dimension d of the embedding vector of the graph attention network and the number n of neurons in the fully connected layer, and initializing the patience value m;

[0084] S32. In each round of training, a sliding window is used to input the training set into the neural network model for training and learning. The loss function uses the square error loss function:

[0085] ,

[0086] in, is the size of the sliding window of input samples, is the total timestamp of the training set, It means that the model predicts the value of each sensor at time t, express The actual value of each sensor at the moment;

[0087] S33. After each round of training, verify on the validation set:

[0088] If the validation set loss in the current round is lower than the previously recorded optimal loss value, the optimal loss is updated and the current model parameters are saved; otherwise, the patience counter is increased; if the patience counter exceeds the set patience parameter m, the training process will stop and return to the model parameters when the validation set loss is optimal.

[0089] Specifically, this embodiment uses the above-mentioned early stopping mechanism training to train the neural network model to prevent the model from overfitting during the training process. The algorithm flow pseudo code using the early stopping mechanism training is as follows:

[0090]

[0091] S4, deploy the optimized neural network model to perform abnormal diagnosis on the industrial control system being protected or detected to obtain the diagnosis result. The abnormal diagnosis method in step S4 is:

[0092] S41. Let the abnormal score of the i-th sensor at time t be:

[0093] ,

[0094] in, is the expected value of the i-th sensor at time t, is the observation value of the i-th sensor at time t;

[0095] S42. Since different sensors may have different characteristics, resulting in different sensitivity to error values, in order to prevent the deviation value of any sensor from being too large and affecting the overall result, the error value of each sensor is robustly normalized:

[0096] ,

[0097] in, and Respectively The median and quartiles of all times on the validation set, Indicates The robustly normalized anomaly scores of each sensor;

[0098] S43. To measure the overall anomaly of the system at time t, we use the maximum normalized anomaly score of all sensors at time t As the overall anomaly score, that is, the anomaly score of all sensors at time t Using the max function:

[0099] ;

[0100] A(t) is the maximum anomaly score among all sensors at time t;

[0101] S44, if ,in Represents the threshold for abnormal score determination; it is considered that an abnormality has occurred in the system and that the abnormality has occurred in the process of the sensor corresponding to A(t).

[0102] The step S4 further includes the following steps:

[0103] S5. The diagnosis results are recorded as logs and saved in the central database, and the staff is notified to take a series of protective measures based on the diagnosis results.

[0104] In summary, the method of the present invention first extracts local time dependencies through a one-dimensional convolutional layer as an embedded representation of the node. Subsequently, the internal and external features of the physical process and the controller are extracted in parallel through a graph attention network and connected in series to capture the dependencies between sensors, thereby improving the accuracy and stability of anomaly detection. At the same time, the present invention uses an early stopping mechanism to train the neural network to effectively avoid model overfitting. In addition, the method can also achieve effective anomaly location based on the anomaly score.

[0105] Specifically, the deep learning method for detecting anomalies in an industrial control system of the present invention takes the fault detection of a water treatment plant as an example for actual retrieval. Figure 2 As shown:

[0106] Historical normal data collection: First, historical normal operation data is collected from various sensors of the industrial control system in the water treatment plant. These data include water flow, pressure, chemical composition, temperature, pH value, etc. These data represent the operating status of the water treatment plant under normal working conditions.

[0107] Data processing: preprocess the collected historical data. This process includes removing outliers, downsampling and standardizing the data to obtain a data set, which includes a training set, a validation set and a test set to ensure the data quality for subsequent model training.

[0108] Neural network model: The neural network model is trained based on the processed data set, and then the trained neural network model is saved and deployed to the industrial control system of the water treatment plant for detection. The maximum anomaly score of the saved neural network model in the validation set is used as the threshold;

[0109] Online detection: Collect the current operating data of the industrial control system of the water treatment plant, pre-process the collected operating data, and input the pre-processed operating data into the deployed neural network model to calculate the derivative score, that is, calculate the error between the predicted value of the neural network model and the actual real-time reading of the sensor to generate anomaly scores;

[0110] Abnormal judgment: compare the abnormal score with the previously set threshold. If the abnormal score is less than the threshold, the system continues to monitor; if the abnormal score exceeds the threshold, an abnormal alarm is issued and the abnormal location is performed so that maintenance personnel can take appropriate measures.

[0111] Example 2

[0112] This embodiment discloses a deep learning device for detecting abnormalities in an industrial control system, comprising:

[0113] A data collection module, used for collecting sensor data of industrial control systems to form a data set;

[0114] A data processing module is used to process the data set to obtain training samples;

[0115] A model construction module is used to train the neural network model using training samples to obtain a model for anomaly detection;

[0116] The abnormality diagnosis module is used to perform model reasoning on the data in the industrial control system being protected or detected, and output the diagnosis results, and then hand over the results to the result response module;

[0117] The result response module is used to record and save the test results to facilitate subsequent analysis and backtracking.

