Industrial control traffic anomaly detection method and system, and electronic equipment

Abstract

The invention discloses an industrial control traffic anomaly detection method and system and electronic equipment, and belongs to the technical field of traffic anomaly detection. Comprising the following steps: acquiring and preprocessing a real-time traffic data packet of a working condition network to generate an original traffic feature sequence and a time-frequency feature sequence; performing parallel processing on the original traffic feature sequence and the time-frequency feature sequence through a trained hybrid neural network model, respectively obtaining a data feature mapping result and a physical feature mapping result, performing adaptive fusion, and obtaining a traffic anomaly detection result; wherein the hybrid neural network model uses a D-ST-LSTM network to learn deep time sequence information in an original traffic feature sequence, and uses a DAE-CNN network to perform local spatial feature extraction on a time-frequency feature sequence. The time and space dimension information of the traffic data can be fully utilized, and the precision of industrial control traffic anomaly detection is improved; the problem that the anomaly detection effect of the anomaly traffic with low feature recognition degree is limited in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of flow anomaly detection, and in particular to an industrial control flow anomaly detection method, system and electronic equipment. Background Art

[0002] The statements in this section merely mention background art related to the present invention and do not necessarily constitute prior art.

[0003] As an important national infrastructure, accurate and reliable industrial control flow anomaly detection is a key means to identify network attacks and achieve active defense, which is of great significance to ensure the safe and stable operation of the power grid.

[0004] Machine learning algorithms represented by decision trees, K-nearest neighbors, random forests, and SVMs have achieved high detection accuracy in industrial control traffic anomaly detection. However, the above methods require manual feature design, are inefficient, and are not suitable for large-scale industrial control traffic data. They also cannot guarantee the effectiveness and comprehensiveness of the extracted traffic features.

[0005] In order to obtain good performance in detecting anomalies in industrial control traffic, deep learning algorithms represented by convolutional neural networks and recurrent neural networks have been introduced into the field of industrial control traffic anomaly detection in recent years. Compared with traditional machine learning algorithms, deep learning algorithms have stronger expressive power and better generalization ability, and can more accurately detect abnormal behaviors in industrial control traffic. Therefore, they are widely used in the field of industrial control traffic anomaly detection.

[0006] Conventional deep learning-based industrial control traffic anomaly detection methods are mostly based on single CNN, RNN, LSTM and other models, which have the problem of incomplete feature extraction and difficulty in taking into account the spatiotemporal characteristics of traffic data at the same time, which brings huge challenges to abnormal traffic detection. In addition, although the purely data-driven methods such as integrated CNN and RNN can effectively capture the characteristics of data, they are limited in effect when facing abnormal traffic with low feature recognition, thus limiting the accuracy of prediction. Summary of the invention

[0007] In order to address the shortcomings of the prior art, the present invention provides an industrial control flow anomaly detection method, system and electronic device, which utilize an improved hybrid neural network to extract features of flow data, capture complex spatiotemporal patterns in the flow anomaly detection task, effectively integrate the spatiotemporal dimension correlation of flow data, and realize high-precision anomaly detection of industrial control flow data.

[0008] In a first aspect, the present invention provides a method for detecting industrial control flow anomalies;

[0009] A method for detecting abnormal industrial control traffic, comprising:

[0010] Obtain the real-time traffic data packets of the working network and perform preprocessing to generate the original traffic feature sequence and time-frequency feature sequence;

[0011] The original traffic feature sequence and time-frequency feature sequence are processed in parallel through the trained hybrid neural network model, and the data feature mapping results and physical feature mapping results are obtained respectively and adaptively fused to obtain the traffic anomaly detection results;

[0012] The hybrid neural network model uses the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence, and uses the DAE-CNN network to extract local spatial features of the time-frequency feature sequence.

[0013] In some implementations, preprocessing the traffic data packets of the working network specifically includes:

[0014] The traffic data packet is divided into multiple discrete data packets, the traffic features are parsed from the discrete data packets, and outlier processing and normalization are performed to obtain the original traffic feature sequence;

[0015] The time-frequency domain features of the numerical data in the discrete data packets are jointly analyzed to construct the time-frequency feature sequence.

[0016] In some embodiments, the original traffic feature sequence includes content attribute features and derived attribute features, and the time-frequency feature sequence includes peak factor, average waveform factor, marginal factor, pulse factor, skewness factor, spectrum dispersion, vibration energy size and main frequency band position change.

[0017] In some implementations, the using of the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence specifically includes:

[0018] The original traffic feature sequence is input into multiple stacked ST-LSTM layers and merging layers for processing to obtain the deep feature vector after dimensionality reduction;

[0019] The deep feature vector is input into multiple stacked ST-LSTM layers and expansion layers for processing to obtain the data feature mapping results.

