Industrial internet abnormal flow detection method, device and equipment and storage medium

Abstract

The invention discloses an industrial internet abnormal flow detection method, device and equipment and a storage medium, and relates to the technical field of industrial internet abnormal detection, and the method comprises the steps: carrying out the data preprocessing of industrial internet data, carrying out the feature selection of the preprocessed industrial internet data, obtaining feature data, and carrying out the feature selection of the feature data; performing abnormal traffic detection on the feature data, determining a target multi-dimensional traffic feature in the feature data, performing data balance on the target multi-dimensional traffic feature to obtain a balanced data set, performing Bayesian optimization on an initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, and outputting the optimal parameter combination. And obtaining a target abnormal flow detection model based on the optimal parameter combination, and obtaining a detection result according to the target abnormal flow detection model, so that the security threat of the industrial internet can be effectively handled, and the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] The present application relates to the technical field of industrial Internet anomaly detection, and in particular to methods, devices, equipment and storage media for detecting abnormal traffic in the industrial Internet. Background Art

[0002] The industrial production environment is becoming increasingly complex, with numerous intelligent devices, advanced control systems and huge network systems closely intertwined. Various machines, sensors and data acquisition systems continuously generate massive amounts of real-time data. These data are not only huge in quantity, but also highly diverse and dynamic, covering a wide range of information such as equipment operating status, process parameters, environmental indicators, etc. However, it is in such a complex system that abnormal situations may occur at any time. Equipment wear, potential risks of failure, deviations in the production process, external interference factors, etc. may all cause abnormalities, posing a serious threat to production continuity, product quality and overall operational efficiency. In many industrial applications, normal operation data far outnumbers abnormal data, resulting in serious class imbalance. This may cause the learning algorithm to over-optimize the detection of normal situations and ignore abnormal situations, thereby reducing the ability to detect real anomalies. At the same time, existing models are prone to overfitting, which increases the false detection rate.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide an industrial Internet abnormal traffic detection method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology cannot effectively respond to the security threats of the industrial Internet and improve the accuracy of anomaly detection.

[0005] To achieve the above purpose, the present application proposes an industrial Internet abnormal traffic detection method, which includes: Preprocess the industrial Internet data, and perform feature selection on the preprocessed industrial Internet data to obtain feature data; Performing abnormal flow detection on the characteristic data to determine target multi-dimensional flow characteristics in the characteristic data; Performing data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set; Based on the balanced data set, the initial abnormal traffic detection model is subjected to Bayesian optimization to obtain an optimal parameter combination, and based on the optimal parameter combination, a target abnormal traffic detection model is obtained, and a detection result is obtained according to the target abnormal traffic detection model.

[0006] In one embodiment, the step of performing feature selection on the preprocessed industrial Internet data to obtain feature data includes: The pre-processed industrial Internet data is subjected to data dimensionality reduction through principal component analysis to obtain a dimensionality-reduced data set; Deriving the dimension reduction data set according to information entropy, and when the information entropy is reduced to a target entropy value, training a random forest model to obtain a target random forest model; The features of the dimensionality reduction data set are evaluated for importance according to the target random forest model, an importance score of each feature is determined, and feature data is determined based on the importance score.

[0007] In one embodiment, the step of performing abnormal flow detection on the feature data and determining the target multi-dimensional flow feature in the feature data includes: Determine a curve of the relationship between the detection rate and the number of features in the feature data based on the extreme gradient boosting tree; The characteristic data corresponding to the maximum accuracy in the relationship curve is used as the multi-dimensional flow feature.

[0008] In one embodiment, the step of performing data balancing on the multi-dimensional traffic features to obtain a balanced data set includes: Adaptively and comprehensively oversampling the multi-dimensional traffic features to obtain majority class samples and minority class samples, wherein the number of samples in the majority class samples is greater than the number of samples in the minority class samples; Obtaining a synthetic sample according to the majority class sample and the minority class sample; Determine the number of multi-class samples of the synthetic sample in the neighboring area to obtain the proportion of the majority class; The proportion of the majority class is standardized, and new samples are generated based on sample weights and the minority class samples to obtain a balanced data set.

[0009] In one embodiment, the initial abnormal traffic detection model is subjected to Bayesian optimization based on the balanced data set to obtain an optimal parameter combination, and a target abnormal traffic detection model is obtained based on the optimal parameter combination, and the step of obtaining a detection result according to the target abnormal traffic detection model includes: Determining parameters and parameter ranges of an initial abnormal traffic detection model, wherein the initial abnormal traffic detection model is an extreme gradient boosting tree and a categorical boosting tree; Performing Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, wherein the optimal parameter combination includes a parameter and a corresponding parameter range; Obtaining a Bayesian optimized extreme gradient boosting tree and a Bayesian optimized category boosting tree according to the optimal parameter combination; Obtaining a first detection result and a second detection result based on the Bayesian optimized extreme gradient boosting tree and the Bayesian optimized category boosting tree; Voting is performed on the first detection result and the second detection result to obtain a voting result, and a detection result is determined according to the voting result.

