Industrial control system anomaly detection method and system based on modal difference
By adopting a multimodal model fusion method based on modal difference in industrial control systems, using the correlation and difference of multimodal data for abnormal detection, the problem of low detection accuracy in the prior art is solved, and high accuracy is achieved abnormal detection and reduce false alarm rate.
Patent Information
- Application Number
- CN202411522735.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2024-08-23
- Filing Date
- 2024-10-29
- Publication Date
- 2025-02-07
AI Technical Summary
The existing industrial control system anomaly detection methods based on deep learning fail to effectively utilize the correlation between multimodal data, resulting in low detection accuracy and missed or false alarms.
Using a multimodal model fusion method based on modal difference, the network traffic of the industrial control system is collected in real time, multimodal data is generated, and the multimodal model is constructed using the trained sensor and actuator anomaly detection model, and the model is comprehensively considered The correlation and difference of state data are detected abnormally.
It improves the abnormal detection accuracy of industrial control systems, reduces the false alarm rate, and can more accurately identify abnormal behaviors of the system, so as to take timely measures to prevent accidents.
Smart Images
Figure CN119396119A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of industrial control system safety, and relates to an industrial control system anomaly detection method and system based on modal difference. Background Art
[0002] Industrial Control Systems (ICS) are key components in modern industrial production processes. They are responsible for monitoring and controlling manufacturing processes, energy distribution, traffic management systems, etc. With the rise of Industry 4.0 and smart manufacturing, the security of ICS has become increasingly important, as any system failure or anomaly may lead to production interruptions, economic losses, and even threaten personnel safety. Therefore, anomaly detection plays a vital role in ICS, which can identify abnormal behaviors of the system in real time, so that timely measures can be taken to prevent accidents.
[0003] Existing ICS anomaly detection methods mainly include rule-based detection, machine learning-based detection, and physical model-based detection. Rule-based detection relies on pre-defined rules to identify anomalies, but these rules often fail to cover all abnormal situations and have limited processing capabilities for the nonlinear characteristics of complex systems. Machine learning-based methods, such as support vector machines, decision trees, and neural networks, build models by learning data from normal operations to identify abnormal behaviors. However, these methods usually only consider a single type of data and ignore the multimodal characteristics present in ICS. For example, an industrial process may generate multiple data streams such as temperature, pressure, and vibration at the same time, and there are inherent connections and complementarities between these data streams. Due to the lack of full utilization of the associations between multimodal data, single-modal anomaly detection methods may not achieve ideal detection accuracy in practical applications, resulting in missed or false positives. Summary of the invention
[0004] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide an industrial control system anomaly detection method and system based on modal difference, which can accurately detect whether the industrial control system is abnormal.
[0005] In a first aspect, the method for detecting anomalies in an industrial control system based on modal differences according to the present invention comprises:
[0006] Collect network traffic in the industrial control system at time t in real time, and generate multimodal data (s t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t;
[0007] The multimodal data (s t1 ,a t1 ) is input to the multimodal model In the above example, the abnormality detection result of the industrial control system at time t is obtained.
[0008] Furthermore, the multimodal data (s t1 ,a t1 ) is input to the multimodal model Previously also included:
[0009] Get the trained sensor anomaly detection model And the trained actuator anomaly detection model
[0010] Based on the trained sensor anomaly detection model And the trained actuator anomaly detection model Building a multimodal model
[0011] Furthermore, the sensor anomaly detection model after training is obtained. And the trained actuator anomaly detection model The process is:
[0012] Collect network traffic samples from industrial control systems, parse the industrial control protocol data in the network traffic samples, and obtain the operation data samples of the industrial control system in each collection cycle;
[0013] According to different modes, the operation data samples of the industrial control system are divided into several sensor data samples and several actuator data samples;
[0014] Construct a training data set D based on each sensor data sample sen ;
[0015] Construct a training data set D based on the data samples of each actuator act ;
[0016] Build sensor anomaly detection model and actuator anomaly detection model;
[0017] Using the training data set D sen The sensor anomaly detection model is trained to obtain a trained sensor anomaly detection model.
[0018] Using the training data set D act The actuator anomaly detection model is trained to obtain a trained actuator anomaly detection model.
[0019] Furthermore, the multimodal data (s t1 ,a t1 ) is input to the multimodal model The abnormal detection result d of the industrial control system at time t is obtained r for:
[0020]
[0021] Among them, d v is the abnormality degree of the industrial control system.