[0020] In some embodiments, the D-ST-LSTM network includes a plurality of first improved LSTM units and a plurality of second improved LSTM units connected in sequence, wherein the first improved LSTM unit includes a stacked ST-LSTM layer and a merging layer, and the second improved LSTM unit includes a stacked ST-LSTM layer and an expansion layer;

[0021] Among them, the ST-LSTM layer is constructed according to the window-based self-attention mechanism.

[0022] In some embodiments, the ST-LSTM layer includes a linear projection layer and a SwinTransformer module connected in sequence;

[0023] The output of the Swin Transformer module is mapped by a sigmoid function to generate a filter gate. The output of the Swin Transformer module is mapped by a tanh function and added to the unit state at the previous moment, and is element-wise multiplied with the filter gate to generate the unit state at the current moment.

[0024] In some implementations, the extracting local spatial features of the time-frequency feature sequence using the DAE-CNN network specifically includes:

[0025] Each time-frequency feature in the time-frequency feature sequence is subjected to denoising processing through a denoising autoencoder network to obtain a latent feature vector after decoding and reconstruction;

[0026] The decoded and reconstructed implicit feature vector is input into the convolutional neural network for hierarchical extraction and aggregation of local spatial information to generate physical feature mapping results.

[0027] In some embodiments, the DAE-CNN network includes a denoising autoencoder network and a convolutional neural network connected in sequence, and the convolutional neural network includes a plurality of convolutional layers connected in sequence, a global average pooling layer and a global maximum pooling layer set in parallel, and a fully connected layer.

[0028] In some implementations, adaptively fusing the data feature mapping result and the physical feature mapping result to obtain the traffic anomaly detection result specifically includes:

[0029] The data feature mapping result and the physical feature mapping result are fused by a feature mapping fusion function to obtain a fused feature mapping result;

[0030] Input the fused feature mapping result into the softmax layer to obtain the traffic anomaly detection result;

[0031] Wherein, the weight parameters in the feature map fusion function are adaptively determined based on the additive attention mechanism.

[0032] In a second aspect, the present invention provides an industrial control flow anomaly detection system;

[0033] An industrial control flow anomaly detection system, comprising:

[0034] The spatiotemporal feature construction module is configured to: obtain the real-time traffic data packets of the working condition network and perform preprocessing to generate the original traffic feature sequence and the time-frequency feature sequence;

[0035] The industrial control traffic anomaly detection module is configured to: process the original traffic feature sequence and the time-frequency feature sequence in parallel through the trained hybrid neural network model, obtain the data feature mapping results and the physical feature mapping results respectively, and adaptively fuse them to obtain the traffic anomaly detection results;

[0036] The hybrid neural network model uses the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence, and uses the DAE-CNN network to extract local spatial features of the time-frequency feature sequence.

[0037] In some implementations, preprocessing the traffic data packets of the working network specifically includes:

[0038] The traffic data packet is divided into multiple discrete data packets, the traffic features are parsed from the discrete data packets, and outlier processing and normalization are performed to obtain the original traffic feature sequence;

[0039] The time-frequency domain features of the numerical data in the discrete data packets are jointly analyzed to construct the time-frequency feature sequence.

[0040] In some embodiments, the original traffic feature sequence includes content attribute features and derived attribute features, and the time-frequency feature sequence includes peak factor, average waveform factor, marginal factor, pulse factor, skewness factor, spectrum dispersion, vibration energy size and main frequency band position change.

[0041] In some implementations, the using of the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence specifically includes:

[0042] The original traffic feature sequence is input into multiple stacked ST-LSTM layers and merging layers for processing to obtain the deep feature vector after dimensionality reduction;

[0043] The deep feature vector is input into multiple stacked ST-LSTM layers and expansion layers for processing to obtain the data feature mapping results.

[0044] In some embodiments, the D-ST-LSTM network includes a plurality of first improved LSTM units and a plurality of second improved LSTM units connected in sequence, wherein the first improved LSTM unit includes a stacked ST-LSTM layer and a merging layer, and the second improved LSTM unit includes a stacked ST-LSTM layer and an expansion layer;

[0045] Among them, the ST-LSTM layer is constructed according to the window-based self-attention mechanism.

[0046] In some embodiments, the ST-LSTM layer includes a linear projection layer and a SwinTransformer module connected in sequence;

[0047] The output of the Swin Transformer module is mapped by a sigmoid function to generate a filter gate. The output of the Swin Transformer module is mapped by a tanh function and added to the unit state at the previous moment, and is element-wise multiplied with the filter gate to generate the unit state at the current moment.

