Industrial control network unsupervised anomaly detection method and system based on space-time codec

Abstract

The invention belongs to the technical field of network security, and discloses an industrial control network unsupervised anomaly detection method and system based on a space-time codec, and the method comprises the following steps: 1, carrying out the data processing and sample construction of an industrial control network sensor; performing sampling and data processing on the historical sensor original data and the time sequence to obtain a sample sequence; step 2, constructing an unsupervised deep learning model based on a space-time codec and training the unsupervised deep learning model; step 3, sensor data spatio-temporal characteristic analysis, and outputting sensor data in a future predetermined time period as a predicted value; and 4, abnormal alarm: determining a confidence space by combining the predicted value output in the step 3 and the confidence coefficient, and triggering network abnormal alarm when the current actual sensor data exceeds a normal range. According to the invention, the identification rate and generalization of industrial control network anomaly detection are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular to an unsupervised anomaly detection method and system for an industrial control network based on a spatiotemporal codec. Background Art

[0002] Traditional anomaly detection methods for industrial control networks mainly rely on parsing and identifying abnormal communication behaviors of general Internet protocols, and matching them according to preset rules and feature values ​​to achieve security filtering. However, these methods have defects such as low recognition rate and weak generalization, and it is difficult to effectively deal with complex network attacks and dynamic threats. However, in industrial control systems, the system status can be reflected by the readings of internal sensors, and any unauthorized intrusion may cause abnormal changes in the values ​​of these sensors. Therefore, abnormal behaviors in the production process can be discovered by analyzing the time series data and spatial topological structure of sensors, which is crucial to maintaining the security of industrial control systems.

[0003] Given the complexity and real-time requirements of industrial control networks, anomaly detection methods based on spatiotemporal feature analysis are particularly important. Spatiotemporal feature analysis can capture the timing characteristics and spatial correlations in industrial control networks, thereby more accurately identifying abnormal behaviors. For example, by analyzing the periodic patterns and time sequence in sensor data, a normal behavior model can be constructed, and deviations from the expected behavior model can be detected based on this, thereby achieving anomaly detection. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention proposes an unsupervised anomaly detection method and system for industrial control networks based on spatiotemporal codecs, and uses them for anomaly detection in industrial control networks. The present invention adopts two branches, one for spatiotemporal feature analysis tasks, and the other for spatiotemporal self-supervised learning tasks. The two branches share the same spatiotemporal encoder, which is used to generate potential representations for understanding the global spatiotemporal context, thereby improving its generalization performance and robustness of anomaly detection. The raw data of engineering control network sensors usually include network load, temperature, humidity, current, voltage, flow rate and pressure, which can all be used as data for anomaly detection. By training and tuning different time steps and different training parameters, a model with the highest anomaly detection accuracy can be obtained, thereby forming an industrial control network anomaly detection system, providing certain suggestions for the field of network security.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec includes the following steps: Step 1: Sensor data processing and sample construction: Sampling and data processing of historical industrial control sensor raw data and time series to obtain sample sequences; Step 2: Build and train an unsupervised deep learning model based on spatiotemporal codec; The unsupervised deep learning model based on the spatiotemporal codec includes a spatiotemporal feature analysis module, and the spatiotemporal feature analysis module includes a spatiotemporal feature analysis branch and a spatiotemporal self-supervised learning branch, which are used for spatiotemporal feature analysis and spatiotemporal self-supervised learning respectively; Step 3, spatiotemporal feature analysis of sensor data: input the data output from step 1 into the trained unsupervised deep learning model based on the spatiotemporal codec. The spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch work together to output the sensor data for a predetermined period of time in the future as the predicted value. Step 4, abnormal alarm: determine the confidence space based on the predicted value and confidence level output from step 3, and use it as the normal data range for industrial control network detection. When the actual sensor data exceeds the normal range, a network abnormality alarm is triggered.

[0006] Furthermore, the spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch both adopt a spatiotemporal encoder-decoder structure. Specifically, the spatiotemporal feature analysis branch adopts a spatiotemporal encoder-decoder I, including a spatiotemporal encoder I, a frequency enhancement attention module, and a spatiotemporal prediction decoder; the spatiotemporal self-supervised learning branch adopts a spatiotemporal encoder-decoder II, including a spatiotemporal encoder II, a self-supervised learning module, and a spatiotemporal reconstruction decoder; wherein the spatiotemporal encoder-decoder I has the same structure as the spatiotemporal encoder II; In the spatiotemporal feature analysis branch, the long-term spatiotemporal dynamic information of the sensor data is encoded and integrated through the spatiotemporal encoder I to obtain the latent feature space matrix , then the latent feature space matrix is ​​captured by the frequency-enhanced attention module and the spatiotemporal prediction decoder The spatiotemporal dynamics of In the spatiotemporal self-supervised learning branch, a masking algorithm for spatiotemporal data is introduced, and patches are randomly masked using spatiotemporal agnostic sampling. The data is subjected to spatiotemporal self-supervised learning, and the masked data is completed and reconstructed through a spatiotemporal reconstruction decoder, and the output is , and the reconstructed data is compared with the spatiotemporal encoder I calculated in the spatiotemporal feature analysis branch. The results are placed in the latent space for alignment and comparison, and the improvement of the spatiotemporal encoder I of the spatiotemporal feature analysis branch is continuously guided.

