Industrial control system anomaly detection method based on differential switching value coding

Abstract

The invention discloses an industrial control system anomaly detection method based on differential switching value coding, and relates to the technical field of industrial control system safety, and the method comprises the steps: carrying out the probability conversion of a switching value numerical value (0 or 1) in a training data set, obtaining a switching change probability value, and capturing the probability information of the state change of a switching device; therefore, the feature information of the numerical vector of the device is expanded, and a differential switching value coding technology is designed. The industrial control system anomaly detection method based on differential switching value coding solves the problem that an existing industrial control anomaly detection method based on deep learning is not sensitive to numerical value changes of a switching device in an industrial control system, and consequently the detection accuracy is not high, and the industrial control system anomaly detection method based on differential switching value coding is provided.

Description

Technical Field

[0001] The present invention relates to the field of industrial control system safety technology, and in particular to an industrial control system anomaly detection method based on differential switch quantity coding. Background Art

[0002] Industrial Control System (ICS) is an automatic control system widely used in industrial production processes. It ensures the stability and safety of the production process by monitoring and controlling various parameters in the production process. With the advancement of Industry 4.0, the status of industrial control systems in the national economy is becoming increasingly important. However, industrial control systems may be affected by various factors during operation, leading to abnormal situations. Industrial control anomaly detection technology is of great significance for ensuring production safety and reducing failure losses. It can monitor the system status in real time, discover potential safety hazards in a timely manner, and provide strong guarantees for the stable operation of industrial production.

[0003] In recent years, anomaly detection technology based on deep learning has been widely used in industrial control systems. This type of technology builds a neural network model to learn a large amount of normal working condition data, thereby realizing the identification of abnormal working conditions. However, the existing industrial control anomaly detection methods based on deep learning have certain limitations.

[0004] Since the proportion of switching devices in industrial control systems is high, these devices often show discrete switching states during normal operation, resulting in unclear changes in their values. Therefore, the existing deep learning models are not sensitive enough to the changes in the values ​​of such switching devices, resulting in low detection accuracy during anomaly detection, which is difficult to meet the needs of actual industrial production. Therefore, more effective methods and technologies are urgently needed to detect anomalies in switching devices in industrial control systems.

[0005] Therefore, it is necessary to design an industrial control system anomaly detection method based on differential switch quantity encoding to solve the above problems. Summary of the invention

[0006] The technical problem to be solved by the present invention is to solve the deficiencies in the prior art, and to design an industrial control system anomaly detection method based on differential switch quantity coding. The purpose of the present invention is to provide an industrial control system anomaly detection method based on differential switch quantity coding, which solves the problem that the existing industrial control anomaly detection method based on deep learning is insensitive to the numerical changes of switch devices in the industrial control system, resulting in low detection accuracy. It has the characteristics of being suitable for the industrial control system environment and having high anomaly detection accuracy, and can meet the needs of actual industrial production.

[0007] The solution adopted by the present invention to solve the technical problem is:

[0008] An industrial control system anomaly detection method based on differential switch quantity coding comprises the following steps:

[0009] Step S1: Data collection phase

[0010] Step S1.1: numbering the devices in the industrial control system according to the device serial numbers to obtain device numbers 1 to N, where N is the number of all devices in the current industrial control system;

[0011] Step S1.2: Collect the network traffic in the current industrial control system, perform deep protocol analysis on the industrial control protocol data packets therein, and obtain the status value of each device in the current industrial control system;

[0012] Step S1.3: Sort the state values ​​in step S1.2 in the order of device numbers to obtain a sorted device value vector vf = [f1, f2...f N-1 ,f N ], where f N Indicates the status value of the Nth device, where N is the number of all devices in the current industrial control system;

[0013] Step S1.4: Repeat the steps S1.2 and S1.3 to obtain multiple device numerical vectors to form a device numerical vector matrix bvf.