[0048] In some implementations, the extracting local spatial features of the time-frequency feature sequence using the DAE-CNN network specifically includes:

[0049] Each time-frequency feature in the time-frequency feature sequence is subjected to denoising processing through a denoising autoencoder network to obtain a latent feature vector after decoding and reconstruction;

[0050] The decoded and reconstructed implicit feature vector is input into the convolutional neural network for hierarchical extraction and aggregation of local spatial information to generate physical feature mapping results.

[0051] In some embodiments, the DAE-CNN network includes a denoising autoencoder network and a convolutional neural network connected in sequence, and the convolutional neural network includes a plurality of convolutional layers connected in sequence, a global average pooling layer and a global maximum pooling layer set in parallel, and a fully connected layer.

[0052] In some implementations, adaptively fusing the data feature mapping result and the physical feature mapping result to obtain the traffic anomaly detection result specifically includes:

[0053] The data feature mapping result and the physical feature mapping result are fused by a feature mapping fusion function to obtain a fused feature mapping result;

[0054] Input the fused feature mapping result into the softmax layer to obtain the traffic anomaly detection result;

[0055] Wherein, the weight parameters in the feature map fusion function are adaptively determined based on the additive attention mechanism.

[0056] In a third aspect, the present invention provides an electronic device;

[0057] An electronic device comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above method.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] 1. The technical solution provided by the present invention performs abnormal detection of industrial control traffic based on an improved hybrid neural network, avoiding the tedious manual detection process, and can quickly and accurately detect the category of abnormal industrial control traffic, thus realizing end-to-end industrial control traffic abnormal detection.

[0060] 2. The technical solution provided by the present invention makes full use of the original traffic data analysis features and the artificially designed time-frequency statistical features to increase the feature dimension of the traffic data; by fusing the data feature mapping results and the physical feature mapping results, the accuracy of anomaly detection is effectively improved.

[0061] 3. The technical solution provided by the present invention is based on the D-ST-LSTM neural network, which obtains the short-term and long-term dependencies in the original traffic feature sequence from the spatial and temporal perspectives, and solves the problem that the traditional abnormal traffic detection model has low utilization rate of the spatiotemporal characteristics of traffic data, resulting in poor detection model performance.

[0062] 4. The technical solution provided by the present invention is based on the DAE-CNN neural network. By performing time-frequency feature extraction and noise reduction processing on numerical data, it can reduce the data dimension while fully extracting the characteristic information of traffic data, effectively improve the ability of the convolutional layer to learn local spatial features, and improve detection accuracy and computational efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0064] Figure 1 A schematic diagram of a process flow of an industrial control flow anomaly detection method provided by an embodiment of the present invention;

[0065] Figure 2 A schematic diagram of a flow chart of flow characteristic analysis provided by an embodiment of the present invention;

[0066] Figure 3 A schematic diagram of the network structure of a hybrid neural network model provided by an embodiment of the present invention;

[0067] Figure 4 A schematic diagram of the network structure of the ST-LSTM layer provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0068] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0069] It should be noted that the terms used herein are only for describing specific embodiments, and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that the terms "include" and "have" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0070] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0071] Embodiment 1

[0072] The existing deep learning-based working flow anomaly detection method has the problems of incomplete feature extraction and limited feature extraction effect on abnormal flow with low feature recognition, which limits the accuracy of working flow anomaly detection; therefore, the present invention provides an industrial control flow anomaly detection method, which uses an improved hybrid neural network model to fully extract the time dimension information and spatial dimension information of flow data.

[0073] Next, combine Figure 1-Figure 4 , a method for detecting abnormal industrial control flow disclosed in this embodiment is described in detail. The method for detecting abnormal industrial control flow includes the following steps:

[0074] S1. Obtain the real-time traffic data packets of the working network and perform preprocessing to generate the original traffic feature sequence and time-frequency feature sequence. Specifically including:

[0075] S101: Divide a continuous real-time traffic data packet into multiple discrete data packets.

[0076] For example, if P is used to represent the set of real-time traffic data packets, p i represents the ith discrete data packet, then P = {p 1 ,p 2 ,…,p n}, where n is the number of discrete packets.

[0077] S102: Analyze traffic characteristics from each discrete data packet.

[0078] Combination Figure 2, the same fields as TCP / IP protocol and APCI fields in 104 protocol are parsed from the traffic, and the parsed fields are divided into internal attributes, content attributes and derived attributes. Internal attributes refer to the basic characteristics related to network traffic, including the duration of the connection (duration), the network service type of the target host (service), the connection status (flag), etc., which are extracted from the header of the network data packet; content attributes involve the content actually transmitted by the data packet, including super user permissions (root_shell), application protocol control information (APCI), login status (logged_in), etc., which are extracted from the content area of ​​the network data packet; the calculation of derived attributes takes into account the previous connection, which is subdivided into time traffic attributes and machine traffic attributes, including the number of connections with the same target host as the current connection (count), the number of connections with the same service as the current connection (srv_count), and the number of connections with the same target host and service as the current connection (dst_host_srv_count), etc., which are calculated or derived from internal attributes and content attributes. The feature sequence is constructed for the above fields, and the construction methods are divided into count, proportion and mean.