[0007] Furthermore, in step 3, before the sensor data is input into the spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch, the following processing is performed: the sensor data is first subjected to preliminary feature extraction and nonlinear transformation through a feedforward neural network to obtain a sensor data signal matrix E, and then the spatial and temporal information is integrated through a spatiotemporal feature embedding module to generate an embedded representation of the fused spatiotemporal information, and the spatiotemporal embedding matrix E' of the sensor data signal matrix sequence is output.

[0008] Furthermore, in step 3, the data processing process in the spatiotemporal feature analysis branch is as follows: (1) First, the original sensor data matrix of the spatiotemporal feature analysis branch is transformed into Project to In which C is the characteristic number; (2) Then Input spatiotemporal encoder I, which is connected to stack L spatiotemporal attention modules. Together with E´, it is the long-term spatiotemporal dynamic information of sensor data, which is encoded and integrated to obtain the potential feature space matrix ; (3) Then enter the frequency enhancement attention module, the formula is: ; in, is the output of the frequency enhancement attention module, is the Fourier transform formula of the frequency enhancement attention module, is the spatiotemporal embedding matrix of the input sensor data signal matrix sequence, is the spatiotemporal embedding matrix of the output sensor data signal matrix sequence; (4) Next, we enter the spatiotemporal prediction decoder, whose input is the output of the frequency enhancement attention module, namely ; Spatiotemporal prediction decoder stack A spatiotemporal attention module captures the spatiotemporal dynamics in the latent space and finally maps it to the predicted target, i.e. the future sensor value, through linear projection. .

[0009] Furthermore, the spatiotemporal attention module includes a spatial attention module and a temporal attention module. The implementation process of the spatial attention module and the temporal attention module is the same. The implementation process of the spatial attention module is as follows: a. Receive input sensor data signal tensor , spatiotemporal embedding STE and mask tensor mask; b. Input sensor data signal tensor It is concatenated with the spatiotemporal embedding STE along the feature dimension to obtain a new tensor X´´; c. Initialize the query and key weight matrices of the multi-head attention mechanism using learnable parameters; d. Perform multi-head attention calculation on the initialized query and key weight matrix G and tensor X´´ to obtain the attention weighted result h; e. Add the attention weighted result h to the input tensor Perform multi-head attention calculations to obtain the final result of the spatial attention mechanism.

[0010] Further, the spatial and temporal attention are operated as follows: The output of the spatiotemporal attention module is expressed as ; Combine it with the spatiotemporal embedding matrix of the input sensor data matrix sequence Connect, get , and Enter the spatiotemporal attention module; Represents all time slices about the node Input, use Indicates time slice Input of all nodes above; In the time dimension, the time of the sensor data signal vector Defined as The time reference point in the temporal attention of the spatiotemporal attention module is calculated as follows in the temporal attention module: ; ; in, For the multi-head self-attention formula, the temporal attention module first pays attention to the input Will Convert to , the updated time reference point Contains the original long input The global sensor data information finally generates the node Time code representation ; The temporal attention module processes the input of each node in parallel, using represents the time-coded representation of all nodes; Similarly, in the spatial dimension, introducing space vector As a spatial reference point, the spatial attention module then processes the input on each time slice in parallel, with the following formula: ; ; in, is the spatial encoding representation of all nodes at time t, represents the spatial encoding representation of all time slices; finally, the output of the spatial attention module is The sum.

[0011] Furthermore, the frequency enhanced attention module includes an encoder, a decoder and a Fourier enhancement structure, wherein the encoder and the decoder both adopt a multi-layer structure, a Fourier enhancement structure is used between the encoder and the decoder, the Fourier enhancement structure adopts Fourier transform and inverse Fourier transform, and uses the Fourier transform frequency enhanced attention mechanism to process the encoder data, the Fourier enhancement structure converts the time domain data into frequency domain data by applying Fourier transform, and executes the Fourier transform frequency enhanced attention mechanism in the frequency domain, and applies the inverse Fourier transform to convert the frequency domain data into time domain data.

[0012] Furthermore, the encoder in the spatiotemporal self-supervised learning branch is the same as the encoder used in the spatiotemporal feature analysis branch. In the spatiotemporal encoder of the spatiotemporal self-supervised learning branch, the mask value in the softmax function input is set to -∞, and the masked sensor data does not participate in the calculation. The output of the spatiotemporal encoder of the spatiotemporal self-supervised learning branch is recorded as ; The input of the spatiotemporal reconstruction decoder is recorded as , which consists of two parts. One part is the spatiotemporal encoder output of the spatiotemporal self-supervised learning branch. ,The other part is the mask marker vector, which occupies all the mask positions and reveals the missing of the true value; Refactoring the decoder stack A spatiotemporal attention module recovers the sensor data in the latent space and finally outputs , which is calculated by the spatiotemporal encoder in the spatiotemporal feature analysis branch Match.

[0013] Furthermore, in the spatiotemporal self-supervised learning branch, a masking algorithm based on spatiotemporal feature data is used to perform self-supervised learning on sensor data. First, the sensor data signal matrix is ​​divided into small blocks, i.e., a block with a length of Then, the patch is randomly masked using spatiotemporal agnostic sampling; The steps for self-supervised learning of sensor data are as follows: (1) Input raw sensor data matrix , P is the length of the input sensor data matrix sequence, N is the number of sensors, and C is the number of features; (2) Generate mask tensor , the elements of the tensor are set to 1; (3) Divide the sensor data signal matrix into patches, namely , ; (4) Calculate the number of mask patches ; (5) Randomly from Extract The corresponding patch index is recorded as ; (6) Loop traversal ; (7) The tensor The All elements of the patch are set to 0; (8) Output mask tensor .

