Industrial control system anomaly detection method and system

Abstract

The invention discloses an industrial control system anomaly detection method and system, and the method comprises the steps: collecting network flow from an industrial control system in real time, carrying out the industrial control protocol analysis of the collected network flow, and obtaining sensor data and actuator data which reflect the operation state of the industrial control system at the current moment; the sensor data and the actuator data are input into a trained anomaly detection model, the anomaly detection result of the industrial control system at the current moment is obtained, the anomaly detection model comprises a historical full connection layer, anomaly detection can be conducted on the industrial control system through the method and system, and the real-time performance and accuracy are high.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control system safety, and relates to an industrial control system anomaly detection method and system. Background Art

[0002] Anomaly detection plays a vital role in industrial control systems. These systems are responsible for monitoring and controlling various production processes to ensure an efficient and safe production environment. However, due to various reasons, such as equipment failure, operational errors, or external interference, these systems may produce abnormal behaviors. If these anomalies are not detected and handled in time, it may cause production stoppages, equipment damage, and even safety accidents. Therefore, anomaly detection has become a key link in industrial control systems, which can help operators detect and handle abnormal situations in time, thereby ensuring the smooth progress of the production process.

[0003] However, traditional anomaly detection methods often rely on manually designed features, which requires a lot of domain knowledge and experience. In recent years, the development of deep learning technology has provided new possibilities for anomaly detection. As a commonly used deep learning model, convolutional neural network (CNN) has achieved remarkable results in fields such as image recognition and speech recognition. However, CNN has limited ability to process time series data and cannot effectively capture the time series features in time series data. In contrast, models such as recurrent neural network (RNN) and long short-term memory network (LSTM) can better process time series data, but their computational complexity is high and it is difficult to apply them in scenarios with limited computing power such as industrial control systems. Therefore, there is an urgent need for a new method that can effectively process time series data while having low computing power requirements to adapt to the actual application of industrial control systems.

[0004] A Chinese patent with publication number CN109445417A discloses a method for detecting data anomalies in an industrial control system based on normalization processing. The method includes: obtaining network traffic data accessed by industrial control equipment online; detecting the network traffic data using a normalization processing algorithm and outputting the detection result; and determining whether the network traffic data is abnormal based on the comparison of the detection result with the data in the existing data feature library, thereby realizing abnormal detection of network traffic data in the industrial control system. The normalization processing used in the invention cannot fully extract complex feature information, and by comparing the normalized data with the data in the existing data feature library, it cannot cope with abnormal situations that have never occurred before in the industrial control system, so the detection accuracy and real-time performance are poor. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide an industrial control system anomaly detection method and system, which can perform anomaly detection on industrial control systems with high real-time performance and accuracy.

[0006] In a first aspect, the industrial control system anomaly detection method according to the present invention comprises:

[0007] Collect network traffic from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic, and obtain sensor data and actuator data reflecting the operating status of the industrial control system at the current moment;

[0008] The sensor data and actuator data are input into the trained anomaly detection model to obtain an anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer.

[0009] Furthermore, the anomaly detection model includes a historical fully connected layer, a convolutional layer, a pooling layer and a fully connected layer, wherein the historical fully connected layer, the convolutional layer, the pooling layer and the fully connected layer are connected.

[0010] Furthermore, before inputting the sensor data and the actuator data into the trained anomaly detection model, the method further includes:

[0011] Constructing an industrial control anomaly detection training dataset;

[0012] Build anomaly detection models;

[0013] The anomaly detection model is trained using the industrial control anomaly detection training data set to obtain a trained anomaly detection model.

[0014] Furthermore, the process of constructing the industrial control anomaly detection training data set is as follows:

[0015] Collect network traffic samples from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic samples, and obtain sensor data samples and actuator data samples reflecting the operating status of the industrial control system;

[0016] An industrial control anomaly detection training data set is constructed based on the sensor data samples and the actuator data samples. The training samples s in the industrial control anomaly detection training data set are t =(d t ,y t ), where d t represents the sensor data sample and actuator data sample at time t, y t Represents a data tag, and the data tag is marked according to whether the industrial control system is abnormal at time t.

[0017] Furthermore, the loss function in the process of training the anomaly detection model using the industrial control anomaly detection training data set is:

[0018] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)

[0019] Among them, L(y i ,p) is the binary cross entropy loss function, y i is the data label of the i-th fusion training sample, p is the probability of the anomaly detection model predicting the positive class, p∈[0,1].