[0010] In one embodiment, the step of preprocessing the industrial Internet data includes: Determine outliers in the industrial Internet data, and perform outlier processing on the outliers to obtain filtered data; The screening data is standardized to obtain standardized data, and the standardized data is normalized to obtain preprocessed data.

[0011] In one embodiment, after the steps of performing Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, and obtaining a target abnormal traffic detection model based on the optimal parameter combination, and obtaining a detection result according to the target abnormal traffic detection model, the method further includes: Verifying the test result based on the test index to obtain a verification result; The verification result is compared with a preset detection threshold, and when the verification result is within the preset detection threshold interval, the validity of the target abnormal traffic detection model is determined to be valid.

[0012] In addition, to achieve the above purpose, the present application also proposes an industrial Internet abnormal traffic detection device, the industrial Internet abnormal traffic detection device comprising: The data processing module is used to preprocess the industrial Internet data and perform feature selection on the preprocessed industrial Internet data to obtain feature data; A feature extraction module, used to perform abnormal flow detection on the feature data and determine target multi-dimensional flow features in the feature data; A data balancing module, used to perform data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set; The model optimization module is used to perform Bayesian optimization on the initial abnormal flow detection model based on the balanced data set to obtain an optimal parameter combination, and obtain a target abnormal flow detection model based on the optimal parameter combination, and obtain a detection result according to the target abnormal flow detection model.

[0013] In addition, to achieve the above-mentioned purpose, the present application also proposes an industrial Internet abnormal traffic detection device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the industrial Internet abnormal traffic detection method as described above.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the industrial Internet abnormal traffic detection method as described above are implemented.

[0015] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the industrial Internet abnormal traffic detection method as described above.

[0016] One or more technical solutions proposed in the present application have at least the following technical effects: performing data preprocessing on industrial Internet data, and performing feature selection on the preprocessed industrial Internet data to obtain feature data, performing abnormal traffic detection on the feature data, determining target multidimensional traffic features in the feature data, performing data balancing on the target multidimensional traffic features to obtain a balanced data set, performing Bayesian optimization on an initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, and obtaining a target abnormal traffic detection model based on the optimal parameter combination, and obtaining detection results according to the target abnormal traffic detection model, which can effectively respond to security threats to the industrial Internet and improve the accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 A flow chart of the first embodiment of the method for detecting abnormal traffic in the industrial Internet provided by the present application; Figure 2 A brief flowchart of the method for detecting abnormal traffic in the industrial Internet provided in Example 2 of the present application; Figure 3 This is a schematic diagram of the module structure of the abnormal traffic detection device for the industrial Internet according to an embodiment of the present application; Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the industrial Internet abnormal traffic detection method in the embodiment of the present application.

[0020] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0022] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0023] The main solution of the embodiment of the present application is: preprocess the industrial Internet data, perform feature selection on the preprocessed industrial Internet data to obtain feature data, perform abnormal traffic detection on the feature data, determine the target multidimensional traffic features in the feature data, perform data balancing on the target multidimensional traffic features to obtain a balanced data set, perform Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain the optimal parameter combination, obtain the target abnormal traffic detection model based on the optimal parameter combination, and obtain the detection result according to the target abnormal traffic detection model.

[0024] In this embodiment, for ease of description, the following description is based on the identification of abnormal traffic detection equipment in the industrial Internet as the execution entity.

[0025] Since it is difficult to obtain a large amount of high-quality data in many industrial scenarios, the data may be missing, noisy, and inconsistent, which can greatly affect the accuracy of anomaly detection. In addition, labeled data (especially data on anomalies) is often difficult to obtain, which limits the application of supervised learning methods. Industrial systems often involve hundreds or thousands of sensors and control points, resulting in very high dimensionality of data. High-dimensional data challenges traditional anomaly detection algorithms because they may not be able to effectively handle this complexity. In addition, feature selection and engineering are particularly difficult on high-dimensional data, but are critical to improving model performance. The operating state of industrial systems changes over time, which may be caused by the introduction of new equipment, the retirement of old equipment, or changes in production processes. Existing anomaly detection techniques may have difficulty adapting to such dynamically changing environments, which may cause the detection performance to degrade over time. Many industrial applications require the ability to detect anomalies in real time or near real time. However, some existing methods are computationally expensive and may not meet the requirements of real-time processing. For industrial applications, it is very important to understand the decision-making process of the model, which helps to build user trust in the model and provide feedback on anomalies detected by the model. However, many efficient anomaly detection methods (such as deep learning models) are often considered "black boxes" and lack easy-to-understand explanations. In many industrial applications, normal operation data far outweighs abnormal data, resulting in serious class imbalance. This may cause the learning algorithm to over-optimize the detection of normal situations and ignore abnormal situations, thereby reducing the ability to detect real anomalies. At the same time, existing models are prone to overfitting, which increases the false detection rate.