[0022] Furthermore, the abnormality degree of the industrial control system d v for:
[0023]
[0024] Among them, α is a hyperparameter, and is the probability that the model predicts that the input sample is abnormal, and v is the modal difference.
[0025] Furthermore, the modal difference v is:
[0026]
[0027] Among them, f diff (i) represents the i-th value of the difference vector, and Z is the trained sensor anomaly detection model And the trained actuator anomaly detection model The length of the vector output by the Softmax layer.
[0028] Furthermore, the ith value f of the difference vector diff (i) is:
[0029]
[0030] in, Represents the trained sensor anomaly detection model Softmax layer f 1 The output vector of Represents the trained actuator anomaly detection model Softmax layer f 2 The output vector of .
[0031] In a second aspect, the industrial control system anomaly detection system based on modal difference of the present invention comprises:
[0032] The acquisition module is used to collect the network traffic in the industrial control system at time t in real time, and generate multimodal data (s) at time t according to the network traffic in the industrial control system at time t. t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t;
[0033] A judgment module is used to convert the multimodal data (s t1 ,a t1 ) is input to the multimodal model In the above example, the abnormality detection result of the industrial control system at time t is obtained.
[0034] Furthermore, it also includes:
[0035] Acquisition module, used to obtain the trained sensor anomaly detection model And the trained actuator anomaly detection model
[0036] The first building block is used to detect anomaly of the sensor based on the trained sensor anomaly detection model. And the trained actuator anomaly detection model Building a multimodal model
[0037] Furthermore, the acquisition module includes:
[0038] The acquisition module is used to collect network traffic samples in the industrial control system, parse the industrial control protocol data in the network traffic samples, and obtain the operation data samples of the industrial control system in each acquisition cycle;
[0039] A classification module, used for classifying the operation data samples of the industrial control system into a number of sensor data samples and a number of actuator data samples according to different modes;
[0040] The second building module is used to build a training data set D based on each sensor data sample. sen ;
[0041] The third construction module is used to construct a training data set D based on the data samples of each actuator. act ;
[0042] The fourth building module is used to build a sensor anomaly detection model and an actuator anomaly detection model;
[0043] The first training module is used to use the training data set D sen The sensor anomaly detection model is trained to obtain a trained sensor anomaly detection model.
[0044] The second training module is used to use the training data set D act The actuator anomaly detection model is trained to obtain a trained actuator anomaly detection model.
[0045] The present invention has the following beneficial effects:
[0046] The industrial control system anomaly detection method and system based on modal difference described in the present invention utilize the multimodal characteristics of data in the industrial control system during specific operation, consider the multimodal data within the anomaly detection range, and simultaneously consider the modal data association and difference of the industrial control system, and utilize the multimodal model to perform anomaly detection, thereby solving the problem that the existing industrial control anomaly detection method based on deep learning does not distinguish the modal characteristics of different data and the relationship between modalities, resulting in low anomaly detection accuracy, and realizes the ability of high-precision model anomaly detection, while having the characteristic of low false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:
[0048] Figure 1 is a flow chart of the method of the present invention;
[0049] Figure 2 It is a system structure diagram of the present invention. DETAILED DESCRIPTION
[0050] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, not all embodiments, and is not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concepts disclosed in the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.
[0051] The accompanying drawings show schematic diagrams of structures according to embodiments disclosed in the present invention. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.
[0052] The basic idea of the present invention is to periodically collect network traffic in industrial control systems, perform protocol analysis and modal classification on the industrial control protocol data therein, and form a multimodal training data set D sen and D act Using the training dataset D sen Train a pre-designed convolutional neural network Get the trained sensor anomaly detection model Using the training dataset D act Train a pre-designed convolutional neural network Get the trained actuator anomaly detection model The model and Perform modal fusion based on modal difference, and the Softmax layers of the two models are divided into f 1 and f 2 The difference of the outputs constitutes the modal difference vector f diff According to the modal difference vector f diff , Softmax layer f 1 and f 2 The output vector result of is calculated comprehensively to obtain the anomaly detection result. The above structure constitutes a multimodal model Collect network traffic in industrial control systems in real time and generate multimodal data at time t (s t ,a t ), and input into the multimodal model The model output 1 represents that the current industrial control system is normal, and the output 0 represents an abnormality. The present invention utilizes the multimodal characteristics of data in industrial control systems. It not only considers multimodal data within the scope of abnormality detection, but also considers the association and difference of modal data of industrial control systems, and designs a multimodal model fusion method based on modal difference. It solves the problem that the existing industrial control anomaly detection method based on deep learning does not distinguish the modal characteristics of different data and the relationship between modalities, resulting in low anomaly detection accuracy. It provides an industrial control system anomaly detection method based on modal difference.
