An industrial internet anomaly detection method based on a deep generative adversarial network

Abstract

The application relates to the field of data supervision detection, and provides an industrial internet anomaly detection method based on a deep generative adversarial network, which is characterized by the following steps: S10, pre-processing of an intrusion detection data set based on a numerical type to obtain real samples; S20, training of a DeepGAN sampling model; and S30, output of a sampling result and anomaly detection of the sampling result based on a detection model. The application is used for solving the problem of performance decline of a detector caused by data class imbalance, using an existing oversampling method, designing an oversampling method based on a deep generative adversarial network, improving a model training process, and improving the quality of generated samples. Finally, the detection performance of the detection model is effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of data supervision and inspection, and in particular relates to an industrial internet anomaly detection method based on deep generative adversarial networks. Background Technology

[0002] Intrusion Detection Systems (IDS) are a proactive defense technology in the field of cybersecurity. IDS identify known attack patterns, anomalous behaviors, or unauthorized activities by collecting and analyzing information from network traffic, system logs, and application data. An effective IDS can promptly alert administrators and provide detailed information about threats, enabling rapid response and mitigating security risks and potential losses. Over the past few decades, much research has focused on applying a combination of traditional machine learning and deep learning methods to IDS.

[0003] However, in network intrusion detection, datasets are often imbalanced, with benign samples (i.e., the majority class) far outnumbering malicious samples (i.e., the minority class). Due to the scarcity of malicious samples and the severe consequences of misclassification, accurately detecting these minority samples becomes crucial. However, imbalanced datasets present challenges to training detection classifiers, potentially leading to misclassification or neglect of minority samples, thus reducing the accuracy of minority class classification. Therefore, enhancing the classification ability of minority samples and improving overall classification accuracy is a significant challenge for intrusion detection systems. Summary of the Invention

[0004] In view of the above-mentioned deficiencies of the existing technology, this invention proposes an industrial internet anomaly detection method based on deep generative adversarial networks. The technical solution designed in this invention includes the following steps:

[0005] S10: Preprocess the intrusion detection dataset based on the numerical type to obtain real samples;

[0006] S20: Train the DeepGAN sampling model;

[0007] S30: Output the sampling results and perform anomaly detection on the sampling results based on the detection model.

[0008] Preferably, S10 includes:

[0009] The intrusion detection dataset includes both numerical and non-numerical data;

[0010] The formula for scaling numerical data is as follows:

[0011]

[0012] In the formula, x is the feature value of the numerical data, x′ is the feature value of the standardized numerical data, and x max x represents the maximum eigenvalue of numerical data. min The minimum characteristic value of numerical data;

[0013] One-hot encoding is used for each column of non-numerical data.

[0014] Preferably, S10 further includes:

[0015] The intrusion detection dataset is divided into two parts: 70% is used as the training dataset, and the remaining 30% is used as the test dataset, resulting in real samples for both the training and test datasets.

[0016] Preferably, S10 further includes:

[0017] The imbalance rates of the training and test datasets are calculated using the following formula:

[0018]

[0019] In the formula, IR is the imbalance rate, and N is the unbalance rate. majority N represents the number of classes. minority The number of minority categories;

[0020] Generate (N) based on the imbalance rates of the training and test datasets. majority -N minority ) minority class samples.

[0021] Preferably, the DeepGAN sampling model includes:

[0022] Generator, discriminator, auxiliary classifier, and information extraction module;

[0023] The generator is used to take real samples as input and output generated samples.

[0024] The discriminator is used to distinguish between real samples and generated samples;

[0025] The auxiliary classifier is used to predict the class label of a given sample and to map the generated sample to the class label of the given sample;

[0026] The information extraction module is used to perform feature processing on the hidden layer outputs of the generator, discriminator, and auxiliary classifier.

[0027] Preferably, step S20 includes the following steps:

[0028] S2001: The generator is trained with a fixed discriminator. The generator adjusts its weights by minimizing the discriminator's judgment error on the generated samples.

[0029] S2002: The discriminator is trained with a fixed generator. The discriminator adjusts its weights by minimizing the Wasserstein distance between real samples and generated samples.

[0030] S2003: Add the loss of the auxiliary classifier to the loss of the generator to predict the class label of a given sample and map the generated sample to the class label of the given sample;

[0031] S2004: The generator loss and discriminator loss are continuously optimized and their respective weights are adjusted through backpropagation until the discriminator can no longer determine the source of the real sample, thus completing the training of the DeepGAN sampling model.