[0079] For example, if b represents the internal attribute of each discrete data packet parsing field, c represents the content attribute of each discrete data packet parsing field, and d represents the derived attribute of each discrete data packet parsing field, then p i =(b i ,c i ,d i ) T , where i = 1, 2, ..., n. At this time, after the real-time traffic data packets are segmented, multiple subsets are obtained, which are expressed as:

[0080]

[0081] S103. For non-numerical features such as network service type in internal attributes, they are converted into numerical features through one-hot encoding for model input.

[0082] S104: For the numerical type features in the subset, perform data processing operations such as outlier processing and data normalization. The specific process is as follows:

[0083] S1041. When the value of the numerical type feature in the subset is greater than the outlier boundary (OB), it is defined as an outlier. The interquartile range method is used to preprocess the outlier to reduce the interference of extreme outliers on model performance. It can be expressed as:

[0084] IQR = Q3-Q1;

[0085] OB=Q3+k·IQR;

[0086] Among them, Q1 is the eigenvalue at the 25% position among all samples in each subset sorted from small to large, Q3 is the eigenvalue at the 75% position among all samples in each subset sorted from small to large, and k is used to control the number of data marked as outliers.

[0087] S1042. Perform maximum-minimum normalization on the features of numerical type, map the values ​​of all features to the interval [0, 1], and thus reduce the impact of data dimension on model performance. It can be expressed as:

[0088]

[0089] Among them, x is the normalized value of the feature parameter, x o is the initial value of the data feature, and are the maximum and minimum values ​​of the flow data characteristics respectively.

[0090] At this time, the processed original traffic feature sequence P is obtained, which is expressed as:

[0091]

[0092] Where m is the sum of the number of all features of internal attribute b, content attribute c, and derived attribute d.

[0093] S105. For numerical data, a time-frequency domain feature joint analysis method is used to extract the time-domain and frequency-domain features of the data respectively, and features are retrieved from multiple domains to further increase feature extraction capabilities.

[0094] Specifically, the frequency domain features FF such as the peak factor, average waveform factor, marginal factor, pulse factor, skewness factor, etc. of each segment of data that changes over time, and the time domain features TF such as spectrum dispersion, vibration energy size, and main frequency band position change are selected to construct the time-frequency feature sequence F. The time-frequency feature sequence is as follows:

[0095]

[0096] Among them, f i For the i-th segment data p i (i.e., the TF and FF extracted from the i-th discrete data packet, f j i is the jth time-frequency feature element of the i-th segment, and z is the sum of the number of time domain features and frequency domain features.

[0097] S2. The original traffic feature sequence and the time-frequency feature sequence are processed in parallel through the trained hybrid neural network model to obtain the data feature mapping results and the physical feature mapping results respectively and adaptively fuse them to obtain the traffic anomaly detection results.

[0098] As an implementation method, before executing S2, it also includes: constructing and training a hybrid neural network model to form a nonlinear mapping between traffic features and label data. Specifically, it includes:

[0099] (1) Construct a parallel D-ST-LSTM network and DAE-CNN network, fuse the outputs of the D-ST-LSTM network and the DAE-CNN network, and input them into the softmax layer for classification to obtain the traffic anomaly detection results.

[0100] In this embodiment, the D-ST-LSTM network includes m first improved LSTM units and m second improved LSTM units connected in sequence, the first improved LSTM unit includes a stacked ST-LSTM layer and a merging layer, and the second improved LSTM unit includes a stacked ST-LSTM layer and an expansion layer.

[0101] Among them, combined Figure 4 The ST-LSTM layer includes a linear projection layer and a Swin Transformer module connected in sequence, which transforms the model’s current input x t and the hidden state H at the previous moment t-1 After dimension splicing, it is passed to the linear projection layer LP. Subsequently, the output of the linear projection layer LP is input into the Swin Transformer module for feature calculation. The calculated features are input into the sigmoid function and the tanh function respectively. After being mapped by the sigmoid function, a filter gate is generated. After being mapped by the tanh function, it is added to the unit state at the previous moment, and then the unit state at the current moment is generated by element-by-element product with the filter gate.

[0102] In addition, the hidden state at the current moment is generated by the element-by-element product of the current moment unit state and the filter gate after being mapped by the tanh function, which is used for the reconstruction layer and for the input of the ST-LSTM layer of the next time step together with the unit state at the current moment.

[0103] The specific implementation process of the ST-LSTM layer is as follows:

[0104] F t =σ(STB(LP(x t ;H t-1 )))

[0105]

[0106] Among them, F t represents the filter gate, STB represents the sliding window self-attention module (Swin Transformerblocks), LP represents the linear projection, Represents the Hadamard product.