[0026] The present application provides a solution, which performs data preprocessing on industrial Internet data, performs feature selection on the preprocessed industrial Internet data to obtain feature data, performs abnormal traffic detection on the feature data, determines target multidimensional traffic features in the feature data, performs data balancing on the target multidimensional traffic features to obtain a balanced data set, performs Bayesian optimization on an initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, obtains a target abnormal traffic detection model based on the optimal parameter combination, and obtains a detection result according to the target abnormal traffic detection model, which can effectively respond to security threats to the industrial Internet and improve the accuracy of abnormal detection.

[0027] It can be seen from the above embodiments that the present application performs data preprocessing on industrial Internet data, performs feature selection on the preprocessed industrial Internet data, obtains feature data, performs abnormal traffic detection on the feature data, determines the target multidimensional traffic features in the feature data, performs data balancing on the target multidimensional traffic features to obtain a balanced data set, performs Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain the optimal parameter combination, obtains the target abnormal traffic detection model based on the optimal parameter combination, and obtains the detection results according to the target abnormal traffic detection model, which can effectively respond to security threats of the Industrial Internet and improve the accuracy of abnormal detection.

[0028] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an industrial Internet abnormal traffic detection device, etc. The following takes the industrial Internet abnormal traffic detection device as an example to illustrate this embodiment and the following embodiments.

[0029] Based on this, the present application embodiment provides an industrial Internet abnormal traffic detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the abnormal traffic detection method for the industrial Internet of this application.

[0030] In this embodiment, the industrial Internet abnormal traffic detection method includes steps S10 to S40: Step S10, preprocessing the industrial Internet data, and performing feature selection on the preprocessed industrial Internet data to obtain feature data.

[0031] It should be noted that industrial Internet data refers to the large amount of data collected and generated by various sensor devices, systems and networks in the process of industrial production, operation and management. These data cover many aspects such as the operating status of production equipment, process parameters, quality inspection results, etc. For example, the working parameters of industrial equipment, real-time monitoring data such as temperature and pressure, or order information in the internal system.

[0032] It can be understood that feature data refers to a data subset with specific representativeness and importance obtained after the feature selection process. These data are usually more targeted and informative, and can better support subsequent data mining, machine learning algorithms and other tasks. For example, when predicting industrial equipment failures, key feature combinations such as equipment vibration frequency and current changes are obtained after feature selection.

[0033] In the specific implementation, after obtaining the industrial Internet data, the industrial Internet data can be preprocessed, the format of the obtained industrial Internet data can be unified, and the industrial Internet with unified format can be preprocessed to obtain the preprocessed industrial Internet data, and feature selection can be performed on the preprocessed industrial Internet data. By calculating the statistics of each feature, such as the mean, variance, correlation, etc., its importance to the target task can be evaluated. Specifically, feature importance evaluation methods such as random forest feature importance scores and information gain-based methods can be used for feature evaluation. Based on the evaluation results, features with high importance and relevance are selected. Filter methods can be used, such as screening based on correlation, variance thresholds, etc.; wrapper methods can be used to evaluate model performance by continuously trying different feature combinations; embedded methods can be used to automatically select features during model training to obtain feature data.

[0034] Step S20, performing abnormal flow detection on the characteristic data to determine target multi-dimensional flow characteristics in the characteristic data.

[0035] It should be noted that the target multi-dimensional process features refer to the most critical and representative feature set for abnormal traffic detection in the industrial Internet, which is selected after data preprocessing and feature selection, such as the traffic size used to describe the size of the data packet or the amount of data transmitted, the traffic rate used for data transmission speed, the network protocol used by the data packet, and other network features.

[0036] In the specific implementation, when abnormal traffic detection is performed on feature data, the extreme gradient boosting tree (XGBoost) can be used to perform abnormal traffic detection on the selected feature data. The feature data can be sorted based on the extreme gradient boosting tree to screen out the target multi-dimensional traffic characteristics.

[0037] Step S30, performing data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set.

[0038] It should be noted that data balance means that the number of samples in each category in the data set is roughly equal to avoid deviations during model training, while a balanced data set refers to the balanced result obtained after data balancing.