[0032] Preferably, the generator, which takes a real sample as input and outputs a generated sample, includes:

[0033] The generator takes 30-dimensional random noise z and class label y as input, performs feature extraction through a hidden layer, and further extracts the time dependencies based on the features extracted by the information extraction module. The extracted data results are used as the input of the subsequent output layer.

[0034] In the output layer, the generator is divided into numerical vectors and non-numerical vectors according to the type of numerical data. For numerical vector outputs, the generator directly generates numerical outputs through a linear layer. For non-numerical vector outputs, the generator sets a separate dense layer for each non-numerical column, so that each non-numerical column can generate independent outputs. The numerical vector outputs and non-numerical vector outputs are concatenated to output a complete generated sample.

[0035] Preferably, the dense layer employs the Gumbel-Softmax activation function, adding noise from the Gumbel distribution to the non-numerical vector output. For a vector x representing the non-normalized log probabilities of k class non-numerical vectors, Gumbel-Softmax is applied to each element x of vector x. i The formula is as follows:

[0036]

[0037] In the formula, g1,…,g k Let τ be an independent and identically distributed sample drawn from Gumbel(0,1), where τ is the temperature coefficient.

[0038] Preferably, the discriminator for distinguishing between real samples and generated samples includes:

[0039] The discriminator takes class labels y and generated samples as input and classifies them according to the numerical type of the generated samples. For numerical vectors, the discriminator adds Gaussian noise with a mean of 0. Let xi represent m numerical vectors x of the data samples. The noise is added to each vector x such that ... Where z1, z2...z m Obtained from N(0, 0.01), noise is added to the real samples and generated samples respectively; for non-numerical vectors, the non-numerical vectors are dimensionality reduced by a separate embedding layer, and the dimension is dynamically adjusted to dimension d according to the original dimension k of one-hot encoding, dimension d = min([k / 3], 20);

[0040] Numerical and non-numerical vectors are used together as inputs to the discriminator's hidden layer. Numerical and non-numerical vectors are learned based on nonlinear transformations. The information extraction module integrates global information to extract features that distinguish real samples from generated samples. The output layer outputs the Wasserstein distance between real samples and generated samples.

[0041] Preferably, the information extraction module performs feature processing on the hidden layer outputs of the generator, discriminator, and auxiliary classifier, including:

[0042] The information extraction module includes a position encoder and a Transformer encoder, applied after the hidden layers of the generator, discriminator, and auxiliary classifier. Data input to the information extraction module is processed through multiple weight matrices W. Q W K and W V Perform a linear transformation to generate a query vector Q, a key vector K, and a value vector V. Then, use Q and K... T The dot product is used to calculate the similarity relationship between different features;

[0043] The Q and K T The formula for calculating the dot product is as follows:

[0044]

[0045] Beneficial Effects: This invention proposes a deep generative adversarial network (GAN)-based anomaly detection method for the industrial internet. Addressing the performance degradation of detectors due to data class imbalance, it utilizes existing oversampling methods and designs an oversampling method based on GANs. A Transformer-based information extraction module is introduced to help the model extract global information, fully learning the distribution characteristics of minority class data. Considering that intrusion detection datasets contain both numerical and non-numerical variables, a differentiated processing strategy is adopted to ensure the model can effectively model both types of variables simultaneously. Finally, the loss functions of WGAN-GP and CGAN are combined, and auxiliary classifier loss and relativistic loss are introduced to improve the model training process and enhance the quality of generated samples. Ultimately, this effectively improves the detection performance of the detection model. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating a preferred embodiment of the present invention;

[0047] Figure 2 This is a schematic diagram of the generator structure according to a preferred embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of the discriminator structure according to a preferred embodiment of the present invention;

[0049] Figure 4 This is a schematic diagram of the auxiliary classifier structure according to a preferred embodiment of the present invention;

[0050] Figure 5 This is a schematic diagram of the information extraction module structure of a preferred embodiment of the present invention. Detailed Implementation

[0051] The embodiments of the present invention will be described in detail below. The embodiments described below are implemented based on the technical solution of the present invention, and detailed implementation methods and specific operation processes are given. However, the protection scope of the present invention is not limited to the embodiments described below.