[0014] The present invention also provides an unsupervised anomaly detection system for industrial control networks based on a spatiotemporal codec, which is used to implement the unsupervised anomaly detection method for industrial control networks based on a spatiotemporal codec as described above, wherein the system includes a data processing module, a sample construction module, an unsupervised deep learning model based on a spatiotemporal codec, and an anomaly warning module; The data processing module performs data cleaning and standardization operations on the raw sensor data; The sample construction module is used to collect historical sensor data to obtain a sensor data sequence, obtain multiple sensor data subsequences in a sliding window form, and use the normalized sensor data subsequences as sample sequences; The unsupervised deep learning model based on the spatiotemporal codec includes a spatiotemporal feature analysis module, which includes a spatiotemporal feature analysis branch and a self-supervised learning branch, performs sensor data prediction for each sensor data sequence to be tested, and outputs sensor data for a predetermined period of time in the future as a prediction result; The abnormal warning module is used to determine the confidence space as the normal range of the sensor value, and trigger the industrial control network abnormal warning when the actual sensor value at the current moment is not within the normal range.

[0015] Compared with the prior art, the present invention has the following advantages: (1) This paper combines self-supervised learning technology with spatiotemporal attention mechanism to propose a method suitable for anomaly detection in industrial control networks, an anomaly detection method based on spatiotemporal feature analysis. It combines the advantages of both, improves data utilization efficiency, and enables the anomaly detection model to have good generalization ability.

[0016] (2) Use a multi-task learning framework to learn multiple tasks simultaneously; by training and tuning different time steps and different training parameters, a model with the highest anomaly detection accuracy can be obtained, and an anomaly detection system can be formed, which improves the ability to extract features from long time slices, improves the ability to capture long-term dynamic information and global correlation information, and improves the accuracy of anomaly detection in the field of industrial control networks, providing certain suggestions for the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 This is a schematic diagram of the structure of the abnormality detection module of the present invention; Figure 3 Schematic diagram of Fourier enhancement structure; Figure 4 Branch architecture diagram for spatiotemporal feature analysis; Figure 5 It is a schematic diagram of the structure of the unsupervised anomaly detection system for industrial control networks based on spatiotemporal codec of the present invention; Figure 6 Graph showing the prediction results obtained in the embodiment of the present invention; Figure 7 This is a comparison chart of the effects of the embodiment of the present invention and other methods on the Abilene dataset; Figure 8 4 is a comparison chart of the prediction results and the true values ​​obtained in the embodiment of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0020] The present invention takes self-supervised learning and frequency-enhanced attention mechanism as the theoretical basis, integrates time and space features, proposes a new anomaly detection method suitable for industrial control networks, and forms a system based on the anomaly detection method based on time and space feature analysis. Figure 1 shown.

[0021] like Figure 2 and Figure 5 As shown, the present invention designs an anomaly detection module, including an unsupervised deep learning model based on a spatiotemporal codec and an anomaly warning module. The model adopts a multi-task learning framework, and the overall architecture of the model adopts two branches, one for the spatiotemporal feature analysis task of sensor data, and the other for the spatiotemporal self-supervised learning task of sensor data signals. The two branches share the same spatiotemporal encoder, which is used to generate a potential representation of the input that understands the global spatiotemporal context, thereby improving its generalization performance and prediction robustness.

[0022] The design process of the present invention is: sensor data processing and sample construction; construction of an unsupervised deep learning model based on spatiotemporal codec (including building an embedding module that integrates spatiotemporal features; building a spatiotemporal attention module; building a frequency enhancement attention module; building a spatiotemporal feature analysis branch; building a spatiotemporal self-supervised learning branch; defining loss functions and evaluation indicators); building an anomaly warning module; forming an anomaly detection module, and then forming an anomaly detection system; method effect evaluation. The following will introduce each part in detail.

[0023] Combination Figure 1-Figure 4 As shown, the unsupervised anomaly detection method for industrial control networks based on spatiotemporal codecs of this embodiment includes the following steps: step 1, sensor data processing and sample construction; step 2, construction and training of an unsupervised deep learning model based on spatiotemporal codecs; step 3, spatiotemporal feature analysis of sensor data; step 4, abnormal alarm. Each step is described in detail below.

[0024] Step 1: Sensor data processing and sample construction: Sampling and data processing of historical sensor raw data and time series to obtain sample sequences.

[0025] This step is to perform historical data extraction operations to collect the raw data generated by sensors in the industrial control network (system) within a specified time range.

[0026] It should be noted that the raw data of the industrial control network sensor includes network load, temperature, humidity, current, voltage, flow rate and pressure, which can be used as data for abnormal detection. In this embodiment, the network load parameter is used as an example for explanation, which will be described in detail later.

[0027] First, the sensor data related to the time series is extracted from the original sensor data to form a sensor data signal matrix. The sensor data network is denoted as G, and the sensor data signal matrix represented at time slice t is , where the network G consists of a set of sensors, denoted as node set V, and , is the feature vector of node v observed at time t, and C is the number of features.

[0028] The historical sensor data and time series are sampled in the form of a sliding window to obtain multiple sensor data subsequences, and each sensor data subsequence is normalized to map the original sequence data to the [1,0] interval. The specific method is: first calculate the maximum and minimum values ​​of the sequence data, which are recorded as and , for each data in the sequence data conduct Calculate and take the normalized sensor data subsequence as the sample sequence.