[0053] Embodiment 1
[0054] refer to Figure 1 The industrial control system anomaly detection method based on modal difference of the present invention comprises the following steps:
[0055] 1) Collect network traffic samples from industrial control systems, parse the industrial control protocol data in the network traffic samples, and obtain the operation data samples of the industrial control system in each collection cycle.
[0056] 2) According to different modes, the operation data samples of the industrial control system are divided into sensor data samples and actuator data samples. Among them, the sensor data samples obtained in each acquisition cycle t N is the total number of sensors in the industrial control system, and the actuator data samples obtained in each acquisition cycle t M is the total number of actuators in the industrial control system, y t Indicates the operating status of the industrial control system at time t, 1 indicates normal and 0 indicates abnormal.
[0057] 3) Repeat steps 1) and 2) until the number of sensor data samples and actuator data samples reaches the maximum number of collected data, P, and then construct two training data sets D of different modes based on all collected sensor data samples and actuator data samples. sen and D act , where D sen ={s 1 ,s 2 ...s P}, D act ={a 1 ,a 2 ...a P}.
[0058] 4) Use training dataset D sen Training a sensor anomaly detection model Get the trained sensor anomaly detection model Among them, the sensor anomaly detection model It is built based on convolutional neural network.
[0059] 41) From the training data set D sen Select training samples s in sequence i , the data vector part The input convolution layer is used for feature extraction, followed by pooling in the pooling layer. According to the output of the last pooling layer, the Sigmoid activation function is used to limit the range of the output value to between 0 and 1.
[0060] 42) Use the binary cross entropy loss function to calculate the loss of a single sample, specifically:
[0061] L(y i,p)=-y i log(p)-(1-y i )log(1-p)
[0062] Among them, p is the probability of the model predicting the positive class, and its value range is [0,1], and y i is the label of the ith sample.
[0063] 43) Use the back gradient propagation algorithm to adjust the model parameters ω, specifically:
[0064]
[0065] Among them, ω old is the model parameter of the previous time, η is the learning rate, and in this embodiment it is taken as 0.001.
[0066] 44) Repeat steps 41) to 43) until the model training loss reaches the requirement or the maximum number of training iterations reaches 200, and the trained sensor anomaly detection model is obtained.
[0067] 5) Follow the steps in step 4) and use the training dataset D act Training the Actuator Anomaly Detection Model Get the trained actuator anomaly detection model The actuator anomaly detection model It is built based on convolutional neural network.
[0068] 6) Use the trained sensor anomaly detection model and the trained actuator anomaly detection model Perform modal fusion based on modal difference. The Softmax layers of the two models are f 1 and f 2 , through f 1 and f 2 The output difference constitutes the modal difference vector f diff , according to the modal difference vector f diff , Softmax layer f 1 and f 2 The output vector result of is calculated comprehensively to obtain the anomaly detection result. The above structure constitutes a multimodal model
[0069] 61) Modal difference vector f diff for:
[0070]
[0071] in, represents the Softmax layer f 1The output vector of represents the Softmax layer f 2 The output vector of .
[0072] 62) The modal difference v is calculated according to the modal difference vector:
[0073]
[0074] Among them, f diff (i) represents the i-th value of the difference vector, and Z is the length of the vector output by the Softmax layers of the two models, which is 2 in this embodiment.
[0075] 63) According to the modal difference vector f diff , fully connected layer f 1 and f 2 The output vector result of the industrial control system is calculated comprehensively to obtain the abnormality degree d v for:
[0076]
[0077] Among them, α is a hyperparameter, which is set to 0.3 in this embodiment. and Predict the probability that the input sample is an anomaly for the model.
[0078] 64) According to the abnormality degree of industrial control system d v Calculate the final anomaly detection result d r for:
[0079]
[0080] 7) According to the method described in step 1) and step 2), the network traffic in the industrial control system is collected in real time to generate multimodal data (s) at time t t1 ,a t1 ).