[0052] This invention designs an industrial internet anomaly detection method based on deep generative adversarial networks, such as... Figure 1 As shown, the technical solution includes the following steps, specifically:

[0053] S10: Preprocess the intrusion detection dataset based on the numerical type to obtain real samples;

[0054] S20: Train the DeepGAN sampling model;

[0055] S30: Output the sampling results and perform anomaly detection on the sampling results based on the detection model.

[0056] Preferably, S10 includes:

[0057] The intrusion detection dataset includes both numerical and non-numerical data;

[0058] The formula for scaling numerical data is as follows:

[0059]

[0060] In the formula, x is the feature value of the numerical data, x′ is the feature value of the standardized numerical data, and x max x represents the maximum eigenvalue of numerical data. min The minimum characteristic value of numerical data;

[0061] One-hot encoding is used for each column of non-numerical data.

[0062] Specifically, industrial control system data includes non-numerical data such as "service," "state," and "proto." GAN models are primarily unable to effectively handle non-numerical data because the generator and discriminator of GAN models require differentiable data, making it impossible to directly generate non-numerical data. To address this, one-hot encoding is used for each column of non-numerical data, and a softmax activation method is employed in the generator. This process not only facilitates the calculation of distances between features but also preserves the information of the original non-numerical data attributes.

[0063] Preferably, S10 further includes:

[0064] The intrusion detection dataset is divided into two parts: 70% is used as the training dataset, and the remaining 30% is used as the test dataset, resulting in real samples for both the training and test datasets.

[0065] Preferably, S10 further includes:

[0066] The imbalance rates of the training and test datasets are calculated using the following formula:

[0067]

[0068] In the formula, IR is the imbalance rate, and N is the unbalance rate. majority N represents the number of classes. minority The number of minority categories;

[0069] Generate (N) based on the imbalance rates of the training and test datasets. majority -N minority ) minority class samples.

[0070] Specifically, this application uses seven publicly available industrial control system cybersecurity datasets for intrusion detection: NSL-KDD, Firewall, UNSW-NB15, Power, SWAT, Gas Pipeline, and BATADAL. Detailed information about these datasets is shown in Table 1. The datasets are divided into two parts: 70% for training the detection model and 30% for testing the model's performance. Both datasets retain their original class imbalance after the data split. The class imbalance rate (IR) reflects the degree of class imbalance in the datasets.

[0071] Table 1

[0072]

[0073] Where Instances is the total number of samples in the dataset, Features is the number of data sample features, #Maj is the number of majority samples, #Min is the number of minority samples, #Num is the number of numerical sample features, #Non-num is the number of non-numerical sample features, and IR is the imbalance ratio.

[0074] Preferably, the DeepGAN sampling model includes:

[0075] Generator, discriminator, auxiliary classifier, and information extraction module;

[0076] The generator is used to take real samples as input and output generated samples.

[0077] The discriminator is used to distinguish between real samples and generated samples;

[0078] The auxiliary classifier is used to predict the class label of a given sample and to map the generated sample to the class label of the given sample;

[0079] The information extraction module is used to perform feature processing on the hidden layer outputs of the generator, discriminator, and auxiliary classifier.

[0080] Preferably, step S20 includes the following steps:

[0081] S2001: The generator is trained with a fixed discriminator. The generator adjusts its weights by minimizing the discriminator's judgment error on the generated samples.

[0082] S2002: The discriminator is trained with a fixed generator. The discriminator adjusts its weights by minimizing the Wasserstein distance between real samples and generated samples.

[0083] S2003: Add the loss of the auxiliary classifier to the loss of the generator to predict the class label of a given sample and map the generated sample to the class label of the given sample;

[0084] S2004: The generator loss and discriminator loss are continuously optimized and their respective weights are adjusted through backpropagation until the discriminator can no longer determine the source of the real sample, thus completing the training of the DeepGAN sampling model.

[0085] Preferably, such as Figure 2 As shown, the generator, which takes a real sample as input and outputs a generated sample, includes:

[0086] The generator takes 30-dimensional random noise z and class label y as input, performs feature extraction through a hidden layer, and further extracts the time dependencies based on the features extracted by the information extraction module. The extracted data results are used as the input of the subsequent output layer.