[0029] Based on the characteristics of time series sensor data, more time-related features can be mined. Use time-of-day to model the behavior patterns and change patterns in different time periods of a day, and capture the periodicity and trend of data changes over time. Use day-of-week to model the behavior patterns and change patterns of different days of the week, and capture the periodicity and seasonality of data with the day of the week.

[0030] Finally, the sensor data is standardized so that it is distributed within the same mean and standard deviation range to improve the effect of model training and anomaly detection.

[0031] Step 2: Build and train an unsupervised deep learning model based on spatiotemporal codec; The unsupervised deep learning model based on the spatiotemporal codec includes a spatiotemporal feature analysis module, and the spatiotemporal feature analysis module includes a spatiotemporal feature analysis branch and a spatiotemporal self-supervised learning branch, which are used for spatiotemporal feature analysis and spatiotemporal self-supervised learning, respectively.

[0032] The spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch both adopt a spatiotemporal encoder-decoder structure. Specifically, the spatiotemporal feature analysis branch adopts a spatiotemporal codec I, including a spatiotemporal encoder I, a frequency enhancement attention module, and a spatiotemporal prediction decoder; the spatiotemporal self-supervised learning branch adopts a spatiotemporal codec II, including a spatiotemporal encoder II, a self-supervised learning module, and a spatiotemporal reconstruction decoder; wherein, the spatiotemporal codec I has the same structure as the spatiotemporal encoder II, that is, the spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch share a spatiotemporal encoder.

[0033] Step 3: Spatiotemporal feature analysis of sensor data: Input the data output from step 1 into the trained unsupervised deep learning model based on the spatiotemporal codec. The spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch work together to output the sensor data for a predetermined period in the future as the predicted value.

[0034] In the spatiotemporal feature analysis branch, the long-term spatiotemporal dynamic information of sensor data is embedded into In (the long-term spatiotemporal dynamic information of sensor data is encoded and integrated through the spatiotemporal encoder I to obtain the potential feature space matrix ), and then captures the spatiotemporal dynamics in the latent space via a frequency-enhanced attention module and a spatiotemporal prediction decoder.

[0035] In the spatiotemporal self-supervised learning branch, a masking algorithm for spatiotemporal data is introduced, and the patch is randomly masked with spatiotemporal agnostic sampling. The sensor data is subjected to spatiotemporal self-supervised learning, and the masked data is completed and reconstructed through the spatiotemporal reconstruction decoder I, and the output is , and the reconstructed data is compared with the spatiotemporal encoder I calculated in the spatiotemporal feature analysis branch. The results are placed in the latent space for alignment and comparison, and the spatiotemporal encoder I of the spatiotemporal feature analysis branch is continuously guided to improve; the two branches work together and finally output the sensor data of the predetermined time period in the future as the predicted value.

[0036] It should be noted that in step 3, before the sensor data is input into the spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch, the following processing is performed: the sensor data is first subjected to preliminary feature extraction and nonlinear transformation through a feedforward neural network to obtain the sensor data signal matrix E, and then the spatiotemporal feature embedding module integrates the spatial and temporal information to generate an embedded representation of the fused spatiotemporal information, and outputs the spatiotemporal embedding matrix E' of the sensor data signal matrix sequence. Such processing can effectively provide high-quality input data for the subsequent spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch.

[0037] As an example, the sensor data is first sent to a feedforward neural network, which consists of an input layer, multiple hidden layers and an output layer. The sensor data is transmitted unidirectionally in the network, and the output of the attention head is nonlinearly transformed to obtain the sensor data signal matrix sequence , where P is the length of the input sensor data matrix sequence, N is the number of sensors, and d is a parameter; then a spatiotemporal embedding module that integrates spatiotemporal features is built, combining spatial embedding (SE) and temporal embedding (TE) to generate an embedded representation that integrates spatiotemporal information, and outputs the spatiotemporal embedding matrix of the sensor data signal matrix sequence , where Q is the length of the output sensor data matrix sequence.

[0038] Note: The spatiotemporal embedding module is an operation performed on the input data to extract spatiotemporal features from the sensor data. It is located before the encoders in the two branches. Figure 1 Inside the "branch" of Figure 2 "Before inputting the encoder", the spatiotemporal information is first embedded.

[0039] The input of the spatiotemporal feature analysis branch is the original data (processed sample data), and in the spatiotemporal self-supervised learning branch, some data is randomly masked from the original data (processed sample data), and the input is the damaged data. Therefore, the two branches do not input the same data, and the spatiotemporal self-supervised learning branch has one more masking process than the feature analysis branch.

[0040] In step 2, the spatiotemporal feature analysis branch includes a spatiotemporal encoder, a frequency enhancement attention module, and a spatiotemporal prediction decoder, such as Figure 4 shown.

[0041] S201, build spatiotemporal attention module: The spatiotemporal attention module includes a spatial attention module and a temporal attention module. The implementation process of the spatial attention module and the temporal attention module is the same. The spatial and temporal attention mechanisms are used to perform weighted aggregation of input sensor data in spatial and temporal dimensions to capture the importance of sensor data in space and time. The implementation process of the spatial attention module is as follows: a. Receive input sensor data signal tensor , spatiotemporal embedding STE and mask tensor mask; b. Input sensor data signal tensor It is concatenated with the spatiotemporal embedding STE along the feature dimension to obtain a new tensor X´´; c. Initialize the query and key weight matrices of the multi-head attention mechanism using learnable parameters I; d. Perform multi-head attention calculation on the initialized query and key weight matrix G and tensor X´´ to obtain the attention weighted result h; e. Add the attention weighted result h to the input tensor Perform multi-head attention calculations to obtain the final result of the spatial attention mechanism.