[0107] Here, the applicant needs to emphasize that the Swin Transformer module in the first improved LSTM unit is constructed by window-based multi-head self-attention (W-MSA), and the Swin Transformer module in the second improved LSTM unit is constructed by shifted window-based multi-head self-attention (SW-MSA); based on this, it is beneficial to reduce the computational burden of global self-attention and improve modeling capabilities.

[0108] The Swin Transformer module in the first improved LSTM unit includes a LayerNorm layer, a W-MSA module, a LayerNorm layer and a two-layer MLP with GELU nonlinearity connected in sequence. The input of the first LayerNorm layer is residually connected to the output of the W-MSA module, and the input of the second LayerNorm layer is residually connected to the output of the two-layer MLP.

[0109] The architecture of the Swin Transformer module in the second improved LSTM unit is the same as that of the Swin Transformer module in the first improved LSTM unit, except that the W-MSA module therein is replaced by a SW-MSA module.

[0110] The DAE-CNN network includes a denoising autoencoder network and a convolutional neural network connected in sequence. The convolutional neural network includes three convolutional layers connected in sequence, a global average pooling layer and a global maximum pooling layer set in parallel, and a fully connected layer.

[0111] (2) Extract historical traffic data from the historical traffic of the industrial control network, obtain the original traffic data packet and the corresponding label data, and perform the preprocessing operation as described in S1 to obtain the corresponding data feature mapping results and physical feature mapping results and form a training set.

[0112] (3) Construct a feature mapping fusion function, adaptively determine the weight parameters of the feature mapping fusion function through the additive attention mechanism, and train the hybrid neural network model using the training set based on the cross entropy loss function.

[0113] Specifically, the cross entropy loss function is expressed as:

[0114]

[0115] O fused =α p ·O p +α f ·O f ;

[0116] In the formula, y is the true label of the sample, is the prediction result of the hybrid neural network, O fused is the fusion feature mapping result, O p and O f These are the feature mapping results output by the D-ST-LSTM network and the DAE-CNN network respectively.

[0117] In this embodiment, the weight parameter α of the feature mapping fusion function is adaptively determined based on the additive attention mechanism. p and α f .

[0118] In order to enable the additive attention mechanism to compare and calculate the weights of the two network outputs, the feature mapping result O of the D-ST-LSTM network is p And the feature mapping result of DAE-CNN network O f Perform a linear transformation so that they are projected into the same space:

[0119] V p =W p O p +b p

[0120] V f =W f O f +b f

[0121] Among them, W p and W f is the weight matrix, b p and b f is the bias term. Then, for V p and V f Additively combine and weight by a learnable vector w to generate the attention score e p and e f :

[0122] e p =tanh(w T V p +b)

[0123] e f =tanh(w T V f +b)

[0124] Among them, w is a learnable vector in the attention layer, and b is the bias term. The attention score is normalized to the weight using the softmax function:

[0125]

[0126] Among them, αp and α f Represents the adaptive weight of the feature map. By normalizing the weight, α p +α f = 1, ensuring that the feature mapping results of the two networks are assigned different weights but sum to 1.

[0127] Using attention weight α p and α f , the feature mapping result of D-ST-LSTM network is O p And the feature mapping result of DAE-CNN network O f Perform weighted summation to obtain the fused feature mapping result:

[0128] O fused =α p ·O p +α f ·O f

[0129] At this point, adaptive weighted fusion based on additive attention mechanism is realized, so that the final feature fusion mapping result can be based on O p and O f to adjust the relative importance of .

[0130] Then, the training set is used for iterative model training. The parameters in the D-ST-LSTM network, DAE-CNN network, and additive attention mechanism are updated through back propagation, so that the attention mechanism can adaptively adjust the adaptive weights of feature mapping, thereby effectively integrating the network output of feature sequence and time-frequency features, and improving the performance of the model in anomaly detection tasks. The training ends at the set number of training times or the set loss value, and finally a trained industrial control flow anomaly detection model is obtained.

[0131] (4) Based on the industrial control traffic prediction results of the constructed hybrid neural network model and the actual detection results, the neural network model is evaluated using multiple indicators such as accuracy, precision, recall, false positive rate, F1-score, and floating point operations per second (FLOPs). The specific steps include:

[0132] (401) The accuracy of industrial control flow anomaly detection is calculated based on the detection results, and the formula is expressed as:

[0133]

[0134] Among them, TP is a true positive example, FP is a false positive example, FN is a false negative example, and TN is a true negative example.