[0020] Furthermore, in the process of training the anomaly detection model using the industrial control anomaly detection training data set, the back propagation algorithm is used to optimize the parameters of the anomaly detection model.

[0021] Furthermore, in the process of training the anomaly detection model using the industrial control anomaly detection training data set, the fusion training sample f output by the historical fully connected layer i =(d i ,h i-1 ), where d i is the training sample s i For the first training sample input into the anomaly detection model, h i-1 =d i , otherwise, h i-1 It is the historical data obtained by the historical fully connected layer during the last training.

[0022] In a second aspect, the industrial control system anomaly detection system of the present invention comprises:

[0023] The first acquisition module is used to collect network traffic from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic, and obtain sensor data and actuator data reflecting the operating status of the industrial control system at the current moment;

[0024] The detection module is used to input the sensor data and the actuator data into the trained anomaly detection model to obtain the anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer.

[0025] Furthermore, it also includes:

[0026] The first construction module is used to construct an industrial control anomaly detection training data set;

[0027] The second building module is used to build an anomaly detection model;

[0028] The training module is used to train the anomaly detection model using the industrial control anomaly detection training data set to obtain a trained anomaly detection model.

[0029] Furthermore, the first building block includes:

[0030] The second acquisition module is used to collect network traffic samples from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic samples, and obtain sensor data samples and actuator data samples reflecting the operating status of the industrial control system;

[0031] The third construction module is used to construct an industrial control anomaly detection training data set based on the sensor data samples and the actuator data samples. The training samples s in the industrial control anomaly detection training data set t =(d t ,y t ), where d t represents the sensor data sample and actuator data sample at time t, y t Represents a data tag, and the data tag is marked according to whether the industrial control system is abnormal at time t.

[0032] The present invention has the following beneficial effects:

[0033] During specific operation, the industrial control system anomaly detection method and system described in the present invention input the sensor data and actuator data into the trained anomaly detection model to obtain the anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer, and the historical data obtained is fused with the input data using the historical fully connected layer, so that the anomaly detection model can learn the timing characteristics, solve the problem that the industrial control system is difficult to run complex timing detection neural networks in real time due to limited computing power, and can provide the ability to capture timing characteristics without increasing the complexity of the network, so as to improve the real-time and accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a flow chart of the method of the present invention;

[0035] Figure 2 It is a schematic diagram of the anomaly detection model in the present invention;

[0036] Figure 3 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0037] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, not all embodiments, and is not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concepts disclosed in the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0038] The accompanying drawings show schematic diagrams of structures according to embodiments disclosed in the present invention. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0039] The basic idea of ​​the present invention is: in the training data collection stage, the network traffic of the industrial control system is collected, the original traffic is subjected to deep protocol analysis, and the deep analysis data at each moment is obtained. The data is collected continuously until the entire training data set is obtained. In the model training stage, the samples in the training data set are sequentially input into the anomaly detection model based on the memory convolutional neural network, which includes a historical fully connected layer network consistent with the input data. The anomaly detection model performs historical data fusion on the input data, and then performs convolution, pooling, full connection, and Sigmoid operations, and then calculates the loss value of the current training sample, and updates the model parameters according to the training loss. Repeat the above training steps until the model training loss meets the requirements or reaches the maximum number of training iterations, that is, the training of the anomaly detection model is completed. In the anomaly detection stage, the network traffic of the industrial control system is collected in real time, and the original traffic is subjected to deep protocol analysis to obtain the deep analysis data at each moment. The data is input into the trained anomaly model, and the anomaly detection result is output.

[0040] Embodiment 1

[0041] refer to Figure 1 The industrial control system anomaly detection method of the present invention comprises the following steps:

[0042] 1) In the training data collection stage, network traffic samples are collected from the industrial control system in real time, and the network traffic samples are deeply parsed by the industrial control protocol. The values ​​of each field in the industrial control protocol message are extracted one by one according to the protocol specification. At each time t, a set of sensor data samples and actuator data samples reflecting the operating status of the entire industrial control system are obtained. An industrial control anomaly detection training data set is constructed based on the periodically collected sensor data and actuator data, wherein the sensor is used to collect data in the industrial control system, such as temperature and humidity; the actuator is responsible for executing equipment actions, such as motors and switches, and its data reflects the status of the equipment itself.

[0043] It should be noted that the process of constructing an industrial control anomaly detection training data set based on periodically collected sensor data and actuator data is as follows:

[0044] Assume that the sensor data samples and actuator data samples collected periodically are Where N is the total number of sensors and actuators in the industrial control system, and the acquisition period T = t n -t n-1 , generally, T is set to 1 second.

