Intelligent factory intrusion equipment detection method based on long and short term memory network

Abstract

The invention discloses an intelligent factory intrusion equipment detection method based on a long and short term memory network. According to the method, the time sequence relation between the characteristics of the signals emitted by the equipment in the intelligent factory at different moments is analyzed based on the long-short-term memory network, and deeper information related to the signal characteristics is extracted from the time sequence relation, so that the detection efficiency of the illegal invasion equipment is improved. According to the invention, training is carried out based on a specific loss function, so that the feature space of the neural network has good sparsity. And by using the sparsity, the identified features of the illegal invasion equipment can be clustered, so that the identification of the number of the illegal invasion equipment in the intelligent factory is realized. The method is of great significance in finding illegal invasion equipment and excluding the illegal invasion equipment in practical application.

Description

Technical Field

[0001] The present invention belongs to the technical field of intelligent signal processing, and in particular, relates to classifying signal features using a long short-term memory network, which can be used for detecting intrusion devices in smart factories. Background Art

[0002] With the development of network technology and the reduction of intelligent hardware manufacturing costs, intelligent manufacturing equipment such as intelligent robotic arms, network cameras, distributed automatic controllers, artificial intelligence quality inspection equipment, etc. are widely used in smart factories to improve management efficiency and production quality, and reduce material costs and labor expenses.

[0003] However, the introduction of smart devices has also brought new challenges to traditional manufacturing companies. For example, intrusion devices secretly placed in smart factories can covertly collect confidential data of enterprises, causing the leakage of production plans and technologies of enterprises; mobile phones (which are considered intrusion devices at this time) accidentally brought into the production site by employees may interfere with smart manufacturing equipment on the production line and cause economic losses if they are not detected in time. Therefore, there is an urgent need for the detection of intrusion devices in current smart factories.

[0004] Since intrusion devices mainly affect normal intelligent manufacturing equipment by sending and receiving electromagnetic waves, the key to distinguishing intrusion devices from normal intelligent manufacturing equipment is to distinguish the characteristics of the signals emitted by the two types of equipment. Since manufacturers of intelligent manufacturing equipment usually do not publish the signal characteristics emitted by their equipment due to the security and intellectual property factors of their equipment, the existing methods mainly use artificial intelligence technology to classify signal characteristics through decision trees, K-means and other methods to achieve the purpose of detecting intrusion devices. However, with the development of technological confrontation, some intrusion devices have gradually begun to use long connections and small data volumes to transmit signals to avoid uploading the collected information in a short time and with large traffic. This makes their signal characteristics very similar to normal intelligent manufacturing equipment in a short time, and it is difficult for existing methods to detect such devices. In order to detect such devices, it is necessary to continuously analyze their signal characteristics over a period of time, that is, to use a memory detection method.

[0005] In summary, the introduction of long short-term memory networks can solve the main problems encountered by current smart factory intrusion device detection methods. By developing this technology, it can effectively make up for the shortcomings of traditional methods, capture the characteristics of intrusion devices, and achieve efficient detection of intrusion devices in smart factories.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] The purpose of the present invention is to address the problems existing in the existing smart factory illegal intrusion device detection methods, and to propose a smart factory intrusion device detection method based on long short-term memory network. The long short-term memory network can understand the characteristics of the time relationship before and after the input sequence, and extract the time characteristics of the signal emitted by the equipment in the smart factory; then, by utilizing this time characteristic, the accuracy of the smart factory intrusion device detection method can be effectively improved; finally, by clustering the characteristics of the intrusion device, the number of intrusion devices in the smart factory can be identified. In summary, compared with the existing smart factory intrusion device detection method, the method proposed by the present invention has achieved improvements in performance in many aspects, thereby providing technical support for the safe operation of smart factories.