[0014] Step S2: In the differential switch quantity encoding stage, the switch quantity values ​​in the device value vector matrix bvf are converted into probabilities to obtain the change probability values. The specific steps are as follows:

[0015] Step S2.1: copy the device data whose output is the switching quantity from the device numerical vector group bvf to form the switching quantity device numerical vector matrix kvf;

[0016] Step S2.2: Set the observation window length to L;

[0017] Step S2.3: Take out each column vector in the matrix kvf in turn, and record the i-th column as v i , process the data of each switching device;

[0018] Step S2.4: Generate the device dictionary Qmap of the current switch device i according to the length of the window i , where Qmap i The keys of Qmap are fixed and in ascending order. i The key indicates the switch mode, Qmap i The value of indicates the number of times the pattern occurs;

[0019] Step S2.5: Start updating Qmap i When the observation window starts at v i The first element position of

[0020] Step S2.6: Get the observation window and v i The overlapping part gives the current observation vector w=[w1,w2,...,w L ] T ;

[0021] Step S2.7: Convert the current observation vector w from a binary vector to a decimal representation kwy w ;

[0022] Step S2.8: Update Qmap i , set the key to key w The corresponding value is incremented by 1, and the position of the observation window moves down by one unit;

[0023] Step S2.9: Repeat steps S2.6 to S2.8 until the end of the observation window exceeds v i The end position of the updated Qmap is obtained i ;

[0024] Step S2.10: Qmap i The value corresponding to each key i is normalized;

[0025] Step S2.11: Repeat steps S2.3 to S2.10 to process each column vector in the matrix kvf to obtain an updated dictionary set SQ = {Qmap i ,1≤i≤Q,i∈Z}, where Z represents a set of integers;

[0026] Step S2.12: Take out the i-th Qmap in the dictionary set SQ in turn i , Qmap i All values ​​are taken out in order to form a dictionary Qmap i Column vector of a i Represents Qmap i The value of the i-th key-value pair in ;

[0027] Step S2.13: According to the dictionary Qmap i Corresponding device number, dictionary Qmap i The converted column vector is updated to the corresponding column of the matrix bvf;

[0028] Step S2.14: Repeat steps S2.12 and S2.13 until the update of matrix bvf is completed, and the process of converting the switch quantity changes in the matrix into change probability values ​​is completed.

[0029] Step S3: In the model training phase, the pre-prepared convolutional neural network model M is trained using the matrix bvf.

[0030] Step S3.1: Take out each row of the matrix bvf in turn and input it into M as a training sample;

[0031] Step S3.2: According to the output of M, the loss of the current training sample is calculated using the binary cross entropy loss function;

[0032] Step S3.3: Use the back gradient propagation algorithm to adjust the model parameters ω;

[0033] Step S3.4: Repeat steps S3.1 to S3.3 until the model training loss reaches the requirement or the maximum number of training iterations reaches 200, and the model M training is completed.

[0034] Step S4: Anomaly detection phase

[0035] Step S4.1: Initialize an observation queue Q according to the observation window length L. The data structure of the observation queue Q input is the device value vector vf. The observation queue Q can store at most L device value vectors.

[0036] Step S4.2: Collect and process the industrial control protocol data packets in real time according to the methods of steps S1.1 to S1.3 to obtain the device value vector vf at time t t , and the device value vector vf t Make a copy and get vf detect ;

[0037] Step S4.3: If the observation queue Q is full, according to the first-in-first-out mechanism of the queue, the earliest vector vf is popped out;

[0038] Step S4.4: Convert the vector vf t Input to observation queue Q;

[0039] Step S4.5: If the observation queue Q is full, a copy of the observation queue Q is made to obtain the observation queue Q2, and all vectors are extracted from the observation queue Q2 to obtain the observation matrix X;

[0040] Step S4.6: Extract each column i of the device type that is a switch device from the observation matrix X in order as the observation vector col i , the observation vector col i Convert to decimal key i ;

[0041] Step S4.7: According to the device number n corresponding to the column, through key i In Qmap n Query the key value and get val i ;

[0042] Step S4.8: According to the current val i Corresponding column number i, update the value to vf detect In the corresponding column;

[0043] Step S4.9: Repeat steps S4.7 to S4.9 until vf is completed detect Updates;

[0044] Step S4.10: Set vf detect Input into the trained anomaly detection model M. If the anomaly detection model M outputs 1, it means that the current industrial control system is abnormal, otherwise it is normal.