[0045] According to whether the industrial control system is abnormal at time t, t Label the data y t Specifically, when the industrial control system is normal, y t The value is 1, otherwise, y t The value is 0, and the data collected at each time t is d t , get a training sample s at time t t =(d t ,y t ).

[0046] The network traffic of the industrial control system is collected and analyzed periodically until the number of training samples with data labels as abnormal reaches the set threshold, and the industrial control anomaly detection training data set D = {s i ,s i+1 ,s i+2 ...s Z}, where Z is the total number of samples in the training data set D, i∈[1,Z], and the threshold is set to the minimum amount of abnormal sample collection. The larger the threshold, the more abnormal samples there are, and the better the effect of training the anomaly detection model. In this embodiment, the threshold is set to 500.

[0047] 2) Establish an anomaly detection model based on a memory convolutional neural network, and train the anomaly detection model according to the industrial control anomaly detection training data set until the anomaly detection model training loss reaches the set threshold or reaches the maximum number of training times, completing the training of the anomaly detection model. In the model training stage, it is necessary to fully consider the temporal characteristics of the training samples. Therefore, reference Figure 2 In this embodiment, the anomaly detection model based on the memory convolutional neural network includes a historical fully connected layer. By performing data fusion with the input samples, the memory convolutional neural network can learn time series features. At the same time, since it is time series data, there is no need to disrupt the sample order of the training data set before model training.

[0048] As a preferred implementation of this embodiment, refer to Figure 2 The anomaly detection model includes a history fully connected layer, several convolutional layers, several pooling layers, several fully connected layers and a Sigmoid function.

[0049] Step 2) is specifically as follows:

[0050] 21) Select training samples s from the training data set D in sequence i , for training sample s i Perform data fusion.

[0051] As a preferred implementation of this embodiment, the training sample s i The specific steps for data fusion are:

[0052] When i is the first sample in the industrial control anomaly detection training data set. At this time, the anomaly detection model parameters are in a random state, and the historical data of the historical fully connected layer is unavailable. The training sample s i The data vector d in i After channel combination, the fusion training sample f is obtained i =(d i ,d i ).

[0053] When i If it is not the first sample in the industrial control anomaly detection training data set, then the data vector d in the fusion training sample is i After combining the channels with the historical data obtained by the previous historical fully connected layer, the fused training sample f is obtained. i =(d i ,h i-1 ), fusion sample f i The data dimension is 2×1×N, where 2×1×N represents the data sample with 2 channels, a height of 1 and a width of N, and N is the data vector d i Length.

[0054] 22) Constructing the input matrix of the convolution layer through the fused training samples, inputting the input matrix into the convolution layer for feature extraction, and then performing pooling operation through the pooling layer, and then performing data feature integration in the fully connected layer, wherein the fully connected layer includes a historical fully connected layer, the output vector dimension of the historical fully connected layer is the same as the data dimension input to the anomaly detection model, retaining the historical data obtained by the historical fully connected layer for data fusion during the next training sample training, and using the Sigmoid activation function to limit the range of the output value to between 0 and 1 according to the output data of the fully connected layer.

[0055] As a preferred implementation of this embodiment, the process of constructing the input matrix of the convolution layer according to the fused training samples after fusion is as follows:

[0056] Assume the data dimension of the input matrix of the convolutional layer, and fuse the training sample f i Perform data reorganization, that is, fusion training samples f are sequentially i The data in is filled into the input matrix. When the number of data bits is insufficient, the input matrix is ​​filled with 0. In this embodiment, the data dimension of the input matrix is ​​set to Among them, the number of channels C = 2, Represents the floor function.

[0057] 23) Use the binary cross entropy loss function to calculate the loss of a single ensemble training sample, and use the back-propagation algorithm to adjust the parameters of the model.

[0058] As a preferred implementation of this embodiment, the binary cross entropy loss function is:

[0059] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)

[0060] Among them, L(y i ,p) is the binary cross entropy loss function, y i is the data label of the i-th fusion training sample, p is the probability of the anomaly detection model predicting the positive class, p∈[0,1].

[0061] As a preferred implementation of this embodiment, the back propagation algorithm is expressed as:

[0062]

[0063] Among them, ω is the parameter of the anomaly detection model that needs to be adjusted, ω old is the parameter of the previous anomaly detection model, and η is the learning rate, which can usually be set to 0.001.