[0039] In the specific implementation, in the set composed of multi-dimensional traffic features, some samples may have more samples than other categories, resulting in data imbalance. In the industrial Internet data, normal traffic data is far more than abnormal traffic data. In order to improve the generalization ability and accuracy of data processing, the data set needs to be balanced. The balanced data set can be obtained by resampling and data synthesis. Resampling includes oversampling and undersampling. In oversampling, the number of minority class samples can be increased by copying existing samples or generating new synthetic samples. For example, synthetic samples can be generated by the SMOTE (Synthetic Minority Over-sampling Technique) algorithm, while the number of majority class samples can be reduced in undersampling. It can be achieved by random selection or selecting samples based on a certain strategy. The purpose of data synthesis is to increase the number of minority classes by generating new synthetic samples through algorithms while maintaining data diversity, such as the ADASYN (Adaptive Synthetic Sampling) algorithm. ADASYN is an adaptive synthetic oversampling method that generates synthetic samples based on the distribution difference between the majority class and the minority class. The core idea of ​​the ADASYN algorithm is to generate synthetic samples similar to each minority class sample while controlling the number of generated samples to achieve a balance between categories.

[0040] Step S40, performing Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, and obtaining a target abnormal traffic detection model based on the optimal parameter combination, and obtaining a detection result according to the target abnormal traffic detection model.

[0041] It should be noted that the optimal parameter combination refers to the model parameters corresponding to the best detection results of the initial abnormal traffic detection model in the process of detecting industrial Internet data after Bayesian optimization of the initial abnormal traffic detection model based on the balanced data set; and the detection result refers to the detection result generated by detecting industrial Internet data through the target abnormal traffic detection model, which is used to reflect the current status of Internet data, among which the target abnormal traffic detection model is the abnormal traffic detection model after Bayesian optimization. In a specific implementation, after obtaining a balanced data set, the balanced data set can be used as input data, and the parameters can be trained by pre-set parameters and corresponding parameter ranges in combination with Bayesian optimization, wherein the pre-set parameters and parameter ranges corresponding to the parameters can be manually pre-set or automatically generated by the system, and either method is based on actual production needs. Through the Bayesian optimization method, the parameters in the initial abnormal traffic detection model and the parameter ranges corresponding to the parameters are redefined to obtain new parameters and parameter ranges, and the target abnormal traffic detection model is constructed with the new parameters and parameter ranges, thereby obtaining the corresponding detection results. Among them, the detection results corresponding to the target abnormal traffic detection model formed by the optimal parameter combination obtained after Bayesian optimization can best reflect the abnormal situation of the current industrial Internet data. After obtaining the target abnormal traffic detection model, the obtained target abnormal traffic detection model can be put into use, and the categories corresponding to each sample data have been obtained.

[0042] The present embodiment provides an abnormal traffic detection method for the industrial Internet, which performs data preprocessing on industrial Internet data and performs feature selection on the preprocessed industrial Internet data to obtain feature data, performs abnormal traffic detection on the feature data, determines target multidimensional traffic features in the feature data, performs data balancing on the target multidimensional traffic features to obtain a balanced data set, performs Bayesian optimization on an initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, obtains a target abnormal traffic detection model based on the optimal parameter combination, and obtains a detection result based on the target abnormal traffic detection model, which can effectively respond to security threats to the industrial Internet and improve the accuracy of abnormal detection.

[0043] In a feasible implementation manner, the step of performing feature selection on the preprocessed industrial Internet data to obtain feature data includes: The pre-processed industrial Internet data is subjected to data dimensionality reduction through principal component analysis to obtain a dimensionality-reduced data set; Deriving the dimension reduction data set according to information entropy, and when the information entropy is reduced to a target entropy value, training a random forest model to obtain a target random forest model; The features of the dimensionality reduction data set are evaluated for importance according to the target random forest model, an importance score of each feature is determined, and feature data is determined based on the importance score.

[0044] It should be noted that principal component analysis can be used to reduce data dimensionality and can reduce data complexity by identifying the main directions of change in the data while retaining as much variability in the original data set as possible; information entropy refers to the uncertainty or degree of confusion in the data, and the uncertainty of industrial Internet data can be reflected through information entropy. The larger the information entropy, the greater the degree of uncertainty, and the smaller the information entropy, the smaller the degree of uncertainty.

[0045] In the specific implementation, the preprocessed industrial Internet data is subjected to principal component analysis (PCA) to reduce the dimension of the preprocessed industrial Internet data, retaining most of the variability in the data set while reducing the dimension of the data. The principal components in the preprocessed industrial Internet data are extracted during the principal component analysis. These components are linear combinations of the original features and are arranged in order of decreasing variance. In this process, selecting the number of principal components is a key step. At this time, the number of principal components can be determined by explaining the variance ratio, cumulative contribution rate and variance ratio graph. Specifically, the variance ratio explained by each principal component can be determined, and the principal component that cumulatively explains most of the variance can be selected. Then, the principal component can be selected to reach a threshold, such as the principal component with a cumulative contribution rate of 95%, and the variance ratio of each principal component can be plotted. The number of principal components at the inflection point is selected, which is usually the turning point where the variance ratio decreases. After data dimensionality reduction based on principal component analysis, a reduced dimensionality data set is obtained. The data set after PCA dimensionality reduction is used as a new input feature set. The features are evaluated based on information entropy, and those with high information content are selected. The calculation of information entropy involves the distribution of eigenvalues. High information entropy means that the distribution of eigenvalues ​​is more uniform and the uncertainty is higher. Therefore, the information entropy can be derived to determine the tree with the fastest entropy drop until the entropy is zero or close to zero, which is the leaf node of the tree. This process can be understood as using information entropy as a splitting criterion to build a decision tree. In the process of tree construction, those features that make the entropy drop the fastest are selected for splitting until the entropy is zero or close to zero, which usually means that a node with high purity is found, that is, a leaf node. Then the random forest model is trained to combine the constructed multiple decision trees with their corresponding prediction results, and provide importance scores according to the importance of each feature. The importance score can reflect the degree of influence of this feature on the performance, so it can be sorted according to the importance score and feature data can be selected.