[0008] The object of the present invention is to achieve the following technical solution: a method for detecting intrusion equipment in a smart factory based on a long short-term memory network, comprising the following steps:

[0009] (1) Construction of signal temporal features: This step is performed in two dimensions: time and feature. The time dimension includes the time period from the start observation time t = 1 to the end observation time t = T, and the feature dimension includes several different features extracted at each time point. For any time point t, the feature extracted from the sampled signal at that time point is expressed as:

[0010] x i,t =[x i,t,1 ,x i,t,2 ,…,x i,t,] ] t

[0011] Where i = 1, 2, ..., I represents the device number, which is used as the label of the data sample during training, I represents the total number of devices, and x i,t,n , n=1,2,…,N expresses the nth feature of the RF signal emitted by the device numbered i extracted at time point t; the overall feature of the RF signal emitted by the device numbered i during the observation time is expressed as:

[0012]

[0013] (2) Signal semantic space modeling based on long short-term memory network: This step involves the forward propagation and training of the neural network based on the long short-term memory network; the forward propagation calculation process of the neural network based on the long short-term memory network is as follows:

[0014] f i，t =Sigmoid(W f ·cat(R i，t-1 , x i,t ))

[0015] p i,t =Sigmoid(W p ·cat(R i，t-1 , x i,t ))

[0016] q i,t =tanh(W q ·cat(R i，t-1 , x i,t ))

[0017] s i，t =f i，t ⊙s i,t-1 +p i，t ⊙q i,t

[0018] o i,t =Sigmoid(W o ·cat(R i，t-1 , x i，t ))

[0019] R i，t =o i，t ⊙tanh(s i，t )

[0020] Each calculation starts from t = 1 and ends at t = T, that is, from f i，1 Start calculating and finally get R i，T ; Among them, except R i，T Outside, f i，t 、p i,t ,q i,t 、s i，t , o i,t , R i,t , t=1,2,..., T represents the intermediate variable in the calculation step, W f , W p , W q , W o expresses trainable parameters, cat(·,·) expresses the operation of connecting two vectors end to end, sigmoid(·) expresses the Sigmund function, tanh(·) expresses the hyperbolic tangent function, · expresses the product of matrices or vectors, ⊙ expresses the Hadamard product, R i，0 ,s i，0 Express R i，t ,s i，t The initial value of is randomly selected during the training process; the forward propagation calculation process is expressed as:

[0021] R i，T =L(X i ; W f , Wp , W q , W o )

[0022] Wherein, L(·) expresses the calculation process described by the above formula; through the forward propagation calculation process, the overall characteristic X of the radio frequency signal emitted by the device numbered i during the time period t=1 to t=T is calculated. i Calculate its representation R in the signal semantic space i，T ;

[0023] The training process selects three loss functions. Each time, a data sample used for training is calculated as its representation through the process shown in the above formula, and then the value of the loss function is calculated. Finally, back propagation is performed to update the trainable parameter W. f , W p , W q , W o ; The selected loss function is expressed as:

[0024]

[0025] Among them, X i，m , m=1,2,..., M represents the mth data sample for training from the device numbered i, M is the total number of training samples from the device, R i，m，T For X i，m Characterization, R i，m，T =L(X i，m ; W f , W p , W q , W o ), C i The center vector representing all data samples from device numbered i, Softmax(·) represents the Softmax function, Abs(·) represents the absolute value, Reverse(·) represents a decoding neural network, and Classify(·) represents a classification neural network;

[0026] The complementary point mechanism is introduced, and the complementary point of the device numbered i is defined as P i , P i satisfy:

[0027]

[0028] Among them, d(·,·) is the distance metric function; based on this mechanism, a new loss function is introduced as follows:

[0029]

[0030] Among them, R i is a learnable parameter;

[0031] (3) Semantic space segmentation based on signal statistical features: Using the standard deviation threshold segmentation method, the semantic space is expressed as:

[0032]

[0033] Among them, V i represents the semantic space corresponding to the device numbered i, and Hongi represents all vectors R belonging to the semantic space in the data samples used for training i , m, the mean of T, φi expresses the segmentation threshold; for the semantic space V i The method for determining the segmentation threshold is as follows: for each vector R belonging to the semantic space in the data sample used for training i , m, T, calculate the following formula:

[0034] d i，m =(R i，m，T -μ i ) T (R i，m，T -μ i )

[0035] Then, calculate d i，m , m=1,2,...,standard deviation σ of M i , and then all d i，m Arrange the values ​​from large to small and take the first one that is less than three times σ i The value of the semantic space V i The segmentation threshold φ i ; Thus, the entire semantic space is clearly divided into I+1 parts, among which the first I part V i , i = 1, 2, ..., I corresponds to the semantic space of signals emitted by devices of known types in the training set, and the last part is defined as:

[0036] V u =R d -V1-V2-…-V I

[0037] Among them, V u The semantic space corresponding to the signal emitted by the unknown intrusion device, R d represents a d-dimensional real vector space, where d represents R i，m，T Dimension; In this formula only, the symbol “[·]-[·]” represents the semantic space on the left side of the symbol minus all elements from the semantic space on the right side of the symbol;

[0038] (4) Intrusion device identification: When a signal is collected and its feature X is calculated according to step (1), sAfter that, its features are input into the trained neural network based on long short-term memory network and its representation R is obtained. s，T , if R s，T Does not belong to the semantic space V u , it is judged as a known device, and it is judged as a normal intelligent manufacturing device or a known intrusion device by the identified device number; otherwise, it is judged as an unknown intrusion device.

[0039] Furthermore, the effects of different loss functions of the LSTM-based neural network are: center The RF signal representations from the same device are clustered together, ensuring the sparsity of the semantic space; classify Ensure that the neural network based on the long short-term memory network has sufficient classification ability; reconstruction This strengthens the representation ability of neural networks based on long short-term memory networks.

[0040] Furthermore, the distance metric function d(·,·) is formulated as:

[0041]

[0042] Among them, z is a hyperparameter.

[0043] Furthermore, the neural network based on the long short-term memory network trained in step (2) can transform the input X i，m Projection to dimension and its representation vector R i，m，T In a semantic space with the same dimension, representation vectors corresponding to inputs from devices with the same number are clustered together, and representation vectors corresponding to inputs from devices with different numbers are separated from each other.

[0044] Furthermore, in step (4), if it is determined that there are multiple signals coming from unknown intrusion devices, the k-means clustering algorithm is used to characterize them. s，T Clustering is performed, and then the number of unknown intrusion devices is determined to be equal to the number of categories obtained by the k-means clustering algorithm.

[0045] Compared with the prior art, the present invention has the following advantages:

[0046] (1) The present invention is based on a long short-term memory network, which can analyze the temporal relationship between the characteristics of signals emitted by devices in a smart factory at different times, and extract deeper information about the signal characteristics from the temporal relationship. Further, it can improve the detection efficiency of illegally intruding devices.

[0047] (2) The present invention is trained based on a specific loss function, so that the feature space of the neural network has good sparsity. By using this sparsity, the features of the identified illegal intrusion devices can be clustered, thereby realizing the identification of the number of illegal intrusion devices in the smart factory. This is of great significance for finding and eliminating illegal intrusion devices in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is the overall flow chart of the method of the present invention.

[0049] Figure 2 It is a comparison chart of the NA values ​​of the method of the present invention and the classic CNN method as the feature similarity between different devices changes.

[0050] Figure 3 It is a comparison chart of the NA value of the method of the present invention and the classic CNN method over the observation time. DETAILED DESCRIPTION

[0051] The following is the attached Figure 1 , the technical solution of the present invention is further described in detail.

[0052] The embodiment of the present invention provides a method for detecting intrusion devices in a smart factory based on a long short-term memory network, the method comprising the following steps:

[0053] (1) Construction of the time series features of the signal. The RF signals of the equipment in the smart factory are collected by the RF sensors deployed in the smart factory. This step is performed in two dimensions: time and features. The time dimension includes the time period from the start observation time t=1 to the end observation time t=T, and the feature dimension includes several different features extracted at each time point. Specifically, for any time point t, the feature extracted from the sampled signal at that time point is expressed as:

[0054] x i，t =[x i,t,1 , x i,t,2 , ..., x i,t,N ] T

[0055] Where i = 1, 2, ..., I represents the device number, which is used as the label of the data sample during training, I represents the total number of devices, [·] T Expresses the transpose operation of a matrix or vector, x i，t，n , n = 1, 2, ..., N expresses the nth feature of the RF signal emitted by the device numbered i extracted at time point t. In general, the overall features of the RF signal emitted by the device numbered i during the observation time can be expressed in a matrix as:

[0056]

