Industrial control system anomaly detection method and system based on receptive field enhancement
By collecting and analyzing network traffic data in an industrial control system, performing correlation enhancement operations to build a comprehensive matrix, and inputting it into the trained convolutional neural network model, the problem of receptive field and detection accuracy trade-off is solved, and high accuracy is achieved rate and low complexity abnormal detection effect.
Patent Information
- Application Number
- CN202411522736.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2024-08-23
- Filing Date
- 2024-10-29
- Publication Date
- 2025-02-07
AI Technical Summary
When using convolutional neural networks to detect abnormalities in industrial control systems, the trade-off between the model's receptive field and detection accuracy leads to high complexity of the model, difficulty in training, and possible overfitting.
By collecting network traffic data from industrial control systems, performing protocol analysis and association enhancement operations, building a comprehensive matrix, and inputting it into the trained convolutional neural network model for abnormal detection. This method reduces the complexity of the model and improves the receptive field through correlation enhancement operations.
It realizes that while maintaining detection accuracy, it reduces the calculation amount and model complexity, avoids overfitting, and improves the accuracy of abnormal detection in industrial control systems.
Smart Images
Figure CN119396120A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of industrial control system safety, and relates to an industrial control system anomaly detection method and system based on receptive field enhancement. Background Art
[0002] Industrial Control Systems (ICS) play a vital role in modern society. They are the basis for the normal operation of industrial production and social infrastructure. The stability and security of ICS directly affect production efficiency and public safety. However, due to factors such as equipment aging, operating errors, and environmental changes, various anomalies may occur in ICS. If these anomalies are not detected and properly handled in a timely manner, they may cause equipment failures, production accidents, and even threaten personnel safety. Therefore, anomaly detection in ICS is of vital importance to ensure the continuity and safety of industrial production. By real-time monitoring and analysis of system data, anomaly detection technology can detect potential risks in a timely manner and issue early warnings, thereby reducing the possibility of accidents and improving system reliability and operational efficiency.
[0003] As a deep learning technology, convolutional neural networks (CNN) have achieved remarkable results in image recognition, speech recognition and other fields, and have also shown great potential in anomaly detection in industrial control systems. CNN can automatically learn data features and extract effective feature representations through multi-layer convolution and pooling operations, thereby improving the accuracy and efficiency of anomaly detection. However, there is a key challenge when using CNN for anomaly detection: the trade-off between the receptive field of the model and the detection accuracy. The receptive field refers to the size of the input data area that each neuron in the neural network can cover. A larger receptive field can capture a wider range of data features, thereby improving detection accuracy. However, increasing the receptive field usually means increasing the number of layers and complexity of the network, which will increase the difficulty of model training, increase computing resource consumption, and even may cause overfitting. Therefore, how to reasonably design the receptive field of the network while ensuring detection accuracy is an important issue that needs to be solved in the current research on industrial control anomaly detection based on CNN. Summary of the invention
[0004] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide an industrial control system anomaly detection method and system based on receptive field enhancement, which can improve the detection accuracy while requiring relatively less calculation.
[0005] In a first aspect, the method for detecting anomalies in an industrial control system based on enhanced receptive field according to the present invention comprises:
[0006] Collect network traffic in the industrial control system to obtain network data packets, perform protocol analysis on the network data packets, and obtain data of all sensors and actuators in the industrial control system at the current moment;
[0007] Performing an association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and constructing a comprehensive matrix based on the results of the association enhancement operation;
[0008] The comprehensive matrix is input into the trained industrial control system anomaly detection model to determine whether the operation of the industrial control system is abnormal at the current moment.
[0009] Furthermore, before inputting the comprehensive matrix into the trained industrial control system anomaly detection model, the method further includes:
[0010] Build a training dataset;
[0011] Building an anomaly detection model for industrial control systems based on convolutional neural networks;
[0012] The industrial control system anomaly detection model is trained using the training data set to obtain a trained industrial control system anomaly detection model.