[0045] As a preferred embodiment of the present invention, the normalization operation in step S2.10 is specifically as follows:

[0046]

[0047] Among them, Qmap i (i) indicates taking Qmap i The keys in are the corresponding values ​​of i, and e is the base of the natural logarithm.

[0048] As a preferred embodiment of the present invention, Qmap in step S2.4 i The keys are fixed and in ascending order in the fixed representation of Qmap i The key set is fixed to {key,1≤key≤2 L ,key∈Z}, where Z represents a set of integers;

[0049] Qmap in step S2.4 i The keys are fixed and in ascending order in Qmap i The keys are sorted from smallest to largest.

[0050] As a preferred embodiment of the present invention, in step S4.7, the current observation vector w is converted from a binary vector to a decimal representation key w , calculated as:

[0051]

[0052] Among them, w(i) represents the value of the i-th element of the observation vector w.

[0053] As a preferred embodiment of the present invention, the form of kvf in step S2.1 is:

[0054]

[0055] Among them, f represents the device state value, the subscript represents the device number, the superscript represents the serial number of the device value vector, Q is the total number of switching devices, and BT is the total number of row vectors of the device value vector group bvf;

[0056] The expression form of bvf in step S1.4 is:

[0057] bvf=[vf1,vf2...vf BT-1 ,f BT ] T ,

[0058] Right now:

[0059] Where BT is the total number of industrial control protocol data packets in this collection after deep protocol analysis in step S1.2, and f BT is the numerical vector of the BTth device, and T represents matrix transpose.

[0060] As a preferred embodiment of the present invention, the observation vector col in step S4.6 i Convert to decimal key i , the specific calculation formula is as follows:

[0061]

[0062] Among them, col i (j) represents the observation vector col i The j-th element value of .

[0063] As a preferred implementation of the present invention, in step S3.2, a binary cross entropy loss function is used to calculate the loss of the current training sample. The specific calculation steps are as follows:

[0064] L(y i ,p)=-y i log(p)-(1-y i )log(1-p)

[0065] Among them, p is the probability of the model predicting the positive class, ranging from [0,1], y i is the label of the i-th sample.

[0066] As a preferred implementation of the present invention, the product neural network model M in step S3 is a binary classification model.

[0067] Beneficial effects:

[0068] The present invention proposes an industrial control system anomaly detection method based on differential switch quantity coding. By performing probability conversion on the switch quantity values ​​(0 or 1) in the training data set, the switch change probability value is obtained, which can capture the probability information of the state change of the switch device, thereby expanding the feature information of the device value vector. The existing industrial control anomaly detection method based on deep learning is not sensitive to the value change of the switch device in the industrial control system, resulting in low detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A flowchart of an industrial control system anomaly detection method based on differential switch quantity coding proposed by the present invention;

[0070] Figure 2 This is a flow chart of step S1 of an industrial control system anomaly detection method based on differential switch quantity coding proposed by the present invention;

[0071] Figure 3 This is a flow chart of step S2 of an industrial control system anomaly detection method based on differential switch quantity coding proposed by the present invention;

[0072] Figure 4 This is a flow chart of step S3 of an industrial control system anomaly detection method based on differential switch quantity coding proposed by the present invention;

[0073] Figure 5 This is a flow chart of step S4 of an industrial control system anomaly detection method based on differential switch quantity encoding proposed by the present invention. DETAILED DESCRIPTION

[0074] The specific implementation of the present invention is described below in conjunction with the accompanying drawings and embodiments:

[0075] It should be noted that the drawings in this specification are only used to match the contents disclosed in the specification so that people familiar with this technology can understand and read them, and are not used to limit the conditions under which the present invention can be implemented. Any structural modification, change in proportional relationship or adjustment of size should still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0076] Based on the above background, the present invention proposes an industrial control system anomaly detection method based on differential switch quantity coding. This method converts the switch quantity values ​​(0 or 1) in the training data set into probability to obtain the switch change probability value, which can capture the probability information of the state change of the switch device, thereby expanding the feature information of the device value vector and designing a differential switch quantity coding technology. This solves the problem that the existing industrial control anomaly detection method based on deep learning is insensitive to the value changes of the switch devices in the industrial control system, resulting in low detection accuracy.