[0064] 24) Repeat steps 21) to 23) until the training loss of the anomaly detection model reaches the set threshold, or reaches the maximum number of training times. In this embodiment, the maximum number of training times can be set to 200 times to complete the anomaly detection model training.

[0065] 3) In the anomaly detection stage of the industrial control system, network traffic is collected from the industrial control system in real time, and deep industrial control protocol analysis is performed to obtain sensor data and actuator data that reflect the operating status of the entire industrial control system at the current moment. The sensor data and actuator data are input into the trained anomaly detection model. The anomaly detection model automatically completes data fusion, convolution, pooling, full connection, Sigmoid activation and saves historical full connection layer data. Finally, the anomaly detection result is output. When the output of the anomaly detection model is 1, it means that the current industrial control system is operating normally, otherwise, it means that the industrial control system is operating abnormally.

[0066] Confirmatory trials

[0067] In order to verify the effectiveness and superiority of the present invention, some specific cases are provided below:

[0068] An anomaly detection model consisting of three one-dimensional convolutional layers, one two-dimensional maximum pooling layer and three fully connected layers is established. Specifically, the parameter settings of the one-dimensional convolutional layer are shown in Table 1, and the parameter settings of the two-dimensional maximum pooling layer are as follows: the pooling window size is set to 2, the step size is 2, and there is no padding by default. The parameter settings of the fully connected layer are shown in Table 2.

[0069] Table 1

[0070] Convolutional Layer Input Channels Output Channel Convolution kernel size Step Length filling Number of neurons Convolutional layer 1 1 16 4 0 No padding 80 Convolutional Layer 2 16 64 3 1 No padding 3136 Convolutional layer 3 64 128 3 1 No padding 24704

[0071] Table 2

[0072]

[0073]

[0074] The method described in this embodiment improves the accuracy and precision of anomaly detection compared to the traditional convolutional neural network with the same parameters. The traditional convolutional neural network refers to the convolutional neural network in the present invention with the historical fully connected layer removed. The comparison results are shown in Table 3.

[0075] Table 3

[0076] method Accuracy Accuracy This embodiment 0.884 0.892 Traditional Convolutional Neural Network 0.735 0.75

[0077] Embodiment 2

[0078] refer to Figure 3 In a second aspect, the industrial control system anomaly detection system of the present invention comprises:

[0079] The first acquisition module is used to collect network traffic from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic, and obtain sensor data and actuator data reflecting the operating status of the industrial control system at the current moment;

[0080] The detection module is used to input the sensor data and the actuator data into the trained anomaly detection model to obtain the anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer.

[0081] As an embodiment of the present invention, it also includes:

[0082] The first construction module is used to construct an industrial control anomaly detection training data set;

[0083] The second building module is used to build an anomaly detection model;

[0084] The training module is used to train the anomaly detection model using the industrial control anomaly detection training data set to obtain a trained anomaly detection model.

[0085] As an embodiment of the present invention, the first building block includes:

[0086] The second acquisition module is used to collect network traffic samples from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic samples, and obtain sensor data samples and actuator data samples reflecting the operating status of the industrial control system;

[0087] The third construction module is used to construct an industrial control anomaly detection training data set based on the sensor data samples and the actuator data samples. The training samples s in the industrial control anomaly detection training data set t =(d t ,y t ), where d t represents the sensor data sample and actuator data sample at time t, y t Represents a data tag, and the data tag is marked according to whether the industrial control system is abnormal at time t.

[0088] As an implementation manner of the present invention, the loss function in the process of training the anomaly detection model using the industrial control anomaly detection training data set is:

[0089] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)

[0090] Among them, L(y i ,p) is the binary cross entropy loss function, yi is the data label of the i-th fusion training sample, p is the probability of the anomaly detection model predicting the positive class, p∈[0,1].

[0091] As an implementation manner of the present invention, in the process of training the anomaly detection model using the industrial control anomaly detection training data set, the parameters of the anomaly detection model are optimized using a back propagation algorithm.

[0092] As an implementation mode of the present invention, in the process of training the anomaly detection model using the industrial control anomaly detection training data set, the fusion training sample f output by the historical fully connected layer i =(d i ,h i-1 ), where d i is the training sample s i For the first training sample input into the anomaly detection model, h i-1 =d i , otherwise, h i-1 It is the historical data obtained by the historical fully connected layer during the last training.