[0087] In the output layer, the generator is divided into numerical vectors and non-numerical vectors according to the type of numerical data. For numerical vector outputs, the generator directly generates numerical outputs through a linear layer. For non-numerical vector outputs, the generator sets a separate dense layer for each non-numerical column, so that each non-numerical column can generate independent outputs. The numerical vector outputs and non-numerical vector outputs are concatenated to output a complete generated sample.

[0088] Preferably, the dense layer employs the Gumbel-Softmax activation function, adding noise from the Gumbel distribution to the non-numerical vector output. For a vector x representing the non-normalized log probabilities of k class non-numerical vectors, Gumbel-Softmax is applied to each element x of vector x. i The formula is as follows:

[0089]

[0090] In the formula, g1,…,g k Let τ be an independent and identically distributed sample drawn from Gumbel(0,1), where τ is the temperature coefficient.

[0091] Specifically, by adding noise from the Gumbel distribution to the non-numerical output, the generator does not simply replicate the input noise, but is able to generate discrete values ​​that are close to the distribution of the real data.

[0092] Preferably, such as Figure 3 As shown, the discriminator used to distinguish between real samples and generated samples includes:

[0093] The discriminator takes class labels y and generated samples as input and classifies them according to the numerical type of the generated samples. For numerical vectors, the discriminator adds Gaussian noise with a mean of 0. Let xi represent m numerical vectors x of the data samples. The noise is added to each vector x such that ... Where z1, z2...z m Obtained from N(0, 0.01), noise is added to the real samples and generated samples respectively; for non-numerical vectors, the non-numerical vectors are dimensionality reduced by a separate embedding layer, and the dimension is dynamically adjusted to dimension d according to the original dimension k of one-hot encoding, dimension d = min([k / 3], 20);

[0094] Numerical and non-numerical vectors are used together as inputs to the discriminator's hidden layer. Numerical and non-numerical vectors are learned based on nonlinear transformations. The information extraction module integrates global information to extract features that distinguish real samples from generated samples. The output layer outputs the Wasserstein distance between real samples and generated samples.

[0095] Specifically, adding noise to real samples ensures that the discriminator doesn't make judgments based solely on values ​​different from the real data. Adding noise to generated samples ensures that the generator doesn't learn to imitate noise, reinforcing the output values ​​that align with the distribution of the real data. The embedding layer transforms high-dimensional sparse one-hot encoding into low-dimensional dense representations, reducing computation and parameter count while aiding in extracting latent relationships between features. The dimension is dynamically adjusted based on the original dimension k of the one-hot vector, ensuring that dimension d = min([k / 3], 20), empirically considered sufficient to capture the main features of the data. The non-numerical and numerical vector parts processed by the embedding layer are used together as input to the hidden layer. In the hidden layer, the data undergoes a series of non-linear transformations to learn complex patterns. The information extraction module further integrates global information, extracting features useful for distinguishing between real and generated samples. Finally, the output layer outputs a one-dimensional scalar representing the probability that the input data is a real sample (actually an approximation of the Wasserstein distance). Since DeepGAN's goal is to directly optimize the Wasserstein distance rather than to perform probability estimation, the output layer does not need to use an activation function.

[0096] In addition, such as Figure 4 As shown, for an auxiliary classifier used to predict the class label of a given sample and map the generated sample to the class label of the given sample, it includes:

[0097] The auxiliary classifier follows the same input processing flow as the discriminator when processing data samples. Its structure consists of two fully connected layers, both using LeaklyReLU as the activation function. After these two fully connected layers, the data flows into the information extraction module for further feature processing. Finally, the data passes through an output layer, which uses Sigmoid as the activation function to generate a class probability. This class probability represents the probability that a given sample X belongs to class y, AC(X) = P(y|X). This design aims to encourage the generator to generate samples belonging to class y by leveraging the predictive power of the auxiliary classifier, thereby improving the generator's generation capability.

[0098] Preferably, such as Figure 5 As shown, the information extraction module is used to perform feature processing on the hidden layer outputs of the generator, discriminator, and auxiliary classifier, including:

[0099] The information extraction module includes a position encoder and a Transformer encoder, applied after the hidden layers of the generator, discriminator, and auxiliary classifier. Data input to the information extraction module is processed through multiple weight matrices W. Q W K and W V Perform a linear transformation to generate a query vector Q, a key vector K, and a value vector V. Then, use Q and K... T The dot product is used to calculate the similarity relationship between different features;

[0100] The Q and K T The formula for calculating the dot product is as follows:

[0101]

[0102] Specifically, data sampling based on the DeepGAN model mainly includes a generator, a discriminator, an auxiliary classifier, and an information extraction module embedded in the generator and discriminator. The information extraction module is applied to the hidden layers of the generator, discriminator, and auxiliary classifier. By further processing the output of the hidden layers, the model can effectively capture the dependencies between time and important features.