[0046] This method performs PCA dimensionality reduction processing on industrial Internet data. Since there are a large number of outliers in the industrial Internet data set and abnormal data samples are relatively scarce, and a large amount of data will lead to high detection complexity, PCA dimensionality reduction processing can reduce data complexity and facilitate feature extraction. The proposed dual feature selection method takes into account the high complexity of the data set and can effectively reduce data complexity and reduce the number of features used, thereby reducing detection time.

[0047] In a feasible implementation manner, the step of performing abnormal flow detection on the feature data and determining the target multi-dimensional flow feature in the feature data includes: Determine a curve of the relationship between the detection rate and the number of features in the feature data based on the extreme gradient boosting tree; The characteristic data corresponding to the maximum accuracy in the relationship curve is used as the multi-dimensional flow feature.

[0048] In the specific implementation, after the industrial Internet data is reduced in dimension through PCA and the characteristic data is determined, the extreme gradient boosting tree (XGboost) can be used for abnormal traffic detection. In the process of sorting the feature importance from high to low, a curve showing the relationship between the detection rate and the number of features used is constructed. When the accuracy reaches the maximum value, the most important multidimensional features are selected, and the detection is completed with the least important multidimensional features.

[0049] This method can use the extreme gradient boosting tree to parallelize multi-threading to reduce the dimension of the data and determine the importance of the features in the detection process through the extreme gradient boosting tree, which can speed up the feature selection time and improve data processing efficiency.

[0050] In a feasible implementation manner, the step of performing data balancing on the multi-dimensional traffic features to obtain a balanced data set includes: Adaptively and comprehensively oversampling the multi-dimensional traffic features to obtain majority class samples and minority class samples, wherein the number of samples in the majority class samples is greater than the number of samples in the minority class samples; Obtaining a synthetic sample according to the majority class sample and the minority class sample; Determine the number of multi-class samples of the synthetic sample in the neighboring area to obtain the proportion of the majority class; The proportion of the majority class is standardized, and new samples are generated based on sample weights and the minority class samples to obtain a balanced data set.

[0051] In a specific implementation, when performing data balancing, the multi-dimensional traffic features can be adaptively oversampled (ADASYN, Adaptive Synthetic Sampling Approach) to obtain majority class samples and minority class samples, wherein the number of samples in the majority class samples is greater than the number of samples in the minority class samples, a synthetic sample is obtained based on the majority class samples and the minority class samples, the number of multi-class samples of the synthetic sample in the neighboring area is determined, the majority class proportion is obtained, the majority class proportion is standardized, and new samples are generated based on the sample weights and the minority class samples to obtain a balanced data set. Specifically, by determining the number of majority class samples to be , the number of minority class samples is , random number , the number of synthesized samples needs to be calculated by the following formula:

[0052] Among them, if , that is, the ratio after sampling is 1:1.

[0053] is the number of samples of the majority class in K nearest neighbors, and the proportion of the majority class in K nearest neighbors is calculated using the following formula:

[0054] in, .

[0055] right Standardization, the formula is as follows:

[0056] Based on the sample weight, the calculation formula for the number of new samples required to generate each minority class sample is as follows:

[0057] If the synthetic sample is , is the first The samples are ,based on Calculate the number of samples to be generated for each minority sample and generate samples according to the SMOTE algorithm. The formula is as follows:

[0058] in, A minority class sample is randomly selected from the K nearest neighbors The random number is .

[0059] This approach takes into account the scarcity of abnormal samples and proposes an oversampling method based on ADASYN, which can balance the sample data of each category and convert unbalanced data sets into balanced data sets, which is conducive to the abnormal traffic detection model to detect data and improve data detection efficiency.