[0093] Embodiment 3

[0094] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of implementing the industrial control system anomaly detection method include: collecting network traffic from the industrial control system in real time, parsing the collected network traffic through industrial control protocols, and obtaining sensor data and actuator data reflecting the operating state of the industrial control system at the current moment; inputting the sensor data and actuator data into a trained anomaly detection model to obtain an anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0095] Embodiment 4

[0096] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of implementing the industrial control system anomaly detection method include: collecting network traffic from the industrial control system in real time, parsing the collected network traffic by industrial control protocol, and obtaining sensor data and actuator data reflecting the operating state of the industrial control system at the current moment; inputting the sensor data and actuator data into the trained anomaly detection model to obtain the anomaly detection result of the industrial control system at the current moment. Specifically, the computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting anomalies in an industrial control system, characterized in that: include: Collect network traffic from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic, and obtain sensor data and actuator data reflecting the operating status of the industrial control system at the current moment; The sensor data and actuator data are input into the trained anomaly detection model to obtain an anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer.

2. The method for detecting abnormality in an industrial control system according to claim 1, characterized in that: The anomaly detection model includes a historical fully connected layer, a convolutional layer, a pooling layer and a fully connected layer, wherein the historical fully connected layer, the convolutional layer, the pooling layer and the fully connected layer are connected.

3. The method for detecting abnormality in an industrial control system according to claim 1, characterized in that: Before inputting the sensor data and the actuator data into the trained anomaly detection model, the method further includes: Constructing an industrial control anomaly detection training dataset; Build anomaly detection models; The anomaly detection model is trained using the industrial control anomaly detection training data set to obtain a trained anomaly detection model.

4. The method for detecting abnormality in an industrial control system according to claim 3, characterized in that: The process of constructing the industrial control anomaly detection training data set is as follows: Collect network traffic samples from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic samples, and obtain sensor data samples and actuator data samples reflecting the operating status of the industrial control system; An industrial control anomaly detection training data set is constructed based on the sensor data samples and the actuator data samples. The training samples s in the industrial control anomaly detection training data set are t =(d t ,y t ), where d t represents the sensor data sample and actuator data sample at time t, y t Represents a data tag, and the data tag is marked according to whether the industrial control system is abnormal at time t.

5. The method for detecting abnormality in an industrial control system according to claim 3, characterized in that: The loss function in the process of training the anomaly detection model using the industrial control anomaly detection training data set is: L(and i ,p)=-y i log(p)-(1-y i )log(1-p) Among them, L(y i ,p) is the binary cross entropy loss function, y i is the data label of the i-th fusion training sample, p is the probability of the anomaly detection model predicting the positive class, p∈[0,1].

6. The method for detecting abnormality in an industrial control system according to claim 3, characterized in that: In the process of training the anomaly detection model using the industrial control anomaly detection training data set, the back propagation algorithm is used to optimize the parameters of the anomaly detection model.

7. The method for detecting abnormality in an industrial control system according to claim 1, characterized in that: In the process of training the anomaly detection model using the industrial control anomaly detection training data set, the fusion training sample f output by the historical fully connected layer i =(d i ,h i-1 ), where d i is the training sample s i For the first training sample input into the anomaly detection model, h i-1 =d i , otherwise, h i-1 It is the historical data obtained by the historical fully connected layer during the last training.

8. An industrial control system anomaly detection system, characterized in that: include: The first acquisition module is used to collect network traffic from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic, and obtain sensor data and actuator data reflecting the operating status of the industrial control system at the current moment; The detection module is used to input the sensor data and the actuator data into the trained anomaly detection model to obtain the anomaly detection result of the industrial control system at the current moment, wherein the anomaly detection model includes a historical fully connected layer.

9. The industrial control system anomaly detection system according to claim 8, characterized in that: Also includes: The first construction module is used to construct an industrial control anomaly detection training data set; The second building module is used to build an anomaly detection model; The training module is used to train the anomaly detection model using the industrial control anomaly detection training data set to obtain a trained anomaly detection model.

10. The industrial control system anomaly detection system according to claim 9, characterized in that: The first building block comprises: The second acquisition module is used to collect network traffic samples from the industrial control system in real time, perform industrial control protocol analysis on the collected network traffic samples, and obtain sensor data samples and actuator data samples reflecting the operating status of the industrial control system; The third construction module is used to construct an industrial control anomaly detection training data set based on the sensor data samples and the actuator data samples. The training samples s in the industrial control anomaly detection training data set t =(d t ,y t ), where d t represents the sensor data sample and actuator data sample at time t, y t Represents a data tag, and the data tag is marked according to whether the industrial control system is abnormal at time t.

Images