[0013] Furthermore, the process of constructing the training data set is:
[0014] Collect network traffic in the industrial control system to obtain network data packet samples, perform protocol analysis on the network data packet samples, and obtain data samples of all sensors and actuators in the industrial control system;
[0015] Classifying data samples of all sensors and actuators in the industrial control system, and constructing a number of unit coding vectors according to the classification results, wherein the data contained in the unit coding vectors include corresponding types and data samples corresponding to the types;
[0016] The unit code vector is shuffled three times continuously to obtain a random unit code matrix Z1, a random unit code matrix Z2 and a random unit code matrix Z3 respectively;
[0017] The comprehensive matrix sample E is constructed according to the random unit coding matrix Z1, the random unit coding matrix Z2 and the random unit coding matrix Z3. t , based on the comprehensive matrix sample E t and the label y of the data sample t , construct a training dataset D.
[0018] Furthermore, the unit code vector is shuffled three times continuously using the Fisher-Yates shuffling algorithm.
[0019] Furthermore, in the process of training the industrial control system anomaly detection model using the training data set, a reverse gradient propagation algorithm is used to adjust the parameters of the industrial control system anomaly detection model.
[0020] Furthermore, the loss function in the process of training the industrial control system anomaly detection model using the training data set is:
[0021] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)
[0022] Among them, p is the probability that the model predicts that the current system is running normally, y i is the label of the i-th training sample in the training dataset.
[0023] In a second aspect, the industrial control system anomaly detection system based on receptive field enhancement described in the present invention includes:
[0024] The first acquisition module is used to collect network traffic in the industrial control system, obtain network data packets, perform protocol analysis on the network data packets, and obtain data of all sensors and actuators in the industrial control system at the current moment;
[0025] An association enhancement operation module, used to perform an association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and to construct a comprehensive matrix through the results of the association enhancement operation;
[0026] The judgment module is used to input the comprehensive matrix into the trained industrial control system anomaly detection model to judge whether the operation of the industrial control system is abnormal at the current moment.
[0027] Furthermore, it also includes:
[0028] The first building module is used to build a training data set;
[0029] The second building block is used to build an industrial control system anomaly detection model based on a convolutional neural network;
[0030] The training module is used to train the industrial control system anomaly detection model using the training data set to obtain a trained industrial control system anomaly detection model.
[0031] Furthermore, the first building block includes:
[0032] The second acquisition module is used to collect network traffic in the industrial control system, obtain network data packet samples, perform protocol analysis on the network data packet samples, and obtain data samples of all sensors and actuators in the industrial control system;
[0033] A classification module, used to classify data samples of all sensors and actuators in the industrial control system, and construct a number of unit coding vectors according to the classification results, wherein the data contained in the unit coding vectors include a corresponding type and a data sample corresponding to the type;
[0034] A scrambling module, used for scrambling the unit code vector three times continuously to obtain a random unit code matrix Z1, a random unit code matrix Z2 and a random unit code matrix Z3 respectively;
[0035] The third construction module is used to construct a comprehensive matrix sample E according to the random unit coding matrix Z1, the random unit coding matrix Z2 and the random unit coding matrix Z3. t , based on the comprehensive matrix sample E t and the label y of the data sample t , construct a training dataset D.
[0036] Furthermore, the unit code vector is shuffled three times continuously using the Fisher-Yates shuffling algorithm.
[0037] The present invention has the following beneficial effects:
[0038] The industrial control system anomaly detection method and system based on receptive field enhancement described in the present invention performs association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and constructs a comprehensive matrix through the results of the association enhancement operation; wherein, the use of the association enhancement operation can solve the problem that the traditional convolutional neural network requires a deeper network to have a stronger receptive field, resulting in high model complexity and difficulty in training, and has the characteristics of providing a larger receptive field and high model anomaly detection accuracy under a low-complexity convolutional neural network. In addition, the comprehensive matrix is input into the trained industrial control system anomaly detection model to determine whether the operation of the industrial control system at the current moment is abnormal, so as to realize the operation anomaly detection of the industrial control system, and the anomaly detection accuracy is high. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] Figure 1 is a flow chart of the method of the present invention;
[0040] Figure 2 It is a system structure diagram of the present invention. DETAILED DESCRIPTION
[0041] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, not all embodiments, and is not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concepts disclosed in the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.