[0042] To better encode the generalized global patterns of sensor data, spatial and temporal attention are operated as follows: The output of the spatiotemporal attention module is expressed as ; Combine it with the spatiotemporal embedding matrix of the input sensor data matrix sequence Connect, get , and Enter the spatiotemporal attention module; Represents all time slices about the node Input, use Indicates time slice Input to all nodes above.

[0043] In the time dimension, the time of the sensor data signal vector Defined as The time reference point in the temporal attention of the spatiotemporal attention module is calculated as follows in the temporal attention module: ; ; in, For the multi-head self-attention formula, the temporal attention module first pays attention to the input Will Convert to , the updated time reference point Contains the original long input The global sensor data information finally generates the node Time code representation ; The temporal attention module processes the input of each node in parallel, using Represents the time-coded representation of all nodes.

[0044] Similarly, in the spatial dimension, introducing space vector As a spatial reference point, the spatial attention module then processes the input on each time slice in parallel, with the following formula: ; ; in, is the spatial encoding representation of all nodes at time t, represents the spatial encoding representation of all time slices; finally, the output of the spatial attention module is The sum.

[0045] S202, construct frequency enhancement attention module: The frequency enhancement attention module includes an encoder, a decoder, and a Fourier enhancement structure, wherein both the encoder and the decoder adopt a multi-layer structure, and a Fourier enhancement structure is used between the encoder and the decoder. The Fourier enhancement structure adopts Fourier transform and inverse Fourier transform, and uses the Fourier transform frequency enhancement attention mechanism to process the encoder data. The Fourier enhancement structure converts the time domain data into frequency domain data by applying Fourier transform, and performs the Fourier transform frequency enhancement attention mechanism in the frequency domain, and applies the inverse Fourier transform to convert the frequency domain data into time domain data. The frequency enhancement attention module improves the performance of the model by combining the encoder, the decoder, and the Fourier enhancement structure, and enhances the model's ability to extract frequency domain features by adaptively modeling the frequency information of different channels of the input sequence.

[0046] As an example, the encoder adopts a multi-layer structure as follows: , where k represents the number of encoder layers, , Represent the sensor data sequences of the kth and k-1th layers of the encoder respectively, is the embedded historical sensor data sequence, for: ; ; ; in, They represent the seasonal components of the sensor data after the jth decomposition block of the kth layer, Breaking down the blocks for hybrid experts; It is a frequency enhancement attention module implemented through discrete Fourier transform (DFT) mechanism.

[0047] The decoder also adopts a multi-layer structure. ,in represents the number of decoder layers, denote the seasonal component and trend component of the sensor data of the decoder layer p, respectively, denote the seasonal component and trend component of the sensor data in the p-1th layer of the decoder, respectively. The formalization is: ; ; ; ; ; in, Respectively represent the pth layer The seasonal component and trend component of the sensor data after decomposition blocks, Indicates The projection of the extracted trend, Break down blocks for hybrid experts, For the frequency enhancement attention module, Enhanced attention mechanism for frequency, is the feed-forward layer; the final prediction is The sum of these two refined decomposition components, where is the seasonal component of the depth conversion Project to the target dimension.

[0048] The Fourier enhancement structure uses discrete Fourier transform DFT, which is defined as , where i is the imaginary unit, , is a complex sequence in the frequency domain. Similarly, the inverse DFT is defined as .

[0049] Combination Figure 3 As shown, the input of the Fourier enhancement structure ( ) First use Linear projection is q is then converted from the time domain to the frequency domain, and the Fourier transform of q is recorded as . Where D is the model hidden layer parameter. In the frequency domain, only the randomly selected M modes are retained, using the selection operator , ; in, is the Fourier transform, And M is much smaller than N; ; in, is the Fourier transform formula of the frequency enhancement attention module, is the inverse Fourier transform, is a randomly initialized parameterized kernel; let and , That is: ,in, is the input channel and is the output channel; Padding(·) is The result is zero-filled to , and then perform an inverse Fourier transform back to the time domain.

[0050] The frequency-enhanced attention module uses the Fourier transform frequency-enhanced attention mechanism. The input is the query, key, and value. In the cross-attention, the query comes from the decoder, and the key and value come from the encoder, and are obtained through the following three formulas: ; ; ; in, , is the weight matrix. The attention formula is: ; In FEA-f, the query, key, and value are transformed by Fourier transform, and a similar attention mechanism is performed in the frequency domain by randomly selecting M patterns. The Fourier transformed representation is denoted as , the operating formula in FEA-f is as follows, ; ; ; ; in, is the activation function, let and , zero padding is performed before the inverse Fourier transform.

[0051] S203, constructing a spatiotemporal feature analysis branch: The structure of this branch is as follows Figure 4 As shown in the figure, the data processing process in the spatiotemporal feature analysis branch is as follows: (1) First, the original sensor data matrix of the spatiotemporal feature analysis branch is transformed into Project to In which, P is the length of the input sensor data matrix sequence, N is the number of sensors, C is the number of features, and d is the parameter; (2) Then Input spatiotemporal encoder, which is connected to stack L spatiotemporal attention modules and The long-term spatiotemporal dynamic information of sensor data is embedded in The medium- and long-term spatiotemporal dynamic information is encoded and integrated to obtain the potential feature space matrix ),and ; (3) Then enter the frequency enhancement attention module, the formula is: ; in, is the output of the frequency enhancement attention module, is the Fourier transform formula of the frequency enhancement attention module, is the spatiotemporal embedding matrix of the input sensor data signal matrix sequence, is the spatiotemporal embedding matrix of the output sensor data signal matrix sequence, is the matrix output from step (2).