[0057] (2) Signal semantic space modeling based on long short-term memory network. This process involves the forward propagation and training of a neural network based on long short-term memory network. The forward propagation calculation process of the neural network based on long short-term memory network is as follows:

[0058] f i，t =Sigmoid(W f ·cat(R i，t-1 , x i，t ))

[0059] p i，t =Sigmoid(W p ·cat(R i，t-1 , x i,t ))

[0060] q i,t =tanh(W q ·cat(R i，t-1 , x i,t ))

[0061] s i，t =f i，t ⊙s i，t-1 +p i,t ⊙q i,t

[0062] o i,t =Sigmoid(W o ·cat(R i，t-1 , x i，t ))

[0063] R i，t =o i,t ⊙tanh(s i，t )

[0064] Each calculation starts from t = 1 and ends at t = T, that is, from f i，1 Start calculating and finally get R i，T Among them, f i，t 、p i,t ,q i,t 、s i，t , o i,t , R i，t , t=1,2,...,T(except R i,T (External) expresses the intermediate variables in the calculation steps, W f , W p , W q , W oexpresses trainable parameters, cat(·,·) expresses the operation of connecting two vectors end to end, sigmoid(·) expresses the Sigmund function, tanh(·) expresses the hyperbolic tangent function, · expresses the product of matrices or vectors, ⊙ expresses the Hadamard product, R i，0 ,s i，0 Express R i，t ,s i，t The initial value of can be randomly selected during the training process. For the convenience of description, the calculation process is expressed as:

[0065] R i，T =L(X i ; W f , W p , W q , W o )

[0066] Wherein, L(·) expresses the calculation process described by the above formula. Through this forward propagation calculation process, the overall characteristic X of the RF signal emitted by the device numbered i during the time period t=1 to t=T is calculated. i Calculate its representation R in the signal semantic space i，T Through the training of the neural network based on the long short-term memory network, these representations R i，T It will have some characteristics that we expect, which are easy to distinguish intrusion devices from normal smart manufacturing equipment in smart factories. Specifically, the training process selects three loss functions. Each time, a data sample used for training is calculated as its representation through the process shown in the above formula, and then the value of the loss function is calculated. Finally, back propagation is performed to update the trainable parameter W. f , W p , W q , W o The chosen loss function is expressed as:

[0067]

[0068] Among them, X i,m , m=1,2,..., M represents the mth data sample for training from the device numbered i, M is the total number of training samples from the device, R i，m，T For X i,m Characterization, R i，m，T =L(X i，m ; W f , W p , W q , W o ), C iW is the center vector representing all data samples from device numbered i. Softmax(·) represents the Softmax function. Abs(·) represents the absolute value. Reverse(·) represents a decoding neural network (a fully connected network composed of several fully connected layers) with trainable parameters W. R Classify(·) expresses a classification neural network (a fully connected network composed of several fully connected layers) with trainable parameters W C .W R and W C During the training process, the trainable parameter W f , W p , W q , W o Update together. The role of different loss functions is: center The RF signal representations from the same device are clustered together, ensuring the sparsity of the semantic space; classify Ensure that the neural network based on the long short-term memory network has sufficient classification ability; reconstruction This strengthens the representation ability of neural networks based on long short-term memory networks.

[0069] At the same time, combined with the application scenario of smart factories, considering that there may be multiple smart manufacturing devices and multiple intrusion devices in the scenario, in order to enable the neural network based on the long short-term memory network after training to better classify the features from the intrusion devices, the complementary point (RP) mechanism is introduced. The complementary point of a device numbered i is defined as P i , P i satisfy:

[0070]

[0071] Among them, d(·,·) is a distance metric. For example, d(·,·) can be:

[0072]

[0073] In the above formula, z is a hyperparameter. Based on this mechanism, a new loss function is introduced as follows:

[0074]

[0075] Among them, max[·,·] means taking the maximum value of the two, R i is a learnable parameter. The neural network based on the long short-term memory network trained by the above method can convert the input X i，m Projection to dimension and its representation vector R i，m，TIn the semantic space with the same dimension, the representation vectors corresponding to the inputs from the same numbered devices are clustered together, and the representation vectors corresponding to the inputs from the different numbered devices are separated from each other, thus completing the signal semantic space modeling.