[0077] Specifically, the overall idea of ​​the present invention is to number all devices in the industrial control system, continuously collect network traffic in the industrial control system, perform deep protocol analysis on the industrial control protocol data packets therein, obtain the state value of each device in the current industrial control system, obtain the device value vector after sorting, and continuously collect them to form a device value vector matrix.

[0078] The device data whose output is the switching quantity is copied from the device numerical vector matrix to form the switching quantity device numerical vector matrix, an observation window is constructed, a device dictionary is constructed for each switching quantity device, the device dictionary is updated through the switching quantity device numerical vector matrix, the device dictionary is converted into a vector and updated to the device numerical vector matrix to obtain a training data set, and the training data set is used to train a pre-prepared binary classification model to obtain a trained anomaly detection model.

[0079] The network traffic in the industrial control system is collected in real time, and the industrial control protocol data packets are deeply analyzed to obtain the status value of each device in the current industrial control system. The device value vector is obtained after sorting, and an observation queue is constructed and updated. The device value vector is updated according to the observation queue, and the updated device value vector is input into the binary classification model for anomaly detection. If the model outputs 1, it means that the current industrial control system is abnormal, otherwise it is normal.

[0080] The present invention proposes an industrial control system anomaly detection method based on differential switch quantity coding, such as Figure 1 As shown, the following steps are included:

[0081] Step S1: data collection stage;

[0082] Step S2: differential switch quantity encoding stage;

[0083] Step S3: model training phase;

[0084] Step S4: Anomaly detection stage.

[0085] like Figure 2 As shown, step S1 includes the following steps:

[0086] Step S1.1: numbering the devices in the industrial control system according to the device serial numbers to obtain device numbers 1 to N, where N is the number of all devices in the current industrial control system;

[0087] The devices in industrial control systems are specifically sensors and actuators;

[0088] Step S1.2: Collect the network traffic in the current industrial control system, perform deep protocol analysis on the industrial control protocol data packets in the network traffic, and thus obtain the status value of each device in the current industrial control system;

[0089] Step S1.3: Sort the state values ​​in step S1.2 in the order of device numbers to obtain a sorted device value vector vf = [f1, f2...f N-1 ,f N ], where f N Indicates the status value of the Nth device, where N is the number of all devices in the current industrial control system;

[0090] Step S1.4: Repeat steps S1.2 and S1.3 to continuously collect and process network traffic to obtain multiple device numerical vectors, forming a device numerical vector matrix bvf = [vf1, vf2...vf BT-1 ,f BT ] T , where BT is the total number of industrial control protocol data packets after deep protocol analysis in this acquisition, f_BT is the numerical vector of the BTth device, and T represents matrix transpose.

[0091] The form of bvf is as follows:

[0092]

[0093] The purpose of step S2 is to perform probability conversion on the switch value (0 or 1) in the device value vector matrix bvf to obtain a change probability value. Figure 3 As shown, the specific steps are as follows:

[0094] Step S2.1: copy the device data whose output is the switching quantity from the device numerical vector group bvf to form the switching quantity device numerical vector matrix kvf;

[0095] Generally, the form of kvf is as follows:

[0096]

[0097] Step S2.2: Set the observation window length to L. The observation window is used to limit a certain area in a vector, which has the same meaning as the sliding window. The longer the observation window is, the richer the switch quantity change characteristics can be captured. In this embodiment, L=11;

[0098] Step S2.3: Take out each column vector in the matrix kvf in turn, and record the i-th column as v i , process the data of each switching device;

[0099] Step S2.4: Generate the device dictionary Qmap of the current switch device i according to the length of the window i , where Qmap i The keys of Qmap are fixed and in ascending order. i The key indicates the switch mode, Qmap i The value of indicates the number of times the pattern occurs;

[0100] Fixed means that the key set of the dictionary is fixed to {key,1≤key≤2 L ,key∈Z}, where Z represents a set of integers;

[0101] Ascending order means that the keys of the dictionary are sorted from smallest to largest;

[0102] Step S2.5: Start updating Qmap i When the observation window starts at v i The first element position of