[0052] (4) Next, we enter the spatiotemporal prediction decoder, whose input is the output of the frequency enhancement attention module, namely ; Spatiotemporal prediction decoder stack A spatiotemporal attention module captures the spatiotemporal dynamics in the latent space and finally maps it to the predicted target, i.e. the future sensor value, through linear projection. .in, Figure 4 The y in is a predicted value of the output, that is, the value of a sensor at a certain moment. is a matrix containing the predicted values ​​of all sensors, and y is an element of .

[0053] S204. Construct spatiotemporal self-supervised learning branch: Sensor data is redundant in the time dimension, so it is necessary to mask the continuous part of the sensor data sequence as much as possible to construct a self-supervised learning task to prevent it from recovering a discrete missing value from adjacent time windows. In addition, masking should be performed along the time and space dimensions to capture spatiotemporal dependencies.

[0054] The present invention introduces a masking algorithm for spatiotemporal data and performs spatiotemporal self-supervised learning on sensor data.

[0055] First, the sensor data signal matrix is ​​divided into small blocks, that is, a block with a length of Then, the patches are randomly masked using spatiotemporal agnostic sampling, and each step is described in detail later.

[0056] The spatiotemporal self-supervised learning branch includes the spatiotemporal encoder II, the self-supervised learning module, and the spatiotemporal reconstruction decoder.

[0057] As a preferred implementation, in the spatiotemporal self-supervised learning branch, a masking algorithm based on spatiotemporal feature data is used to perform self-supervised learning on sensor data. First, the sensor data signal matrix is ​​divided into small blocks, i.e., a block with a length of Then, the patches are randomly masked using spatiotemporally agnostic sampling.

[0058] Among them, the steps of sensor data self-supervised learning are as follows: (1) Input raw sensor data matrix , P is the length of the input sensor data matrix sequence, N is the amount of sensor data, and C is the number of features; (2) Generate mask tensor , the elements of the tensor are set to 1; (3) Divide the sensor data signal matrix into patches, namely , ; (4) Calculate the number of mask patches (Round down); (5) Randomly from Extract The corresponding patch index is recorded as ; (6) Loop traversal ; (7) The tensor The All elements of the patch are set to 0; (8) Output mask tensor .

[0059] The encoder in the spatiotemporal self-supervised learning branch is the same as the encoder used in the spatiotemporal feature analysis branch. In the spatiotemporal encoder of the spatiotemporal self-supervised learning branch, the mask value in the softmax function input is set to -∞, so that the masked sensor data does not participate in the calculation. The output of the spatiotemporal encoder of the spatiotemporal self-supervised learning branch is recorded as .

[0060] The input of the spatiotemporal reconstruction decoder is recorded as , which consists of two parts. One part is the spatiotemporal encoder output of the spatiotemporal self-supervised learning branch. , the other part is the mask marker vector, which occupies all mask positions and reveals the absence of true values; the mask marker vector is shared and trained with the entire model, indicating that there are mask patches that need to be restored.

[0061] Refactoring the decoder stack A spatiotemporal attention module recovers the sensor data in the latent space and finally outputs , which is calculated by the spatiotemporal encoder in the spatiotemporal feature analysis branch Match.

[0062] S205. Define loss function and evaluation index.

[0063] Three commonly used evaluation indicators are selected as the prediction accuracy indicators of the model, namely, mean absolute error (MAE), mean square error (MSE) and root mean square error (RMSE). MAE is selected as the loss function, and the real sensor data and the predicted value of the sensor data are used to calculate the evaluation indicators. The specific formula can be referred to the existing technology and will not be repeated here. For mean absolute error (MAE), mean square error (MSE) and root mean square error (RMSE), the closer the value is to 0, the more accurate the predicted data is.

[0064] Step 4: Abnormal warning: Determine the confidence space by combining the predicted value and confidence level output in step 3, and use it as the normal data range for industrial control network detection. When the actual sensor data exceeds the normal range, a network abnormality alarm is triggered.

[0065] Specifically, the predicted values ​​of future sensor values , the 95% confidence interval is . for The lower limit of the corresponding confidence space is for The upper limit of the corresponding confidence space. Taking it as the normal data range for industrial control network detection, the 95% confidence space means that in the process of repeated sampling and prediction, about 95% of the prediction intervals will contain the true sensor value. If the actual observed sensor value exceeds this normal range, that is, exceeds the lower limit or upper limit of the confidence space, then this may indicate an abnormal situation, and the system should trigger an abnormal warning for the industrial control network.

[0066] As a preferred embodiment, in industrial control systems, network loads are key parameters, and their abnormal fluctuations may indicate equipment failure or network attacks.

[0067] As an application example, this embodiment proposes an unsupervised anomaly detection method based on a spatiotemporal codec, which specifically performs anomaly detection on network load (bandwidth, latency, throughput, network traffic, etc.).

[0068] First, the historical sensor data of network load in industrial control systems is collected, the data is cleaned, noise and outliers are removed, and the data is standardized to have a unified dimension and range. The sliding window technology is used to extract multiple subsequences from the historical data to form a sample sequence, each of which contains the network load data within a certain time window.