[0076] (3) Semantic space segmentation based on signal statistical features, using the standard deviation threshold segmentation method. The semantic space segmented by this method can be expressed as:

[0077]

[0078] Among them, V i represents the semantic space corresponding to the device numbered i, and Hongi represents all vectors R belonging to the semantic space in the data samples used for training i ,m, T The mean of , φi expresses a segmentation threshold. For a semantic space V i The method for determining the segmentation threshold is as follows: for each vector R belonging to the semantic space in the data sample used for training i，m，T , calculate the following formula:

[0079] d i，m =(R i，m,T -μ i ) T (R i，m,T -μ i )

[0080] Then, calculate d i，m , m=1,2,...,standard deviation σ of M i , and then all d i，m Arrange the values ​​from large to small and take the first one that is less than three times σ i The value of the semantic space V i The segmentation threshold φ i Thus, the entire semantic space is clearly divided into I+1 parts. i , i = 1, 2, ..., I corresponds to the semantic space of the signals emitted by the known types of devices in the training set (including the training samples of normal intelligent manufacturing devices and the training samples of known intrusion devices), and the last part is defined as:

[0081] V u =R d -V1-V2-…-V I

[0082] Among them, V u The semantic space corresponding to the signal emitted by the unknown intrusion device, R d represents a d-dimensional real vector space, where d represents R i，m，TIn this formula only, the symbol “[·]-[·]” means that the semantic space on the left side of the symbol removes all elements from the semantic space on the right side of the symbol, that is, R is first executed d -V1, R d Remove the elements contained in V1 from the semantic space, and then execute V′-V2-…-V I , that is, execute V′-V2, remove the elements contained in V2 from the semantic space of V′, and then execute V″-V3-…-V I , and so on. So far, the semantic space segmentation based on signal statistical features has been completed.

[0083] (4) Identification of intrusion devices. When a signal is collected and its feature X is calculated according to step (1), s After that, its features are input into the trained neural network based on long short-term memory network and its representation R is obtained. s，T , if R s，T Does not belong to the semantic space V u , it is judged as a known device, and it is judged as a normal intelligent manufacturing device or a known intrusion device by the identified device number; otherwise, it is judged as an unknown intrusion device. If this method is used to determine that there are currently multiple signals from unknown intrusion devices, the k-means clustering algorithm can be used to characterize them R s，T Clustering is performed, and then the number of unknown intrusion devices is determined to be equal to the number of categories obtained by the k-means clustering algorithm. Through this method, the number of illegal unknown intrusion devices in the smart factory can be determined, which facilitates the search and elimination of intrusion devices in practical applications.

[0084] The performance of the present invention is described more intuitively below through simulation experiments.

[0085] The experiment assumes that there are five devices in a smart factory, four of which are known normal smart manufacturing devices, and one is an illegally intruded device. In step (1), each device is simulated to set N = 5 features. For each feature of each device, it is simulated and generated by Gaussian distribution. Specifically, the means of all Gaussian distributions are different, but the variances are consistent. Therefore, Gaussian variance can be used as an indicator to evaluate the similarity of features of different devices. When the Gaussian variance is 0, the features of different devices are completely dissimilar. As the Gaussian variance increases, the features of different devices gradually become similar. In the simulation experiment, the normalized accuracy NA indicator evaluation method is used to evaluate the effectiveness of detecting illegal intrusion devices. In this simulation experiment, the calculation formula of NA is expressed as:

[0086] NA=kAKS+(1-k)AUS

[0087]

[0088] Among them, L expresses the number of normal intelligent manufacturing equipment. TU and FU express the detection effect of illegal intrusion equipment: TU expresses the number of illegal intrusion equipment correctly detected, and FU expresses the number of illegal intrusion equipment that failed to be correctly detected; TPl, TNl, FPl, and FNl express the classification effect of normal intelligent manufacturing equipment. TPl expresses the number of normal intelligent manufacturing equipment correctly identified as the lth normal intelligent manufacturing equipment, and TNl expresses the number of normal intelligent manufacturing equipment correctly identified as the lth normal intelligent manufacturing equipment. l Expresses the number of non-lth normal intelligent manufacturing equipment correctly identified as non-lth normal intelligent manufacturing equipment, FP l Expresses the number of devices that failed to correctly identify the lth normal intelligent manufacturing device as the lth normal intelligent manufacturing device, FN l It expresses the number of non-l-th normal intelligent manufacturing equipment mistakenly identified as the l-th normal intelligent manufacturing equipment. k is an arbitrary constant, and k=0.5 is taken here.