[0135] (402) The accuracy of industrial control flow anomaly detection is calculated based on the detection results, and the formula is expressed as:

[0136]

[0137] (403) The recall rate of industrial control flow anomaly detection is calculated based on the detection results, and the formula is expressed as follows:

[0138]

[0139] (404) The false alarm rate of the industrial control flow anomaly detection is calculated according to the detection result, and the formula is expressed as follows:

[0140]

[0141] (405) The F1 value of the industrial control flow anomaly detection is calculated according to the detection result, and the formula is expressed as follows:

[0142]

[0143] (406) The computational cost of the model is evaluated using floating point operations per second. The smaller the FLOPs, the faster the computation speed.

[0144] As an implementation mode, S2 specifically includes:

[0145] S201. Use the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence and obtain the data feature mapping result. Specifically include:

[0146] S2011. Input the original traffic feature sequence into multiple stacked ST-LSTM layers and merging layers for processing to obtain the deep feature vector after dimensionality reduction.

[0147] Specifically, stacked W-MSA-based ST-LSTM layers are used to capture the long-term and short-term temporal dependencies of the original traffic feature sequence, and the global spatial dependencies are learned longitudinally. Subsequently, a merging layer (Patch Merging layer) is used for downsampling to reduce the spatial dimension of the feature sequence. Then, multiple stacked W-MSA-based ST-LSTM layers and merging layers are used to learn deep temporal information to form a deep feature vector after dimensionality reduction.

[0148] S2012. Input the deep feature vector into multiple stacked ST-LSTM layers and expansion layers for processing to obtain data feature mapping results.

[0149] Specifically, the SW-MSA-based ST-LSTM layer is used to further capture the long-term and short-term temporal dependencies of the deep feature vectors, and the global spatial dependencies are learned longitudinally. Subsequently, the expansion layer (Patch Expanding layer) is used for upsampling to restore the spatial size of the feature sequence; multiple stacked SW-MSA-based ST-LSTM layers and expansion layers are used to further learn the deep temporal information to obtain the data feature mapping results.

[0150] S202, using the DAE-CNN network to extract local spatial features from the time-frequency feature sequence to obtain physical feature mapping results. Specifically including:

[0151] S2021. Perform denoising on each time-frequency feature in the time-frequency feature sequence through a denoising autoencoder network to obtain an implicit feature vector after decoding and reconstruction.

[0152] In order to enhance the robustness of the feature set, the time-frequency feature sequence containing outlier features is encoded and denoised. The outliers in the time-frequency feature sequence are regarded as noise values, and each time-frequency feature of the time-frequency feature sequence F is denoised based on the denoising autoencoder network (DAE).

[0153] Specifically, DAE consists of two parts: encoding and decoding process.

[0154] The encoding process is to compress the input F through the hidden layer and output the implicit feature vector Y = f(w1·F+b1); the decoding part decodes and reconstructs the implicit feature vector Y and outputs F′ = g(w2·Y+b2), thereby completing the denoising of high-noise data. By extracting time-frequency features and denoising numerical data, the data dimension can be reduced while fully extracting the effective feature information of the traffic data, reducing the time complexity of the convolution operation.

[0155] S2022. Input the decoded and reconstructed implicit feature vector into multiple convolutional layers for hierarchical extraction of local spatial information, and process the final output through GAP and GMP.

[0156] S2023. Input the features extracted by GAP and GMP into the fully connected layer (FC) to achieve further feature extraction and fusion to obtain physical feature mapping results.

[0157] It should be emphasized that, in this embodiment, S201 and S202 can be performed in parallel.

[0158] S203, adaptively fuse the data feature mapping result and the physical feature mapping result through the determined feature mapping fusion function, obtain the fused feature mapping result and input it into the softmax layer to obtain the traffic anomaly detection result.

[0159] Embodiment 2

[0160] This embodiment discloses an industrial control flow anomaly detection system, including:

[0161] The spatiotemporal feature construction module is configured to: obtain the real-time traffic data packets of the working condition network and perform preprocessing to generate the original traffic feature sequence and the time-frequency feature sequence;

[0162] The industrial control traffic anomaly detection module is configured to: process the original traffic feature sequence and the time-frequency feature sequence in parallel through the trained hybrid neural network model, obtain the data feature mapping results and the physical feature mapping results respectively, and adaptively fuse them to obtain the traffic anomaly detection results;

[0163] The hybrid neural network model uses the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence, and uses the DAE-CNN network to extract local spatial features of the time-frequency feature sequence.

[0164] In some implementations, preprocessing the traffic data packets of the working network specifically includes:

[0165] The traffic data packet is divided into multiple discrete data packets, the traffic features are parsed from the discrete data packets, and outlier processing and normalization are performed to obtain the original traffic feature sequence;

[0166] The time-frequency domain features of the numerical data in the discrete data packets are jointly analyzed to construct the time-frequency feature sequence.