[0060] In a feasible implementation manner, the initial abnormal traffic detection model is subjected to Bayesian optimization based on the balanced data set to obtain an optimal parameter combination, and a target abnormal traffic detection model is obtained based on the optimal parameter combination, and the step of obtaining a detection result according to the target abnormal traffic detection model includes: Determining parameters and parameter ranges of an initial abnormal traffic detection model, wherein the initial abnormal traffic detection model is an extreme gradient boosting tree and a categorical boosting tree; Performing Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, wherein the optimal parameter combination includes a parameter and a corresponding parameter range; Obtaining a Bayesian optimized extreme gradient boosting tree and a Bayesian optimized category boosting tree according to the optimal parameter combination; Obtaining a first detection result and a second detection result based on the Bayesian optimized extreme gradient boosting tree and the Bayesian optimized category boosting tree; Voting is performed on the first detection result and the second detection result to obtain a voting result, and a detection result is determined according to the voting result.

[0061] In the specific implementation, by taking the balanced data set as the new data set, according to the pre-set parameters and numerical ranges used by the extreme gradient boosting tree (XGBoost) and the category boosting tree (CatBoost), Bayesian optimization is used to train XGBoost and CatBoost to obtain the optimal parameter combination, and according to the optimal parameter combination, the Bayesian optimized extreme gradient boosting tree (BO-CatBoost) and the Bayesian optimized category boosting tree (BO-XGBoost) are obtained to obtain the first detection result and the second detection result, and the first detection result and the second detection result are voted on according to the voting method to obtain the voting result, and the final detection result is obtained according to the voting result, and the category corresponding to each sample data is output.

[0062] This method votes on the detection results of XGBoost and CatBoost after Bayesian optimization to achieve a Bayesian optimized fusion model. XGBoost focuses more on computational efficiency and model performance, while CatBoost has better performance in processing category features and reducing model overfitting. Models that integrate different algorithms can improve overall prediction accuracy by combining their respective advantages. In some cases, a single model may not be able to capture all the features of the data, and the fusion model can better identify and utilize these features, thereby improving the accuracy of anomaly detection and further reducing detection time.

[0063] In a feasible implementation manner, the step of preprocessing the industrial Internet data includes: Determine outliers in the industrial Internet data, and perform outlier processing on the outliers to obtain filtered data; The screening data is standardized to obtain standardized data, and the standardized data is normalized to obtain preprocessed data.

[0064] In the specific implementation, when preprocessing the data of the industrial Internet, statistical methods such as box plot (IQR) can be used to identify outliers that are far from the average or beyond the normal range, and outliers can be deleted, corrected, replaced, etc. to obtain filtered data, and the filtered data is standardized to obtain standardized data, and further normalized to obtain preprocessed data. When standardizing the data, the data is converted to a mean of 0 and a standard deviation of 1. The implementation formula is:

[0065] in, is the original data point, is the mean, is the standard deviation.

[0066] Then, the data is scaled to a specific range through data normalization. In this embodiment, the data is scaled to between 0 and 1, which can be achieved through the minimum and maximum normalization method. The formula is:

[0067] To normalize the data, are minimum and maximum values.

[0068] This process can reduce the amount of input data, increase the model's data processing speed, and improve the efficiency of abnormal traffic detection by standardizing and normalizing the industrial Internet data.

[0069] In a feasible implementation manner, after the steps of performing Bayesian optimization on the initial abnormal traffic detection model based on the balanced data set to obtain an optimal parameter combination, and obtaining a target abnormal traffic detection model based on the optimal parameter combination, and obtaining a detection result according to the target abnormal traffic detection model, the method further includes: Verifying the test result based on the test index to obtain a verification result; The verification result is compared with a preset detection threshold, and when the verification result is within the preset detection threshold interval, the validity of the target abnormal traffic detection model is determined to be valid.

[0070] In a specific implementation, after obtaining a target abnormal flow detection model based on the optimal parameter combination and obtaining a detection result according to the target abnormal flow detection model, the detection result can be verified by comparing the obtained detection result with the expected value to determine the error loss between the detection result and the expected value. , at this time, the error loss can be obtained Compared with the set threshold range, when the error loss is within the preset detection threshold interval, the validity of the target abnormal flow detection model is determined to be valid, otherwise the target abnormal flow detection model needs to be re-optimized to make the validity of the target abnormal flow detection model valid.

[0071] Through the above method, the abnormal traffic detection model can be adaptively learned and optimized, and the parameters of the abnormal traffic detection model can be automatically adjusted according to the environment, so as to ensure that the detection results output by the model are accurate, improve the detection accuracy of the model, simplify the maintenance of model parameters, and enhance the data processing capability of the model.

[0072] For example, in order to help understand the implementation process of the industrial Internet abnormal traffic detection method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 2 , Figure 2A brief flow chart of an abnormal traffic detection method for industrial Internet is provided. Specifically, an IIOT data set is obtained by acquiring industrial Internet data, and the data set is preprocessed. The preprocessed data is subjected to PCA dimensionality reduction processing, and feature data is determined based on feature selection algorithms of random forest and XGBoost, and a new data set is determined based on the feature data through ADASYN. At the same time, the data set is divided into three parts, namely, a training set, a validation set and a test set. The data in the training set are respectively obtained by Bayesian optimization to obtain a Bayesian optimized extreme gradient boosting tree (BO-CatBoost) and a Bayesian optimized category boosting tree (BO-XGBoost). The detection results of the Bayesian optimized extreme gradient boosting tree and the Bayesian optimized category boosting tree are voted to determine the final detection result. The final result is verified by the validation set. When the verification passes, a target abnormal traffic detection model is determined, and after the test set test passes, the target abnormal traffic detection model is determined as the optimal abnormal traffic detection model output.