[0089] Attached Figure 2 The figure shows the change of NA value of the present invention with the similarity of features between different devices (in Gaussian variance). The larger the horizontal axis in the figure, the more similar the features between different devices are, and the more difficult it is to distinguish different devices. The vertical axis in the figure represents the NA value, and the larger its value, the better the performance of the method. Figure 2 The performance of the present invention and the classical method based on convolutional neural network (CNN) are compared. Figure 2 It can be seen that when the Gaussian variance is 0, the feature differences between different devices are large, which belongs to a simple scenario, and all methods perform well. As the Gaussian variance increases, the present invention shows better performance, and its performance is always better than the classic CNN method.

[0090] Attached Figure 3 The figure shows the change of the NA value of the present invention with the observation time T. The horizontal axis in the figure represents the observation time of the radio frequency signal, and the vertical axis represents the NA value. Figure 3 In the same paper, the performance of the present invention and the classic CNN method are also compared. Figure 3 The performance of the present invention is always better than the classical method.

[0091] The above is only a preferred embodiment of the present invention. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Any technician familiar with the art can make many possible changes and modifications to the technical solution of the present invention by using the above disclosed methods and technical contents without departing from the scope of the technical solution of the present invention, or modify it into an equivalent embodiment of equivalent changes. Therefore, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of protection of the technical solution of the present invention.