[0069] Next, an unsupervised deep learning model based on the spatiotemporal codec is constructed, and the spatiotemporal feature analysis branch is responsible for analyzing the spatiotemporal characteristics of network load data.

[0070] The spatiotemporal self-supervised learning branch uses a masking algorithm to perform self-supervised learning on the data to improve the generalization ability of the model. The sample sequence is initially extracted and nonlinearly transformed through a feedforward neural network, and spatial and temporal information is integrated to generate an embedded representation that integrates spatiotemporal information. The embedded representation that integrates spatiotemporal information is input into the spatiotemporal codec, and the long-term spatiotemporal dynamic information of the network load data is captured through the spatiotemporal attention module. In self-supervised learning, the network load data is masked, and part of the data is randomly blocked, forcing the model to learn and predict the masked data from the remaining data. The masked data is completed and reconstructed through the spatiotemporal reconstruction decoder, and compared with the original data to optimize the model performance.

[0071] Finally, the real-time network load data is input into the trained model to predict the sensor data (network load data) for future time periods.

[0072] The confidence space is determined based on the predicted value and confidence level output by the model as the normal data range. When real-time data exceeds the normal range, an abnormal alarm is triggered.

[0073] The accuracy and robustness of the model are evaluated by comparing the network load data predicted by the model with the actual data. In practical applications, this method can effectively identify abnormal fluctuations in network load, issue early warnings in a timely manner, and reduce potential equipment failures and safety risks. This method not only improves the accuracy of anomaly detection, but also enhances the generalization ability and robustness of the model, providing a strong guarantee for the stable operation of industrial control systems.

[0074] In order to verify the effectiveness and advancement of the model, this embodiment selects the real data sets Abilene and GEANT data sets to carry out anomaly detection of industrial control networks. The Abilene data set collects 24 weeks of traffic data statistics containing 12 nodes in a certain year, generating a sample every 5 minutes, totaling 48,384 samples, and each sample consists of a 12×12 data matrix. The network composition of GEANT includes 23 nodes and 38 links. The complete data set consists of 4 months of statistical data with a collection interval of 15 minutes. There are 10,773 samples in total, and each sample consists of 23×23 data. The data set is divided into training set, validation set, and test set according to the ratio of 6:2:2. The model receives data from the past 4 hours to predict the network load in the next 4 hours.

[0075] The experiment was conducted on a computer with an NVIDIA GeForce RTX 3090 graphics card. The experimental environment was based on Python version 3.12, and the deep learning framework PyTorch version 2.5.1 was used to build and implement the model under study.

[0076] Use the trained model to make predictions. In this example, network traffic is used as an example to make predictions. The prediction results are as follows: Figure 6 shown.

[0077] In order to prove the effectiveness of the proposed scheme, this scheme also selected ARIMA, SVR, GRU, GCN and T-GCN for comparative experiments with the method proposed in this invention. The detailed information of the experimental results is shown in Table 1 below, which is a comparison of MAE, MSE and RMSE.

[0078] Table 1 Comparison of MAE, MSE and RMSE between the present invention and the existing methods

[0079] From the comparison results, it can be seen that the unsupervised deep learning model based on the spatiotemporal codec has a significant advantage in prediction accuracy. Taking the Abilene dataset as an example, compared with the ARIMA model, this model has achieved significant progress in the accuracy of network traffic prediction. This model achieved a 4.65% reduction in MAE and a 12.63% reduction in RMSE. Compared with the SVR model, this model reduced MAE by 3.78% and RMSE by 9.93%. Compared with the T-GCN model, this model achieved a 1.67% reduction in MAE and a 3.39% reduction in RMSE. The difference in the effect of this model and other methods on the Abilene dataset is shown below. Figure 7 The output parameters of some network traffic prediction values ​​are shown in Table 2.

[0080] Table 2 Parameters of actual flow rate and predicted value

[0081] Get the comparison between the predicted result and the true value Figure 8 As shown in Table 3, the predicted value and the true value are kept within a very small gap. Next, the confidence space for anomaly detection is determined based on the prediction results. Using a 95% confidence space, the results are shown in Table 3.

[0082] Table 3 Confidence space of traffic anomaly detection

[0083] The confidence interval is the normal range. If the actual value exceeds this normal range, an abnormal alarm will be triggered.

[0084] As another embodiment of the present invention, an unsupervised anomaly detection system for an industrial control network based on a spatiotemporal codec is provided, which is used to implement the unsupervised anomaly detection method for an industrial control network based on a spatiotemporal codec as described above. Figure 1 and Figure 5 As shown, the system includes a data processing module, a sample construction module, an unsupervised deep learning model based on spatiotemporal codec, and an abnormal warning module.

[0085] That is to say, the present invention finally forms an industrial control network anomaly detection system through the various modules constructed previously. The anomaly detection system includes a (sensor data) data processing module, a (sensor data) sample construction module, a model construction module, a (sensor data) spatiotemporal feature analysis module and an anomaly warning module. The system executes the above method to perform industrial control network anomaly detection.

[0086] The data processing module performs data cleaning and standardization operations on the raw sensor data, and mines more time-related features based on the characteristics of the time series sensor data. The sensor data network is denoted as G, and the sensor data signal matrix represented at time slice t is , where the sensor data network G consists of a set of sensors, denoted as node set V, and , is the feature vector of node v observed at time t, and C is the number of features.