[0042] The accompanying drawings show schematic diagrams of structures according to embodiments disclosed in the present invention. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.
[0043] The basic idea of the present invention is to collect network traffic in the industrial control system, obtain network data packets of industrial control protocols such as Modbus and IEC104, perform protocol parsing on the network data packets, obtain data of all sensors and actuators in the industrial control system at time t, classify, encode, shuffle and splice the data of all sensors and actuators according to device types and categories of measured or controlled physical quantities to form several comprehensive matrices; determine the sample label y according to the operating status of the industrial control system at time t t , each comprehensive matrix and its corresponding sample label y t Combine to obtain a training data set, and use the training data set to train a convolutional neural network During the training, the binary cross entropy loss function is used to calculate the loss of a single sample, and the reverse gradient propagation algorithm is used to adjust the model parameter ω. As an anomaly detection model for industrial control systems During detection, the data S of all sensors and actuators in the industrial control system at the current time t are collected. t Convert to comprehensive matrix E t , and the comprehensive matrix E t Input to the trained industrial control system anomaly detection model In the case of anomaly detection models in industrial control systems If the output is 1, it means that the current industrial control system is operating normally, otherwise, it means that the current industrial control system is operating abnormally. It should be noted that the present invention uses the collected data association enhancement method to pre-process the collected data, so that the convolutional neural network model with a shallower depth can learn more data associations and have a stronger receptive field for the input data, which solves the problem that the traditional convolutional neural network requires a deeper network to have a stronger receptive field, resulting in high model complexity and difficulty in training.
[0044] Embodiment 1
[0045] like Figure 1 As shown, the industrial control system anomaly detection method based on receptive field enhancement of the present invention comprises the following steps:
[0046] 1) Collect network traffic in the industrial control system and obtain network data packets of industrial control protocols such as Modbus and IEC104. Perform protocol parsing on the network data packets to obtain data samples of all sensors and actuators in the industrial control system at time t in, is the value of the i-th device in the industrial control system, and N is the total number of sensors and actuators in the current industrial control system.
[0047] 2) The sensor and actuator data collected at time t are classified according to the device type and the category of the physical quantity measured or controlled. The specific device classification method is shown in Table 1:
[0048] Table 1
[0049]
[0050] 3) According to the device classification method, similar devices in the collected data are merged into unit coding vectors. Specifically, the data contained in each unit coding vector is composed of data samples of the corresponding device type and the corresponding device for measuring or controlling physical quantities.
[0051] 4) The first byte of the unit code vector is the data code corresponding to the type of physical quantity measured or controlled by the device. The subsequent data consists of all the collected data of the device of the current category in the collected data. When the number of collected data is less than P, 0x00 is used to fill the remaining position of the unit code vector. P is the longest unit code vector length in the industrial control system.
[0052] 5) The unit coding vector representation of the pressure sensor is shown in Table 2:
[0053] Table 2
[0054]
[0055] 6) Arrange the unit code vectors in the order of Table 1 to form a unit code matrix Z: 10×P, where Z is a matrix with 10 rows and P columns, and P is the longest unit code vector length in the industrial control system. There are 10 device types in total, so the number of matrix rows is 10.
[0056] 7) Using the Fisher-Yates shuffle algorithm, shuffle the data of the unit code matrix Z with the unit code vector as the unit to obtain a random unit code matrix Z1.
[0057] 8) Using the Fisher-Yates shuffle algorithm, shuffle the data of the unit code matrix Z1 with the unit code vector as the unit to obtain the random unit code matrix Z2.