[0167] In some embodiments, the original traffic feature sequence includes content attribute features and derived attribute features, and the time-frequency feature sequence includes peak factor, average waveform factor, marginal factor, pulse factor, skewness factor, spectrum dispersion, vibration energy size and main frequency band position change.

[0168] In some implementations, the using of the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence specifically includes:

[0169] The original traffic feature sequence is input into multiple stacked ST-LSTM layers and merging layers for processing to obtain the deep feature vector after dimensionality reduction;

[0170] The deep feature vector is input into multiple stacked ST-LSTM layers and expansion layers for processing to obtain the data feature mapping results.

[0171] In some embodiments, the D-ST-LSTM network includes a plurality of first improved LSTM units and a plurality of second improved LSTM units connected in sequence, wherein the first improved LSTM unit includes a stacked ST-LSTM layer and a merging layer, and the second improved LSTM unit includes a stacked ST-LSTM layer and an expansion layer;

[0172] Among them, the ST-LSTM layer is constructed according to the window-based self-attention mechanism.

[0173] In some embodiments, the ST-LSTM layer includes a linear projection layer and a SwinTransformer module connected in sequence;

[0174] The output of the Swin Transformer module is mapped by a sigmoid function to generate a filter gate. The output of the Swin Transformer module is mapped by a tanh function and added to the unit state at the previous moment, and is element-wise multiplied with the filter gate to generate the unit state at the current moment.

[0175] In some implementations, the extracting local spatial features of the time-frequency feature sequence using the DAE-CNN network specifically includes:

[0176] Each time-frequency feature in the time-frequency feature sequence is subjected to denoising processing through a denoising autoencoder network to obtain a latent feature vector after decoding and reconstruction;

[0177] The decoded and reconstructed implicit feature vector is input into the convolutional neural network for hierarchical extraction and aggregation of local spatial information to generate physical feature mapping results.

[0178] In some embodiments, the DAE-CNN network includes a denoising autoencoder network and a convolutional neural network connected in sequence, and the convolutional neural network includes a plurality of convolutional layers connected in sequence, a global average pooling layer and a global maximum pooling layer set in parallel, and a fully connected layer.

[0179] In some implementations, adaptively fusing the data feature mapping result and the physical feature mapping result to obtain the traffic anomaly detection result specifically includes:

[0180] The data feature mapping result and the physical feature mapping result are fused by a feature mapping fusion function to obtain a fused feature mapping result;

[0181] Input the fused feature mapping result into the softmax layer to obtain the traffic anomaly detection result;

[0182] Wherein, the weight parameters in the feature map fusion function are adaptively determined based on the additive attention mechanism.

[0183] It should be noted that the above-mentioned spatiotemporal feature construction module and the industrial control flow anomaly detection module correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above-mentioned modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned Embodiment 1. It should be noted that the above-mentioned modules, as part of the system, can be executed in a computer system such as a set of computer executable instructions.

[0184] Embodiment 3

[0185] Embodiment 3 of the present invention provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps of the above-mentioned industrial control flow anomaly detection method are completed.

[0186] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0187] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0188] These computer program instructions can also be loaded onto a computer or other programmable data processing device, and a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0189] The description of each embodiment in the above embodiments has different emphases. For parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0190] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal industrial control flow, characterized in that: include: Obtain the real-time traffic data packets of the working network and perform preprocessing to generate the original traffic feature sequence and time-frequency feature sequence; The original traffic feature sequence and time-frequency feature sequence are processed in parallel through the trained hybrid neural network model, and the data feature mapping results and physical feature mapping results are obtained respectively and adaptively fused to obtain the traffic anomaly detection results; The hybrid neural network model uses the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence, and uses the DAE-CNN network to extract local spatial features of the time-frequency feature sequence.

2. The method for detecting abnormal industrial control flow according to claim 1, characterized in that: Preprocessing of real-time traffic data packets of the working condition network specifically includes: The real-time traffic data packets are divided into multiple discrete data packets, the traffic features are parsed from the discrete data packets, and outlier processing and normalization are performed to obtain the original traffic feature sequence; Perform a joint analysis of the time-frequency domain features on the numerical data in the discrete data packets to construct a time-frequency feature sequence; Furthermore, the original traffic feature sequence includes internal attribute features, content attribute features and derived attribute features, and the time-frequency feature sequence includes peak factor, average waveform factor, marginal factor, pulse factor, skewness factor, spectrum dispersion, vibration energy size and main frequency band position change.