[0081] 8) The multimodal data at time t (s t1 ,a t1 ) Input multimodal model In the anomaly detection results, the multimodal model Output 1 means the current industrial control system is normal, and the multimodal model If the output is 0, the current industrial control system is abnormal.
[0082] Embodiment 2
[0083] refer to Figure 2 The industrial control system anomaly detection system based on modal difference of the present invention comprises:
[0084] The acquisition module is used to collect the network traffic in the industrial control system at time t in real time, and generate multimodal data (s) at time t according to the network traffic in the industrial control system at time t. t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t;
[0085] A judgment module is used to convert the multimodal data (s t1 ,a t1 ) is input to the multimodal model In the above example, the abnormality detection result of the industrial control system at time t is obtained.
[0086] As an embodiment of the present invention, it also includes:
[0087] Acquisition module, used to obtain the trained sensor anomaly detection model And the trained actuator anomaly detection model
[0088] The first building block is used to detect anomaly of the sensor based on the trained sensor anomaly detection model. And the trained actuator anomaly detection model Building a multimodal model
[0089] As an implementation manner of the present invention, the acquisition module includes:
[0090] The acquisition module is used to collect network traffic samples in the industrial control system, parse the industrial control protocol data in the network traffic samples, and obtain the operation data samples of the industrial control system in each acquisition cycle;
[0091] A classification module, used for classifying the operation data samples of the industrial control system into a number of sensor data samples and a number of actuator data samples according to different modes;
[0092] The second building module is used to build a training data set D based on each sensor data sample. sen ;
[0093] The third construction module is used to construct a training data set D based on the data samples of each actuator. act ;
[0094] The fourth building module is used to build a sensor anomaly detection model and an actuator anomaly detection model;
[0095] The first training module is used to use the training data set D senThe sensor anomaly detection model is trained to obtain a trained sensor anomaly detection model.
[0096] The second training module is used to use the training data set D act The actuator anomaly detection model is trained to obtain a trained actuator anomaly detection model.
[0097] As an implementation mode of the present invention, the multimodal data (s t1 ,a t1 ) is input to the multimodal model The abnormal detection result d of the industrial control system at time t is obtained r for:
[0098]
[0099] Among them, d v is the abnormality degree of the industrial control system.
[0100] As an embodiment of the present invention, the abnormality degree of the industrial control system d v for:
[0101]
[0102] Among them, α is a hyperparameter, and is the probability that the model predicts that the input sample is abnormal, and v is the modal difference.
[0103] As an implementation manner of the present invention, the modal difference v is:
[0104]
[0105] Among them, f diff (i) represents the i-th value of the difference vector, and Z is the trained sensor anomaly detection model And the trained actuator anomaly detection model The length of the vector output by the Softmax layer.
[0106] As an implementation mode of the present invention, the ith value f of the difference vector diff (i) is:
[0107]
[0108] in, Represents the trained sensor anomaly detection model Softmax layer f 1 The output vector of Represents the trained actuator anomaly detection model Softmax layer f 2 The output vector of .
[0109] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.
[0110] Embodiment 3
[0111] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of implementing the method for detecting abnormalities in an industrial control system based on modal differences include: collecting network traffic in the industrial control system at time t in real time, generating multimodal data (s) at time t according to the network traffic in the industrial control system at time t t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t; the multimodal data (s t1 ,a t1 ) is input to the multimodal model The abnormality detection result of the industrial control system at time t is obtained. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard structure bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.
[0112] Embodiment 4
[0113] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of implementing the method for detecting abnormalities in an industrial control system based on modal differences include: collecting network traffic in the industrial control system at time t in real time, generating multimodal data (s) at time t according to the network traffic in the industrial control system at time t t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t; the multimodal data (s t1 ,a t1 ) is input to the multimodal model In the embodiment of the present invention, the abnormality detection result of the industrial control system at time t is obtained. Specifically, the computer-readable storage medium includes, but is not limited to, for example, a volatile memory and / or a non-volatile memory. The volatile memory may include a random access memory (RAM) and / or a cache memory (cache), etc. The non-volatile memory may include a read-only memory (ROM), a hard disk, a flash memory, an optical disk, a magnetic disk, etc.