[0058] 9) Using the Fisher-Yates shuffle algorithm, the unit code matrix Z2 is shuffled with the unit code vector as the unit to obtain a random unit code matrix Z3.
[0059] 10) Specifically, the Fisher-Yates shuffling algorithm described in step 7), step 8), and step 9) is based on the unit code vector. What needs to be disrupted is the position of the row where the different unit code vectors are located in the unit code matrix. The original matrix represents the unit code matrix that needs to be disrupted, and the target matrix represents the random unit code matrix obtained after disrupting the original matrix. The specific steps are:
[0060] 10-1) Randomly select a unit code vector from the original matrix and move it to the last row of the target matrix;
[0061] 10-2) Randomly select a unit code vector from the remaining unit code vectors in the original matrix and move it to the last row of the target matrix;
[0062] 10-3) Repeat steps 10-1) to 10-2) until all unit coding vectors in the original matrix are moved to the target matrix, and the target matrix is the random unit coding matrix.
[0063] 11) The three random unit coding matrices Z1, Z2, and Z3 obtained from step 7), step 8) and step 9) are channel-concatenated to form a comprehensive matrix E with a dimension of 3×10×P, wherein steps 1) to 9) are called acquisition data association enhancement operations.
[0064] 12) Repeat steps 1) to 11), and then obtain the comprehensive matrix sample E at time t according to the data of sensors and actuators collected at each time t t , combined with the label y of the data sample t , construct training data set D = {(S t ,y t),(S t+1 ,y t+1 )...(S t+N ,y t+N )}, where N is the total number of samples in the data set, y t is the operating state of the industrial control system at time t. When the operating state is normal, y t is 1, otherwise, y t is 0.
[0065] 13) Use the training dataset to train the industrial control system anomaly detection model Anomaly Detection Model for Industrial Control Systems Based on the convolutional neural network model, the model can be a model with a shallow model depth and a small number of convolutional layers. Due to the data association enhancement operation on the training data, the convolutional neural network model with a shallow depth can learn more data associations and have a stronger receptive field for the input data.
[0066] 14) During the model training process, the binary cross entropy loss function is used to calculate the loss of a single sample, and the reverse gradient propagation algorithm is used to adjust the model parameters ω, where the loss of a single sample is:
[0067] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)
[0068] Among them, p is the probability that the model predicts that the current system is running normally, and its value range is [0,1]. i is the label of the i-th training sample in the training dataset.
[0069] Use the back gradient propagation algorithm to adjust the model parameter ω, specifically:
[0070]
[0071] Among them, ω old is the model parameter of the previous time, η is the learning rate, and in this embodiment it is taken as 0.001.
[0072] 15) Repeat the training steps until the model training loss reaches the requirement, or the maximum number of training iterations reaches 200, and the model is completed. training.
[0073] 16) In the industrial control system anomaly detection stage, the network traffic in the industrial control system is collected to obtain network data packets of industrial control protocols such as Modbus and IEC104, which are parsed to obtain the data of all sensors and actuators in the industrial control system at the current time t
[0074] 17) Perform correlation enhancement operations on the collected data according to steps 2) to 11), and associate the data S of all sensors and actuators in the industrial control system at the current time t t Convert to comprehensive matrix E t .
[0075] 18) The comprehensive matrix E t Input to the trained industrial control system anomaly detection model When the output of the model is 1, it means that the current industrial control system is operating normally, otherwise, it means that the current industrial control system is operating abnormally.
[0076] Embodiment 2
[0077] refer to Figure 2 The industrial control system anomaly detection system based on receptive field enhancement of the present invention comprises:
[0078] The first acquisition module is used to collect network traffic in the industrial control system, obtain network data packets, perform protocol analysis on the network data packets, and obtain data of all sensors and actuators in the industrial control system at the current moment;
[0079] An association enhancement operation module, used to perform an association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and to construct a comprehensive matrix through the results of the association enhancement operation;
[0080] The judgment module is used to input the comprehensive matrix into the trained industrial control system anomaly detection model to judge whether the operation of the industrial control system is abnormal at the current moment.