[0073] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the industrial Internet abnormal traffic detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0074] This application also provides an industrial Internet abnormal traffic detection device, please refer to Figure 3 , the industrial Internet abnormal traffic detection device includes: The data processing module 10 is used to perform data preprocessing on the industrial Internet data and perform feature selection on the preprocessed industrial Internet data to obtain feature data; A feature extraction module 20 is used to perform abnormal flow detection on the feature data and determine target multi-dimensional flow features in the feature data; A data balancing module 30 is used to perform data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set; The model optimization module 40 is used to perform Bayesian optimization on the initial abnormal flow detection model based on the balanced data set to obtain an optimal parameter combination, and obtain a target abnormal flow detection model based on the optimal parameter combination, and obtain a detection result according to the target abnormal flow detection model.

[0075] The abnormal traffic detection device for the industrial Internet provided by the present application adopts the abnormal traffic detection method for the industrial Internet in the above-mentioned embodiment, which can solve the technical problem that the prior art cannot effectively deal with the security threats of the industrial Internet and improve the accuracy of abnormal detection. Compared with the prior art, the beneficial effects of the abnormal traffic detection device for the industrial Internet provided by the present application are the same as the beneficial effects of the abnormal traffic detection method for the industrial Internet provided by the above-mentioned embodiment, and the other technical features in the abnormal traffic detection device for the industrial Internet are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0076] The present application provides an industrial Internet abnormal traffic detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the industrial Internet abnormal traffic detection method in the above-mentioned embodiment one.

[0077] Reference below Figure 4 , which shows a schematic diagram of the structure of an abnormal traffic detection device for the industrial Internet suitable for implementing the embodiment of the present application. The abnormal traffic detection device for the industrial Internet in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions: tablet computers), PMPs (Portable Media Players: portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The industrial Internet abnormal traffic detection device shown is merely an example and should not bring any limitations to the functions and scope of use of the embodiments of the present application.

[0078] like Figure 4As shown, the abnormal traffic detection device of the industrial Internet may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the abnormal traffic detection device of the industrial Internet are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the industrial Internet abnormal traffic detection device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows an industrial Internet abnormal traffic detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0079] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0080] The abnormal traffic detection device for the industrial Internet provided by this application adopts the abnormal traffic detection method for the industrial Internet in the above-mentioned embodiment, which can solve the technical problem that the prior art cannot effectively deal with the security threats of the industrial Internet and improve the accuracy of abnormal detection. Compared with the prior art, the beneficial effects of the abnormal traffic detection device for the industrial Internet provided by this application are the same as the beneficial effects of the abnormal traffic detection method for the industrial Internet provided by the above-mentioned embodiment, and the other technical features in the abnormal traffic detection device for the industrial Internet are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0081] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0083] The present application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, and the computer-readable program instructions are used to execute the industrial Internet abnormal traffic detection method in the above-mentioned embodiment.

[0084] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0085] The above-mentioned computer-readable storage medium may be included in the industrial Internet abnormal traffic detection device; or it may exist independently without being assembled into the industrial Internet abnormal traffic detection device.

[0086] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the industrial Internet abnormal traffic detection device, the industrial Internet abnormal traffic detection device: Preprocess the industrial Internet data, and perform feature selection on the preprocessed industrial Internet data to obtain feature data; Performing abnormal flow detection on the characteristic data to determine target multi-dimensional flow characteristics in the characteristic data; Performing data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set; Based on the balanced data set, the initial abnormal traffic detection model is subjected to Bayesian optimization to obtain an optimal parameter combination, and based on the optimal parameter combination, a target abnormal traffic detection model is obtained, and a detection result is obtained according to the target abnormal traffic detection model.

[0087] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0088] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0089] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0090] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned industrial Internet abnormal traffic detection method, which can solve the technical problem that the prior art cannot effectively respond to the security threats of the industrial Internet and improve the accuracy of abnormal detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the industrial Internet abnormal traffic detection method provided in the above-mentioned embodiment, and will not be repeated here.

[0091] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned industrial Internet abnormal traffic detection method.

[0092] The computer program product provided by this application can solve the technical problem that the prior art cannot effectively deal with the security threats of the industrial Internet and improve the accuracy of anomaly detection. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the industrial Internet abnormal traffic detection method provided by the above embodiment, which will not be repeated here.