[0103] Step S2.6: Get the observation window and v i The overlapping part gives the current observation vector w=[w1,w2,...,w L ] T ;

[0104] Step S2.7: Convert the current observation vector w from a binary vector to a decimal representation key w , calculated as follows:

[0105]

[0106] Among them, w(i) means taking the value of the i-th element of the observation vector w;

[0107] Step S2.8: Update Qmap i , set the key to key w The corresponding value is incremented by 1, and the position of the observation window moves down by one unit;

[0108] Step S2.9: Repeat steps S2.6 to S2.8 until the end of the observation window exceeds v i The end position of the updated Qmap is obtained i ;

[0109] The following is an example of the data structure of an updated dictionary:

[0110]

[0111] For example, "1023:14" means that when the observation window L = 11, the vector [0,1,1,1,1,1,1,1,1,1,1] appears 14 times in the observation window;

[0112] Step S2.10: Qmap i The value corresponding to each key i is normalized. The specific calculation steps are as follows:

[0113]

[0114] Among them, Qmap i (i) means taking the value corresponding to the key i in the dictionary, and e is the base of the natural logarithm;

[0115] Step S2.11: Repeat steps S2.3 to S2.10 to process each column vector in the matrix kvf to obtain an updated dictionary set SQ = {Qmap i ,1≤i≤Q,i∈Z}, where Z represents a set of integers;

[0116] Step S2.12: Take out the i-th Qmap in the dictionary set SQ in turn i , Qmap i All values ​​are taken out in order to form a dictionary Qmap i Column vector of a i Represents Qmap i The value of the i-th key-value pair in ;

[0117] The following shows an example of converting a dictionary to a column vector:

[0118]

[0119] It can be observed that the column vector needs to maintain the order of the values ​​in the original dictionary;

[0120] Step S2.13: According to the dictionary Qmap i Corresponding device number, dictionary Qmap i The converted column vector is updated to the corresponding column of the matrix bvf;

[0121] Step S2.14: Repeat steps S2.12 and S2.13 until the update of the matrix bvf is completed, completing the process of converting the switch quantity changes in the matrix into change probability values.

[0122] The purpose of step S3 is to use the matrix bvf to train the pre-prepared convolutional neural network model M, which is a binary classification model. In addition, the pre-prepared convolutional neural network model M directly applies the existing technology, and the present invention does not limit it, and any convolutional neural network can be used. Figure 4 As shown, it includes the following steps:

[0123] Step S3.1: Take out each row of the matrix bvf in turn and input it into M as a training sample;

[0124] Step S3.2: According to the output of M, the binary cross entropy loss function is used to calculate the loss of the current training sample. The specific calculation steps are as follows:

[0125] L(y i , p) = -y i log(p)-(1-y i )log(1-p)

[0126] Among them, p is the probability of the model predicting the positive class, ranging from [0,1], y i is the label of the i-th sample;

[0127] Step S3.3: Use the back gradient propagation algorithm to adjust the model parameters ω,

[0128] The specific calculation steps are as follows:

[0129]

[0130] where ω old is the model parameter of the previous time; η is the learning rate, and the model parameter ω represents the parameter value of each neuron in the neural network / model, and in this embodiment, it is taken as 0.001;

[0131] Step S3.4: Repeat steps S3.1 to S3.3 until the model training loss meets the requirement or the maximum number of training iterations reaches 200, and the training of model M is completed.

[0132] like Figure 5 As shown, step S4 includes the following steps:

[0133] Step S4.1: Initialize an observation queue Q according to the observation window length L. The data structure of the observation queue Q input is the device value vector vf. The observation queue Q can store at most L device value vectors, that is, the length of the observation queue Q is consistent with the length of the observation window L;

[0134] Step S4.2: Collect and process the industrial control protocol data packets in real time according to the methods of steps S1.1 to S1.3 to obtain the device value vector vf at time tt , and the device value vector vf t Make a copy and get vf detect ;

[0135] Step S4.3: If the observation queue Q is full, according to the first-in-first-out mechanism of the queue, the earliest vector vf is popped out;

[0136] Step S4.4: Convert the vector vf t Input to the observation queue Q, vf t is vf at time t, they are the same, so just input vf t The number of storage depends on the length of the observation queue Q, which is consistent with the length of the observation window;