[0081] As an embodiment of the present invention, it also includes:
[0082] The first building module is used to build a training data set;
[0083] The second building block is used to build an industrial control system anomaly detection model based on a convolutional neural network;
[0084] The training module is used to train the industrial control system anomaly detection model using the training data set to obtain a trained industrial control system anomaly detection model.
[0085] As an embodiment of the present invention, the first building block includes:
[0086] The second acquisition module is used to collect network traffic in the industrial control system, obtain network data packet samples, perform protocol analysis on the network data packet samples, and obtain data samples of all sensors and actuators in the industrial control system;
[0087] A classification module, used to classify data samples of all sensors and actuators in the industrial control system, and construct a number of unit coding vectors according to the classification results, wherein the data contained in the unit coding vectors include a corresponding type and a data sample corresponding to the type;
[0088] A scrambling module, used for scrambling the unit code vector three times continuously to obtain a random unit code matrix Z1, a random unit code matrix Z2 and a random unit code matrix Z3 respectively;
[0089] The third construction module is used to construct a comprehensive matrix sample E according to the random unit coding matrix Z1, the random unit coding matrix Z2 and the random unit coding matrix Z3. t , based on the comprehensive matrix sample E t and the label y of the data sample t , construct a training dataset D.
[0090] As an implementation mode of the present invention, the unit code vector is shuffled three times continuously using the Fisher-Yates shuffling algorithm.
[0091] As an implementation manner of the present invention, in the process of training the industrial control system anomaly detection model using the training data set, a reverse gradient propagation algorithm is used to adjust the parameters of the industrial control system anomaly detection model.
[0092] As an implementation manner of the present invention, the loss function in the process of training the industrial control system anomaly detection model using the training data set is:
[0093] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)
[0094] Among them, p is the probability that the model predicts that the current system is running normally, y i is the label of the i-th training sample in the training dataset.
[0095] Embodiment 3
[0096] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the industrial control system anomaly detection method based on receptive field enhancement are implemented, including: collecting network traffic in the industrial control system to obtain network data packets, performing protocol analysis on the network data packets to obtain data of all sensors and actuators in the industrial control system at the current moment; performing association enhancement operations on the data of all sensors and actuators in the industrial control system at the current moment, and constructing a comprehensive matrix through the results of the association enhancement operations; inputting the comprehensive matrix into the trained industrial control system anomaly detection model to determine whether the industrial control system is operating abnormally at the current moment. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.
[0097] Embodiment 4
[0098] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of implementing the industrial control system anomaly detection method based on receptive field enhancement are as follows: collecting network traffic in the industrial control system to obtain network data packets, performing protocol parsing on the network data packets, and obtaining data of all sensors and actuators in the industrial control system at the current moment; performing an association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and constructing a comprehensive matrix through the results of the association enhancement operation; inputting the comprehensive matrix into the trained industrial control system anomaly detection model to determine whether the industrial control system is running abnormally at the current moment. Specifically, the computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, disk, etc.
[0099] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0100] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A method for detecting anomalies in industrial control systems based on receptive field enhancement, characterized in that: include: Collect network traffic in the industrial control system to obtain network data packets, perform protocol analysis on the network data packets, and obtain data of all sensors and actuators in the industrial control system at the current moment; Performing an association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and constructing a comprehensive matrix based on the results of the association enhancement operation; The comprehensive matrix is input into the trained industrial control system anomaly detection model to determine whether the operation of the industrial control system is abnormal at the current moment.
2. The method for detecting anomalies in an industrial control system based on enhanced receptive field according to claim 1, characterized in that: Before inputting the comprehensive matrix into the trained industrial control system anomaly detection model, the method further includes: Build a training dataset; Building an anomaly detection model for industrial control systems based on convolutional neural networks; The industrial control system anomaly detection model is trained using the training data set to obtain a trained industrial control system anomaly detection model.