[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A method for detecting abnormality in an industrial control system based on modal difference, characterized in that: include: Collect network traffic in the industrial control system at time t in real time, and generate multimodal data (s t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t; The multimodal data (s t1 ,a t1 ) is input to the multimodal model In the above example, the abnormality detection result of the industrial control system at time t is obtained.
2. The method for detecting anomalies in an industrial control system based on modal difference according to claim 1, characterized in that: The multimodal data (s t1 ,a t1 ) is input to the multimodal model Previously also included: Get the trained sensor anomaly detection model And the trained actuator anomaly detection model Based on the trained sensor anomaly detection model And the trained actuator anomaly detection model Building a multimodal model 3. The method for detecting anomalies in an industrial control system based on modal difference according to claim 2, characterized in that: The sensor anomaly detection model after training is obtained And the trained actuator anomaly detection model The process is: Collect network traffic samples from industrial control systems, parse the industrial control protocol data in the network traffic samples, and obtain the operation data samples of the industrial control system in each collection cycle; According to different modes, the operation data samples of the industrial control system are divided into several sensor data samples and several actuator data samples; Construct a training data set D based on each sensor data sample sen ; Construct a training data set D based on the data samples of each actuator act ; Build sensor anomaly detection model and actuator anomaly detection model; Using the training data set D sen The sensor anomaly detection model is trained to obtain a trained sensor anomaly detection model. Using the training data set D act The actuator anomaly detection model is trained to obtain a trained actuator anomaly detection model.
4. The method for detecting anomalies in an industrial control system based on modal difference according to claim 2, characterized in that: The multimodal data (s t1 ,a t1 ) is input to the multimodal model The abnormal detection result d of the industrial control system at time t is obtained r for: Among them, d v is the abnormality degree of the industrial control system.
5. The method for detecting anomalies in an industrial control system based on modal difference according to claim 4, characterized in that: The abnormality degree of the industrial control system d v for: Among them, α is a hyperparameter, and is the probability that the model predicts that the input sample is abnormal, and v is the modal difference.
6. The method for detecting anomalies in an industrial control system based on modal difference according to claim 5, characterized in that: The modal difference v is: Among them, f diff (i) represents the i-th value of the difference vector, and Z is the trained sensor anomaly detection model And the trained actuator anomaly detection model The length of the vector output by the Softmax layer.
7. The method for detecting anomalies in an industrial control system based on modal difference according to claim 6, characterized in that: The i-th value f of the difference vector diff (i) is: in, Represents the trained sensor anomaly detection model The output vector of the Softmax layer f1, Represents the trained actuator anomaly detection model The output vector of the Softmax layer f2 in .
8. An industrial control system anomaly detection system based on modal difference, characterized in that: include: The acquisition module is used to collect the network traffic in the industrial control system at time t in real time, and generate multimodal data (s) at time t according to the network traffic in the industrial control system at time t. t1 ,a t1 ), where s t1 is the sensor data at time t, a t1 is the actuator data at time t; A judgment module is used to convert the multimodal data (s t1 ,a t1 ) is input to the multimodal model In the above example, the abnormality detection result of the industrial control system at time t is obtained.
9. The industrial control system anomaly detection system based on modal difference according to claim 8, characterized in that: Also includes: Acquisition module, used to obtain the trained sensor anomaly detection model And the trained actuator anomaly detection model The first building block is used to detect anomaly of the sensor based on the trained sensor anomaly detection model. And the trained actuator anomaly detection model Building a multimodal model 10. The industrial control system anomaly detection system based on modal difference according to claim 9, characterized in that: The acquisition module comprises: The acquisition module is used to collect network traffic samples in the industrial control system, parse the industrial control protocol data in the network traffic samples, and obtain the operation data samples of the industrial control system in each acquisition cycle; A classification module, used for classifying the operation data samples of the industrial control system into a number of sensor data samples and a number of actuator data samples according to different modes; The second building module is used to build a training data set D based on each sensor data sample. sen ; The third construction module is used to construct a training data set D based on the data samples of each actuator. act ; The fourth building module is used to build a sensor anomaly detection model and an actuator anomaly detection model; The first training module is used to use the training data set D sen The sensor anomaly detection model is trained to obtain a trained sensor anomaly detection model. The second training module is used to use the training data set D act The actuator anomaly detection model is trained to obtain a trained actuator anomaly detection model.