[0137] Step S4.5: If the observation queue Q is full, a copy of the observation queue Q is made to obtain the observation queue Q2, and all vectors are extracted from the observation queue Q2 to obtain the observation matrix X;

[0138] Step S4.6: Extract each column i of the device type that is a switch device from the observation matrix X in the arranged order as the observation vector col i , the observation vector col i Convert to decimal number keyi, the specific calculation formula is as follows:

[0139]

[0140] Among them, col i (j) represents the observation vector col i The j-th element value of ;

[0141] Step S4.7: According to the device number n corresponding to the column, through key i In Qmap n Query the key value and get val i ;

[0142] Step S4.8: According to the current val i Corresponding column number i, update the value to vf detect In the corresponding column;

[0143] Step S4.9: Repeat steps S4.7 to S4.9 until vf is completed detect Updates;

[0144] Step S4.10: Set vf detect Input into the trained anomaly detection model M. If the anomaly detection model M outputs 1, it means that the current industrial control system is abnormal, otherwise it is normal.

[0145] The specific implementation modes of the present invention are described in detail above in conjunction with the accompanying drawings. However, the present application is not limited to the above implementation modes. Various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the spirit of the present invention. It should be understood that the accompanying drawings only show some specific embodiments of the present application. Therefore, they should not be regarded as limiting the scope of the content of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0147] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0149] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0150] Many other changes and modifications may be made without departing from the concept and scope of the present invention.It should be understood that the present invention is not limited to the specific embodiments, and the scope of the present invention is defined by the appended claims.

Claims

1. An industrial control system anomaly detection method based on differential switch quantity coding, characterized in that: The steps include: Step S1: Data collection phase Step S1.1: numbering the devices in the industrial control system according to the device serial numbers to obtain device numbers 1 to N, where N is the number of all devices in the current industrial control system; Step S1.2: Collect the network traffic in the current industrial control system, perform deep protocol analysis on the industrial control protocol data packets therein, and obtain the status value of each device in the current industrial control system; Step S1.3: Sort the state values ​​in step S1.2 in the order of device numbers to obtain a sorted device value vector vf = [f1, f2...f N-1 ,f N ], where f N Indicates the status value of the Nth device, where N is the number of all devices in the current industrial control system; Step S1.4: Repeat the steps S1.2 and S1.3 to obtain multiple device numerical vectors to form a device numerical vector matrix bvf. Step S2: In the differential switch quantity encoding stage, the switch quantity values ​​in the device value vector matrix bvf are converted into probabilities to obtain the change probability values. The specific steps are as follows: Step S2.1: copy the device data whose output is the switching quantity from the device numerical vector group bvf to form the switching quantity device numerical vector matrix kvf; Step S2.2: Set the observation window length to L; Step S2.3: Take each column vector in the matrix kef in turn, and record the i-th column as v i , process the data of each switching device; Step S2.4: Generate the device dictionary Qmap of the current switch device i according to the length of the window i , where Qmap i The keys of Qmap are fixed and in ascending order. i The key indicates the switch mode, Qmap i The value of indicates the number of times the pattern occurs; Step S2.5: Start updating Qmap i When the observation window starts at v i The first element position of Step S2.6: Get the observation window and v i The overlapping part gives the current observation vector w=[w1,w2,...,w L ] T ; Step S2.7: Convert the current observation vector w from a binary vector to a decimal representation key w ; Step S2.8: Update Qmap i , set the key to key w The corresponding value is incremented by 1, and the position of the observation window moves down by one unit; Step S2.9: Repeat steps S2.6 to S2.8 until the end of the observation window exceeds v i The end position of the updated Qmap is obtained i ; Step S2.10: Qmap i The value corresponding to each key i is normalized; Step S2.11: Repeat steps S2.3 to S2.10 to process each column vector in the matrix kvf to obtain an updated dictionary set SQ = {Qmap i ,1≤i≤Q,i∈Z}, where Z represents a set of integers; Step S2.12: Take out the i-th Qmap in the dictionary set SQ in turn i , Qmap i All values ​​are taken out in order to form a dictionary Qmap i Column vector of a i Represents Qmap i The value of the i-th key-value pair in ; Step S2.13: According to the dictionary Qmap i Corresponding device number, dictionary Qmap i The converted column vector is updated to the corresponding column of the matrix bvf; Step S2.14: Repeat steps S2.12 and S2.13 until the update of matrix bvf is completed, and the process of converting the switch quantity changes in the matrix into change probability values ​​is completed. Step S3: In the model training phase, the pre-prepared convolutional neural network model M is trained using the matrix bvf. Step S3.1: Take out each row of the matrix bvf in turn and input it into M as a training sample; Step S3.2: According to the output of M, the loss of the current training sample is calculated using the binary cross entropy loss function; Step S3.3: Use the back gradient propagation algorithm to adjust the model parameters ω; Step S3.4: Repeat steps S3.1 to S3.3 until the model training loss reaches the requirement or the maximum number of training iterations reaches 200, and the model M training is completed. Step S4: Anomaly detection phase Step S4.1: Initialize an observation queue Q according to the observation window length L. The data structure of the observation queue Q input is the device value vector vf. The observation queue Q can store at most L device value vectors. Step S4.2: Collect and process the industrial control protocol data packets in real time according to the methods of steps S1.1 to S1.3 to obtain the device value vector vf at time t t , and the device value vector vf t Make a copy and get vf detect ; Step S4.3: If the observation queue Q is full, according to the first-in-first-out mechanism of the queue, the earliest vector vf is popped out; Step S4.4: Convert the vector vf t Input to observation queue Q; Step S4.5: If the observation queue Q is full, a copy of the observation queue Q is made to obtain the observation queue Q2, and all vectors are extracted from the observation queue Q2 to obtain the observation matrix X; Step S4.6: Extract each column i of the device type that is a switch device from the observation matrix X in order as the observation vector col i , the observation vector col i Convert to decimal key i ; Step S4.7: According to the device number n corresponding to the column, through key i In Qmap n Query the key value and get val i ; Step S4.8: According to the current val i Corresponding column number i, update the value to vf detect In the corresponding column; Step S4.9: Repeat steps S4.7 to S4.9 until vf is completed detect Updates; Step S4.10: Set vf detect Input into the trained anomaly detection model M. If the anomaly detection model M outputs 1, it means that the current industrial control system is abnormal, otherwise it is normal.

2. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: The normalization operation in step S2.10 is specifically as follows: Among them, Qmap i (i) indicates taking Qmap i The keys in are the corresponding values ​​of i, and e is the base of the natural logarithm.

3. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: Qmap in step S2.4 i The keys are fixed to represent Qmap i The key set is fixed to {key,1≤key≤2 L ,key∈Z}, where Z represents a set of integers; Qmap in step S2.4 i The keys are fixed and in ascending order in Qmap i The keys are sorted from smallest to largest.

4. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: In step S4.7, the current observation vector w is converted from a binary vector to a decimal representation key w , calculated as: Among them, w(i) represents the value of the i-th element of the observation vector w.

5. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: The form of kvf in step S2.1 is: Among them, f represents the device state value, the subscript represents the device number, the superscript represents the serial number of the device value vector, Q is the total number of switching devices, and BT is the total number of row vectors of the device value vector group bvf; The expression form of bvf in step S1.4 is: bvf=[vf1,vf2…vf BT-1 ,f BT ] T , Right now: Where BT is the total number of industrial control protocol data packets in this collection after deep protocol analysis in step S1.2, and f BT is the numerical vector of the BTth device, and T represents matrix transpose.

6. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: In step S4.6, the observation vector col i Convert to decimal key i , the specific calculation formula is as follows: Among them, col i (j) represents the observation vector col i The j-th element value of .

7. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: In step S3.2, the binary cross entropy loss function is used to calculate the loss of the current training sample. The specific calculation steps are as follows: L(and i ,p)=-y i log(p)-(1-y i )log(1-p) Among them, p is the probability of the model predicting the positive class, ranging from [0,1], y i is the label of the i-th sample.

8. The method for detecting abnormality in an industrial control system based on differential switch quantity coding according to claim 1, characterized in that: The product neural network model M in step S3 is a binary classification model.

Images