[0118] Example 3

[0119] This embodiment discloses a storage medium storing a program. When the program is executed by a processor, the deep learning method for abnormality detection in an industrial control system described in the first purpose is implemented.

[0120] Example 4

[0121] This embodiment discloses a computer device, including a processor and a memory for storing a program executable by the processor. When the processor executes the program stored in the memory, the deep learning method for abnormality detection in an industrial control system described in the first purpose is implemented.

[0122] The above specific implementation modes are preferred embodiments of the present invention and cannot be used to limit the present invention. Any other changes or other equivalent replacement methods that do not deviate from the technical solution of the present invention are included in the protection scope of the present invention.

Claims

1. A deep learning method for anomaly detection in industrial control systems, characterized in that: The following steps are involved: S1. In the industrial control system that needs to be protected or detected, a data acquisition system is used to collect sensor data in real time, and the collected data is processed to obtain a data set, which includes a training set, a validation set, and a test set; S2. Construct a neural network model. The neural network model includes: Node encoder, used to extract local temporal dependencies; A physical flow graph-oriented attention network module is used to capture the dependencies of sensors in the physical process; A controller graph attention network module to capture the sensor information flow relationship between controllers; The predictor is used to predict the expected value of the sensor at the next timestamp; The node encoder includes a one-dimensional convolution layer and a linear layer. The one-dimensional convolution layer performs one-dimensional convolution on each node along the time dimension for the data input by the sliding window to capture the local time dependency in the input sequence, thereby obtaining a vectorized result after the convolution, and then the vectorized result is input into the linear layer to encode each node; The physical flow graph-oriented attention network module includes: Divide the physical subgraph and divide each node into node sets to form a physical flow graph; Generate a physical subgraph, assign different weights to each node based on the adaptive attention mechanism, and perform average pooling on the features of each node in the physical flow chart; The physical graph attention layer performs graph attention operations on the average pooled physical process graph to obtain the features of adjacent physical processes to capture the dependencies of sensors in the physical process. The controller-oriented graph attention network module includes: Divide the controller subgraph and divide each node into node sets to form a control graph; Generate a controller subgraph, assign different weights to each node based on the adaptive attention mechanism, and perform average pooling on the features of each node in the control graph; The control graph attention layer performs graph attention operations on the average pooled control graph to obtain the features of adjacent physical processes to capture the dependencies of information flows between controllers. S3, using an early stopping mechanism to train the neural network model to optimize the neural network model; S4. Deploy the optimized neural network model to perform abnormal diagnosis on the industrial control system being protected or detected and obtain the diagnosis result.

2. The deep learning method for abnormality detection of industrial control systems according to claim 1 is characterized in that: Step S3 includes the following steps: S31, initializing the neural network model according to the dimension d of the embedding vector of the graph attention network and the number n of neurons in the fully connected layer, and initializing the patience value m; S32. In each round of training, a sliding window is used to input the training set into the neural network model for training and learning. The loss function uses the square error loss function: ， in, is the size of the sliding window of input samples, is the total timestamp of the training set, It means that the model predicts the value of each sensor at time t, express The actual value of each sensor at the moment; S33. After each round of training, verify on the validation set: If the validation set loss in the current round is lower than the previously recorded optimal loss value, the optimal loss is updated and the current model parameters are saved; otherwise, the patience counter is increased; if the patience counter exceeds the set patience parameter m, the training process will stop and return to the model parameters when the validation set loss is optimal.

3. The deep learning method for abnormality detection of industrial control systems according to claim 1 is characterized in that: The abnormality diagnosis method in step S4 is: S41. Let the abnormal score of the i-th sensor at time t be: ， in, is the expected value of the i-th sensor at time t, is the observation value of the i-th sensor at time t; S42, performing robust normalization processing on the error value of each sensor: ， in, and Respectively The median and quartiles of all times on the validation set, Indicates The robustly normalized anomaly scores of each sensor; S43, using the maximum normalized anomaly score among all sensors at time t As the overall anomaly score, that is, the anomaly score of all sensors at time t Using the max function: ； A(t) is the maximum anomaly score among all sensors at time t; S44, if ,in Represents the threshold for abnormal score determination; it is considered that an abnormality has occurred in the system and that the abnormality has occurred in the process of the sensor corresponding to A(t).

4. The deep learning method for abnormality detection of industrial control systems according to claim 1 is characterized in that: The step S4 further includes the following steps: S5. The diagnosis results are recorded as logs and saved in the central database, and the staff is notified to take a series of protective measures based on the diagnosis results.

5. A storage medium, characterized in that A program is stored, and when the program is executed by a processor, the deep learning method for abnormality detection of an industrial control system described in any one of claims 1 to 4 is implemented.

6. Computer device, characterized in that It comprises a processor and a memory for storing a program executable by the processor. When the processor executes the program stored in the memory, the deep learning method for abnormality detection of an industrial control system described in any one of claims 1 to 4 is implemented.

Images