[0103] In addition, in the information extraction module, the Transformer encoder incorporates position encoding to explicitly represent the position of each element in the sequence. Considering the temporal nature of industrial control system data, the DeepGAN architecture combines the position encoder with the Transformer encoder to form the information extraction module. The core working principle of the Transformer lies in its multi-head attention mechanism, which uses scaled dot product attention to capture key dependencies in the input data. First, the input data is processed through multiple sets of weight matrices W... Q WK and W V Perform a linear transformation to generate Q (query), K (key), and V (value). Then, use the formula to transform Q and K... T The dot product calculation can determine the similarity relationship between different features. To prevent the dot product result from becoming too large and causing the Softmax method to enter the saturation region, the dot product result is divided by a scaling factor, which is usually the square root of the feature dimension of the key. The scaled dot product matrix is ​​then normalized using the Softmax method to obtain the attention weights. The value matrix is ​​then weighted and summed according to the attention weight formula to obtain the output head of each attention head. j The outputs of multiple attention heads are concatenated using a formula, and the entire multi-head attention output is calculated through a linear transformation.

[0104] The attention weights are weighted sums of the value matrices, as shown in the following formula:

[0105] head i =Attention(QW i Q KW i K VW i V )

[0106] The outputs of multiple attention points are concatenated using a formula, as follows:

[0107] MultiHead(Q,K,V)=Concat(head1,...,head n )

[0108] The output obtained through the multi-head attention mechanism cannot be directly fed into the fully connected neural network. Instead, it is first processed through the Add&Norm layer. The Add&Norm layer consists of two parts: Add and Norm. The Add part adds a residual block X to the original input. The purpose of adding the residual block is to prevent degradation during the training of the deep neural network. The Norm part is mainly for normalization, aiming to speed up the training of the model and improve its stability. Its calculation formula is as follows:

[0109] LayerNorm(X+MultiHeadAttention(X))

[0110] LayerNorm(X+FeedForward(X))

[0111] Next, the output processed by the Add&Norm layers is passed to the FeedForward network. FeedForward is a two-layer fully connected neural network that first performs a linear transformation, then applies the ReLU non-linear activation function, and finally performs another linear transformation, allowing the model to learn more complex feature representations. Through the filtering effect of the ReLU function, the model can selectively retain important feature information and ignore irrelevant parts. Finally, after the transformation by the FeedForward network, the model obtains a new output.

[0112] Preferably, in step S30, the sampling results are output and anomaly detection is performed on the sampling results based on the detection model, including the use of four common detection models: Support Vector Machine (SVM), XGBoost, Random Forest, LightGBM, and Fully Connected Neural Network (FCNN).

[0113] Preferably, the present invention also provides an evaluation index design, including the use of F-measure (Table 2) and G-mean index (Table 3) to evaluate the anomaly detection performance of the DeepGAN method. To verify the superiority of the experimental results, the performance of DeepGAN was compared with SMOTE, Borderline-SMOTE, K-means SMOTE, Geometric SMOTE, GAN, CWGAN and no-sampling methods.

[0114] Table 2

[0115]

[0116]

[0117] Table 3

[0118]

[0119]