3. The method for detecting anomalies in an industrial control system based on enhanced receptive field according to claim 2, characterized in that: The process of constructing the training data set is as follows: Collect network traffic in the industrial control system to obtain network data packet samples, perform protocol analysis on the network data packet samples, and obtain data samples of all sensors and actuators in the industrial control system; Classifying data samples of all sensors and actuators in the industrial control system, and constructing a number of unit coding vectors according to the classification results, wherein the data contained in the unit coding vectors include corresponding types and data samples corresponding to the types; The unit code vector is shuffled three times continuously to obtain a random unit code matrix Z1, a random unit code matrix Z2 and a random unit code matrix Z3 respectively; The comprehensive matrix sample E is constructed according to the random unit coding matrix Z1, the random unit coding matrix Z2 and the random unit coding matrix Z3. t , based on the comprehensive matrix sample E t and the label y of the data sample t , construct a training dataset D.
4. The method for detecting anomalies in an industrial control system based on enhanced receptive field according to claim 3 is characterized in that: The unit code vector is shuffled three times continuously using the Fisher-Yates shuffling algorithm.
5. The method for detecting anomalies in an industrial control system based on enhanced receptive field according to claim 2, characterized in that: In the process of training the industrial control system anomaly detection model using the training data set, the parameters of the industrial control system anomaly detection model are adjusted using a reverse gradient propagation algorithm.
6. The method for detecting anomalies in an industrial control system based on enhanced receptive field according to claim 2, characterized in that: The loss function in the process of training the industrial control system anomaly detection model using the training data set is: L(and i ,p)=-y i log(p)-(1-y i )log(1-p) Among them, p is the probability that the model predicts that the current system is running normally, y i is the label of the i-th training sample in the training dataset.
7. An industrial control system anomaly detection system based on receptive field enhancement, characterized in that: include: The first acquisition module is used to collect network traffic in the industrial control system, obtain network data packets, perform protocol analysis on the network data packets, and obtain data of all sensors and actuators in the industrial control system at the current moment; An association enhancement operation module, used to perform an association enhancement operation on the data of all sensors and actuators in the industrial control system at the current moment, and to construct a comprehensive matrix through the results of the association enhancement operation; The judgment module is used to input the comprehensive matrix into the trained industrial control system anomaly detection model to judge whether the operation of the industrial control system is abnormal at the current moment.
8. The industrial control system anomaly detection system based on receptive field enhancement according to claim 7 is characterized in that: Also includes: The first building module is used to build a training data set; The second building block is used to build an industrial control system anomaly detection model based on a convolutional neural network; The training module is used to train the industrial control system anomaly detection model using the training data set to obtain a trained industrial control system anomaly detection model.
9. The industrial control system anomaly detection system based on receptive field enhancement according to claim 8 is characterized in that: The first building block comprises: The second acquisition module is used to collect network traffic in the industrial control system, obtain network data packet samples, perform protocol analysis on the network data packet samples, and obtain data samples of all sensors and actuators in the industrial control system; A classification module, used to classify data samples of all sensors and actuators in the industrial control system, and construct a number of unit coding vectors according to the classification results, wherein the data contained in the unit coding vectors include a corresponding type and a data sample corresponding to the type; A scrambling module, used for scrambling the unit code vector three times continuously to obtain a random unit code matrix Z1, a random unit code matrix Z2 and a random unit code matrix Z3 respectively; The third construction module is used to construct a comprehensive matrix sample E according to the random unit coding matrix Z1, the random unit coding matrix Z2 and the random unit coding matrix Z3. t , based on the comprehensive matrix sample E t and the label y of the data sample t , construct a training dataset D.
10. The industrial control system anomaly detection system based on receptive field enhancement according to claim 9 is characterized in that: The unit code vector is shuffled three times continuously using the Fisher-Yates shuffling algorithm.