3. The method for detecting abnormal industrial control flow according to claim 1, characterized in that: The method of using the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence specifically includes: The original traffic feature sequence is input into multiple stacked ST-LSTM layers and merging layers for processing to obtain the deep feature vector after dimensionality reduction; Input the deep feature vector into multiple stacked ST-LSTM layers and expansion layers for processing to obtain data feature mapping results; or, The D-ST-LSTM network includes a plurality of first improved LSTM units and a plurality of second improved LSTM units connected in sequence, wherein the first improved LSTM unit includes a stacked ST-LSTM layer and a merging layer, and the second improved LSTM unit includes a stacked ST-LSTM layer and an expansion layer; Wherein, the ST-LSTM layer is constructed according to a window-based self-attention mechanism; Furthermore, the ST-LSTM layer includes a linear projection layer and a Swin Transformer module connected in sequence; The output of the Swin Transformer module is mapped by a sigmoid function to generate a filter gate. The output of the Swin Transformer module is mapped by a tanh function and added to the unit state at the previous moment, and is element-wise multiplied with the filter gate to generate the unit state at the current moment.

4. The method for detecting abnormal industrial control flow according to claim 1, characterized in that: The use of the DAE-CNN network to extract local spatial features from the time-frequency feature sequence specifically includes: Each time-frequency feature in the time-frequency feature sequence is subjected to denoising processing through a denoising autoencoder network to obtain a latent feature vector after decoding and reconstruction; The decoded and reconstructed implicit feature vector is input into the convolutional neural network for hierarchical extraction and aggregation of local spatial information to generate physical feature mapping results.

5. The method for detecting abnormal industrial control flow according to claim 1, characterized in that: The DAE-CNN network includes a denoising autoencoder network and a convolutional neural network connected in sequence, and the convolutional neural network includes a plurality of convolutional layers connected in sequence, a global average pooling layer and a global maximum pooling layer set in parallel, and a fully connected layer.

6. The method for detecting abnormal industrial control flow according to claim 1, characterized in that: Adaptively integrate the data feature mapping results and the physical feature mapping results to obtain the traffic anomaly detection results, including: The data feature mapping result and the physical feature mapping result are fused by a feature mapping fusion function to obtain a fused feature mapping result; Input the fused feature mapping result into the softmax layer to obtain the traffic anomaly detection result; Wherein, the weight parameters in the feature map fusion function are adaptively determined based on the additive attention mechanism.

7. An industrial control flow anomaly detection system, characterized in that: include: The spatiotemporal feature construction module is configured to: obtain the real-time traffic data packets of the working condition network and perform preprocessing to generate the original traffic feature sequence and the time-frequency feature sequence; The industrial control traffic anomaly detection module is configured to: process the original traffic feature sequence and the time-frequency feature sequence in parallel through the trained hybrid neural network model, obtain the data feature mapping results and the physical feature mapping results respectively, and adaptively fuse them to obtain the traffic anomaly detection results; The hybrid neural network model uses the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence, and uses the DAE-CNN network to extract local spatial features of the time-frequency feature sequence.

8. The industrial control flow anomaly detection system according to claim 7, characterized in that: The use of the DAE-CNN network to extract local spatial features from the time-frequency feature sequence specifically includes: Each time-frequency feature in the time-frequency feature sequence is subjected to denoising processing through a denoising autoencoder network to obtain a latent feature vector after decoding and reconstruction; The latent feature vector after decoding and reconstruction is input into the convolutional neural network to extract and aggregate the local spatial information in a hierarchical manner to generate the physical feature mapping result; or, The DAE-CNN network includes a denoising autoencoder network and a convolutional neural network connected in sequence, and the convolutional neural network includes a plurality of convolutional layers connected in sequence, a global average pooling layer and a global maximum pooling layer set in parallel, and a fully connected layer.

9. The industrial control flow anomaly detection system according to claim 7, characterized in that: The method of using the D-ST-LSTM network to learn the deep time series information in the original traffic feature sequence specifically includes: The original traffic feature sequence is input into multiple stacked ST-LSTM layers and merging layers for processing to obtain the deep feature vector after dimensionality reduction; Input the deep feature vector into multiple stacked ST-LSTM layers and expansion layers for processing to obtain data feature mapping results; or, The D-ST-LSTM network includes a plurality of first improved LSTM units and a plurality of second improved LSTM units connected in sequence, wherein the first improved LSTM unit includes a stacked ST-LSTM layer and a merging layer, and the second improved LSTM unit includes a stacked ST-LSTM layer and an expansion layer; Wherein, the ST-LSTM layer is constructed according to a window-based self-attention mechanism; Furthermore, the ST-LSTM layer includes a linear projection layer and a Swin Transformer module connected in sequence; The output of the Swin Transformer module is mapped by a sigmoid function to generate a filter gate. The output of the Swin Transformer module is mapped by a tanh function and added to the unit state at the previous moment, and is element-wise multiplied with the filter gate to generate the unit state at the current moment.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the industrial control flow anomaly detection method according to any one of claims 1 to 6.

Images