[0093] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for detecting abnormal traffic in industrial Internet, characterized in that: The industrial Internet abnormal traffic detection method includes: Preprocess the industrial Internet data, and perform feature selection on the preprocessed industrial Internet data to obtain feature data; Performing abnormal flow detection on the characteristic data to determine target multi-dimensional flow characteristics in the characteristic data; Performing data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set; Based on the balanced data set, the initial abnormal traffic detection model is subjected to Bayesian optimization to obtain an optimal parameter combination, and based on the optimal parameter combination, a target abnormal traffic detection model is obtained, and a detection result is obtained according to the target abnormal traffic detection model.

2. The method according to claim 1, characterized in that The step of performing feature selection on the preprocessed industrial Internet data to obtain feature data includes: The pre-processed industrial Internet data is subjected to data dimensionality reduction through principal component analysis to obtain a dimensionality-reduced data set; Deriving the dimension reduction data set according to information entropy, and when the information entropy is reduced to a target entropy value, training a random forest model to obtain a target random forest model; The features of the dimensionality reduction data set are evaluated for importance according to the target random forest model, an importance score of each feature is determined, and feature data is determined based on the importance score.

3. The method according to claim 1, characterized in that The step of performing abnormal flow detection on the feature data to determine the target multi-dimensional flow characteristics in the feature data comprises: Determine a curve of the relationship between the detection rate and the number of features in the feature data based on the extreme gradient boosting tree; The characteristic data corresponding to the maximum accuracy in the relationship curve is used as the multi-dimensional flow feature.

4. The method according to claim 1, characterized in that The step of performing data balancing on the multi-dimensional traffic features to obtain a balanced data set comprises: Adaptively and comprehensively oversampling the multi-dimensional traffic features to obtain majority class samples and minority class samples, wherein the number of samples in the majority class samples is greater than the number of samples in the minority class samples; Obtaining a synthetic sample according to the majority class sample and the minority class sample; Determine the number of multi-class samples of the synthetic sample in the neighboring area to obtain the proportion of the majority class; The proportion of the majority class is standardized, and new samples are generated based on sample weights and the minority class samples to obtain a balanced data set.

5. The method according to claim 1, characterized in that The steps of performing Bayesian optimization on the initial abnormal flow detection model based on the balanced data set to obtain an optimal parameter combination, obtaining a target abnormal flow detection model based on the optimal parameter combination, and obtaining a detection result according to the target abnormal flow detection model include: Determining parameters and parameter ranges of an initial abnormal traffic detection model, wherein the initial abnormal traffic detection model is an extreme gradient boosting tree and a categorical boosting tree; Based on the balanced data set, the initial abnormal traffic detection model is subjected to Bayesian optimization to obtain an optimal parameter combination, wherein the optimal parameter combination includes a parameter and a corresponding parameter range; Obtaining a Bayesian optimized extreme gradient boosting tree and a Bayesian optimized category boosting tree according to the optimal parameter combination; Obtaining a first detection result and a second detection result based on the Bayesian optimized extreme gradient boosting tree and the Bayesian optimized category boosting tree; Voting is performed on the first detection result and the second detection result to obtain a voting result, and a detection result is determined according to the voting result.

6. The method according to claim 1, characterized in that The step of preprocessing the industrial Internet data includes: Determine outliers in the industrial Internet data, and perform outlier processing on the outliers to obtain filtered data; The screening data is standardized to obtain standardized data, and the standardized data is normalized to obtain preprocessed data.

7. The method according to any one of claims 1 to 6, characterized in that After the steps of performing Bayesian optimization on the initial abnormal flow detection model based on the balanced data set to obtain an optimal parameter combination, obtaining a target abnormal flow detection model based on the optimal parameter combination, and obtaining a detection result according to the target abnormal flow detection model, the method further includes: Verifying the test result based on the test index to obtain a verification result; The verification result is compared with a preset detection threshold, and when the verification result is within the preset detection threshold interval, the validity of the target abnormal traffic detection model is determined to be valid.

8. An industrial Internet abnormal traffic detection device, characterized in that: The device comprises: The data processing module is used to preprocess the industrial Internet data and perform feature selection on the preprocessed industrial Internet data to obtain feature data; A feature extraction module, used to perform abnormal flow detection on the feature data and determine target multi-dimensional flow features in the feature data; A data balancing module, used to perform data balancing on the target multi-dimensional traffic characteristics to obtain a balanced data set; The model optimization module is used to perform Bayesian optimization on the initial abnormal flow detection model based on the balanced data set to obtain an optimal parameter combination, and obtain a target abnormal flow detection model based on the optimal parameter combination, and obtain a detection result according to the target abnormal flow detection model.

9. An industrial Internet abnormal traffic detection device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the industrial Internet abnormal traffic detection method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the industrial Internet abnormal traffic detection method as described in any one of claims 1 to 7 are implemented.

Images