[0120] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. An industrial internet anomaly detection method based on deep generative adversarial networks, characterized in that, Includes the following steps: S10: Preprocess the intrusion detection dataset based on the numerical type to obtain real samples; S20: Train the DeepGAN sampling model; S30: Output the sampling results and perform anomaly detection based on the detection model; S10 includes: The intrusion detection dataset includes both numerical and non-numerical data. The formula for scaling numerical data is as follows: In the formula, For the feature values ​​of numerical data, For the feature values ​​of standardized numerical data, For numerical data, the maximum eigenvalue is the eigenvalue. The minimum characteristic value of numerical data; One-hot encoding is used for each column of non-numerical data; The DeepGAN sampling model includes: Generator, discriminator, auxiliary classifier, and information extraction module; The generator is used to take real samples as input and output generated samples. The discriminator is used to distinguish between real samples and generated samples; The auxiliary classifier is used to predict the class label of a given sample and to map the generated sample to the class label of the given sample; The information extraction module is used to perform feature processing on the hidden layer outputs of the generator, discriminator, and auxiliary classifier; The generator, which takes real samples as input and outputs generated samples, includes: The generator takes 30-dimensional random noise as input. and category labels After feature extraction through the hidden layer, the information extraction module further extracts the time dependencies based on the features extracted in the hidden layer. The extracted data results are used as the input of the subsequent output layer. In the output layer, the generator is divided into numerical vectors and non-numerical vectors according to the type of numerical data. For numerical vector outputs, the generator directly generates numerical outputs through a linear layer. For non-numerical vector outputs, the generator sets up a separate dense layer for each non-numerical column, so that each non-numerical column can generate independent outputs. The numerical vector outputs and non-numerical vector outputs are concatenated to output a complete generated sample. The dense layer employs the Gumbel-Softmax activation function, adding noise from the Gumbel distribution to the non-numerical vector output. A vector of nonnormalized log probabilities of non-numerical vectors of each category. Gumbel-Softmax is applied to vectors Each element The formula is as follows: In the formula, These are independent and identically distributed samples drawn from Gumbel(0,1). It is the temperature coefficient.

2. The industrial internet anomaly detection method based on deep generative adversarial networks according to claim 1, characterized in that, S10 further includes: The intrusion detection dataset is divided into two parts: 70% is used as the training dataset, and the remaining 30% is used as the test dataset, resulting in real samples for both the training and test datasets.

3. The industrial internet anomaly detection method based on deep generative adversarial networks according to claim 2, characterized in that, S10 further includes: The imbalance rates of the training and test datasets are calculated using the following formula: In the formula, IR The imbalance rate, N majority For the majority class number, N minority The number of minority categories; Generate based on the imbalance rates of the training and test datasets. A minority class of samples.

4. The industrial internet anomaly detection method based on deep generative adversarial networks according to claim 1, characterized in that, S20 includes the following steps: S2001: The generator is trained with a fixed discriminator. The generator adjusts its weights by minimizing the discriminator's judgment error on the generated samples. S2002: The discriminator is trained with a fixed generator. The discriminator adjusts its weights by minimizing the Wasserstein distance between real samples and generated samples. S2003: Add the loss of the auxiliary classifier to the loss of the generator to predict the class label of a given sample and map the generated sample to the class label of the given sample; S2004: The generator loss and discriminator loss are continuously optimized and their respective weights are adjusted through backpropagation until the discriminator can no longer determine the source of the real sample, thus completing the training of the DeepGAN sampling model.

5. The industrial internet anomaly detection method based on deep generative adversarial networks according to claim 1, characterized in that, The discriminator used to distinguish between real samples and generated samples includes: The discriminator input is the category label. The system generates samples and classifies them according to their numerical types. For numerical vectors, the discriminator adds Gaussian noise with a mean of 0. This represents the m numerical vectors x of the data sample. The noise is added to each vector x such that... ,in from N The result is obtained from (0, 0.01). Noise is added to both the real and generated samples. For non-numerical vectors, dimensionality reduction is performed using a separate embedding layer, with the dimension dynamically adjusted based on the original dimension k of the one-hot encoding. Dimension ; Numerical and non-numerical vectors are used together as inputs to the discriminator's hidden layer. Numerical and non-numerical vectors are learned based on nonlinear transformations. The information extraction module integrates global information to extract features that distinguish real samples from generated samples. The output layer outputs the Wasserstein distance between real samples and generated samples.

6. The industrial internet anomaly detection method based on deep generative adversarial networks according to claim 1, characterized in that, The information extraction module is used to perform feature processing on the hidden layer outputs of the generator, discriminator, and auxiliary classifier, including: The information extraction module includes a position encoder and a Transformer encoder, applied after the hidden layers of the generator, discriminator, and auxiliary classifier. The data input to the information extraction module is processed through multiple sets of weight matrices. , and Perform a linear transformation to generate a query vector. Key vector Sum value vector ,pass and The dot product is used to calculate the similarity relationship between different features; The and The formula for calculating the dot product is as follows: 。

Images