Claims

1. A method for detecting intrusion equipment in a smart factory based on long short-term memory network, characterized in that: The following steps are involved: (1) Construction of signal temporal features: This step is performed in two dimensions: time and feature. The time dimension includes the time period from the start observation time t = 1 to the end observation time t = T, and the feature dimension includes several different features extracted at each time point. For any time point t, the feature extracted from the sampled signal at that time point is expressed as: x i,t =[x i,t,1 ,x i,t,2 ,…,x i,t,N ] T Where i = 1, 2, ..., I represents the device number, which is used as the label of the data sample during training, I represents the total number of devices, and x i,t,n , n=1,2,…,N expresses the nth feature of the RF signal emitted by the device numbered i extracted at time point t; the overall feature of the RF signal emitted by the device numbered i during the observation time is expressed as: (2) Signal semantic space modeling based on long short-term memory network: This step involves the forward propagation and training of the neural network based on the long short-term memory network; the forward propagation calculation process of the neural network based on the long short-term memory network is as follows: f i,t =Sigmoid(W f ·cat(R i,t-1 ,x i,t )) p i,t =Sigmoid(W p ·cat(R i,t-1 ,x i,t )) q i,t =tanh(W q ·cat(R i,t-1 ,x i,t )) s i,t =f i,t ⊙s i,t-1 +p i,t ⊙q i,t o i,t =Sigmoid(W o ·cat(R i,t-1 ,x i,t )) R i,t =o i,t ⊙tanh(s i,t ) Each calculation starts from t = 1 and ends at t = T, that is, from f i,1 Start calculating and finally get R i,T ; Among them, except R i,T Outside, f i,t 、p i,t ,q i,t 、s i,t , o i,t , R i,t ,t=1,2,…,T expresses the intermediate variables in the calculation steps, W f , W p , W q , W o expresses trainable parameters, cat(·,·) expresses the operation of connecting two vectors end to end, sigmoid(·) expresses the Sigmund function, tanh(·) expresses the hyperbolic tangent function, · expresses the product of matrices or vectors, ⊙ expresses the Hadamard product, R i,0 ,s i,0 Express R i,t ,s i,t The initial value of is randomly selected during the training process; the forward propagation calculation process is expressed as: R i,T =L(X i ;W f ,W p ,W q ,W o ) Wherein, L(·) expresses the calculation process described by the above formula; through the forward propagation calculation process, the overall characteristic X of the radio frequency signal emitted by the device numbered i during the time period t=1 to t=T is calculated. i Calculate its representation R in the signal semantic space i,T ; The training process selects three loss functions. Each time, a data sample used for training is calculated as its representation through the process shown in the above formula, and then the value of the loss function is calculated. Finally, back propagation is performed to update the trainable parameter W. f , W p , W q , W o ; The selected loss function is expressed as: Among them, X i,m ,m=1,2,…,M represents the mth data sample for training from the device numbered i, M is the total number of training samples from the device, R i,m,T For X i,m Characterization, R i,m,T =L(X i,m ; W f ,W p ,W q ,W o ), C i The center vector representing all data samples from device numbered i, Softmax(·) represents the Softmax function, Abs(·) represents the absolute value, Reverse(·) represents a decoding neural network, and Classify(·) represents a classification neural network; The complementary point mechanism is introduced, and the complementary point of the device numbered i is defined as P i , P i satisfy: Among them, d(·,·) is the distance metric function; based on this mechanism, a new loss function is introduced as follows: Among them, R i is a learnable parameter; (3) Semantic space segmentation based on signal statistical features: Using the standard deviation threshold segmentation method, the semantic space is expressed as: Among them, V i The semantic space corresponding to the device numbered i, μ i Represents all vectors R belonging to the semantic space in the data samples used for training i,m,T The mean value of i Expression segmentation threshold; for semantic space V i The method for determining the segmentation threshold is as follows: for each vector R belonging to the semantic space in the data sample used for training i,m,T , calculate the following formula: d i,m =(R i,m,T -m i ) T (R i,m,T -m i ) Then, calculate d i,m ,m=1,2,…,standard deviation σ of M i , and then all d i,m Arrange the values ​​from large to small and take the first one that is less than three times σ i The value of the semantic space V i The segmentation threshold φ i ; Thus, the entire semantic space is clearly divided into I+1 parts, among which the first I part V i ,i=1,2,…,I corresponds to the semantic space of signals emitted by devices of known types in the training set, and the last part is defined as: V u =R d -V1-V2-…-V I Among them, V u The semantic space corresponding to the signal emitted by the unknown intrusion device, R d represents a d-dimensional real vector space, where d represents R i,m,T Dimension; In this formula only, the symbol "[·]-[·]" represents the semantic space on the left side of the symbol minus all elements from the semantic space on the right side of the symbol; (4) Intrusion device identification: When a signal is collected and its feature X is calculated according to step (1), s After that, its features are input into the trained neural network based on long short-term memory network and its representation R is obtained. s,T , if R s,T Does not belong to the semantic space V u , it is judged as a known device, and it is judged as a normal intelligent manufacturing device or a known intrusion device by the identified device number; otherwise, it is judged as an unknown intrusion device.

2. According to claim 1, the method for detecting intrusion equipment in a smart factory based on a long short-term memory network is characterized in that: The role of different loss functions of neural networks based on long short-term memory networks is: center The RF signal representations from the same device are clustered together, ensuring the sparsity of the semantic space; l classify Ensure that the neural network based on the long short-term memory network has sufficient classification ability; reconstruction This strengthens the representation ability of neural networks based on long short-term memory networks.

3. The method for detecting intrusion equipment in a smart factory based on a long short-term memory network according to claim 1 is characterized in that: The distance metric function d(·,·) is: Among them, z is a hyperparameter.

4. The method for detecting intrusion equipment in a smart factory based on a long short-term memory network according to claim 1 is characterized in that: The neural network based on the long short-term memory network trained in step (2) can transform the input X i,m Projection to dimension and its representation vector R i,m,T In a semantic space with the same dimension, representation vectors corresponding to inputs from devices with the same number are clustered together, and representation vectors corresponding to inputs from devices with different numbers are separated from each other.

5. The method for detecting intrusion equipment in a smart factory based on a long short-term memory network according to claim 1 is characterized in that: In step (4), if it is determined that there are multiple signals coming from unknown intrusion devices, the k-means clustering algorithm is used to characterize them. s,T Clustering is performed, and then the number of unknown intrusion devices is determined to be equal to the number of categories obtained by the k-means clustering algorithm.

Images