[0087] The sample construction module is used to collect historical sensor data to obtain a sensor data sequence, obtain multiple sensor data subsequences in the form of a sliding window, and use the normalized sensor data subsequences as sample sequences. The specific method of normalization is: first calculate the maximum and minimum values ​​of the sequence data, which are recorded as and , for each data in the sequence data conduct Calculate and take the normalized sensor data subsequence as the sample sequence.

[0088] The model building module uses each sensor data subsequence to train an unsupervised deep learning model based on the spatiotemporal codec, inserts the spatiotemporal embedding module, spatiotemporal attention module, and frequency enhanced attention module of the sensor data that integrates spatiotemporal features in the above method, builds an industrial control network anomaly detection model, and trains the model based on the corresponding sample sequence to obtain the trained industrial control network anomaly detection model.

[0089] The spatiotemporal feature analysis module includes a spatiotemporal feature analysis branch and a self-supervised learning branch. For each sensor data sequence to be tested, the self-supervised spatiotemporal frequency enhanced attention model corresponding to the input is used to predict sensor data, and the sensor data of the future predetermined period is output as the prediction result. This module mainly uses the spatiotemporal feature analysis branch and the self-supervised learning branch based on sensor data in the above method. The specific data processing and function implementation process will not be repeated here.

[0090] The abnormal warning module judges the real-time sensor actual value and compares it with the confidence space. If it falls within the normal range, it works normally. If the actual sensor value at the current moment is not within the normal range, it triggers the industrial control network abnormal warning, notifies relevant personnel or automatically starts the preset response measures.

[0091] In summary, the present invention combines self-supervised learning technology with spatiotemporal frequency enhanced attention mechanism, combines the advantages of both, improves data utilization efficiency, and enables the anomaly detection model to have good generalization ability. By integrating time and space features, an anomaly detection method suitable for industrial control networks is proposed, namely, an unsupervised anomaly detection method for industrial control networks based on spatiotemporal codecs, and a system is formed. Using a multi-task learning framework, multiple tasks are learned at the same time, the ability to extract features of long time slices is improved, and the technical bottleneck of the current model's poor long-term global spatiotemporal feature extraction ability and high time complexity is broken through, and the ability to capture long-term dynamic information and global correlation information is improved, and the accuracy of anomaly detection in the field of industrial control is improved.

[0092] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Any changes, modifications, additions or substitutions made by ordinary technicians in this technical field within the essential scope of the present invention should fall within the protection scope of the present invention.

Claims

1. An unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec, characterized in that: The following steps are involved: Step 1: Sensor data processing and sample construction: Sampling and data processing of historical industrial control sensor raw data and time series to obtain sample sequences; Step 2: Build and train an unsupervised deep learning model based on spatiotemporal codec; The unsupervised deep learning model based on the spatiotemporal codec includes a spatiotemporal feature analysis module, and the spatiotemporal feature analysis module includes a spatiotemporal feature analysis branch and a spatiotemporal self-supervised learning branch, which are used for spatiotemporal feature analysis and spatiotemporal self-supervised learning respectively; Step 3: Spatiotemporal feature analysis of sensor data: The data output from step 1 is input into the trained unsupervised deep learning model based on spatiotemporal codec. The spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch work together to output the sensor data of the future predetermined period as the predicted value. Step 4, abnormal alarm: Combine the predicted value and confidence level output in step 3 to determine the confidence space, and use it as the normal data range for industrial control network detection. When the actual sensor data exceeds the normal range, a network abnormal alarm is triggered.

2. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 1 is characterized in that: The spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch both adopt a spatiotemporal encoder-decoder structure. Specifically, the spatiotemporal feature analysis branch adopts a spatiotemporal encoder-decoder I, including a spatiotemporal encoder I, a frequency enhancement attention module, and a spatiotemporal prediction decoder; the spatiotemporal self-supervised learning branch adopts a spatiotemporal encoder-decoder II, including a spatiotemporal encoder II, a self-supervised learning module, and a spatiotemporal reconstruction decoder; wherein the spatiotemporal encoder-decoder I has the same structure as the spatiotemporal encoder II; In the spatiotemporal feature analysis branch, the long-term spatiotemporal dynamic information of the sensor data is encoded and integrated through the spatiotemporal encoder I to obtain the latent feature space matrix , then the latent feature space matrix is ​​captured by the frequency-enhanced attention module and the spatiotemporal prediction decoder The spatiotemporal dynamics of In the spatiotemporal self-supervised learning branch, a masking algorithm for spatiotemporal data is introduced, and patches are randomly masked using spatiotemporal agnostic sampling. The data is subjected to spatiotemporal self-supervised learning, and the masked data is completed and reconstructed through a spatiotemporal reconstruction decoder, and the output is , and the reconstructed data is compared with the spatiotemporal encoder I calculated in the spatiotemporal feature analysis branch. The results are placed in the latent space for alignment and comparison, and the improvement of the spatiotemporal encoder I of the spatiotemporal feature analysis branch is continuously guided.

3. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 1 is characterized in that: In step 3, before the sensor data is input into the spatiotemporal feature analysis branch and the spatiotemporal self-supervised learning branch, the following processing is performed: the sensor data is first subjected to preliminary feature extraction and nonlinear transformation through a feedforward neural network to obtain the sensor data signal matrix E, and then the spatiotemporal feature embedding module is used to integrate the spatial and temporal information to generate an embedded representation of the fused spatiotemporal information, and the spatiotemporal embedding matrix E´ of the sensor data signal matrix sequence is output.

4. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 3 is characterized in that: In step 3, the data processing process in the spatiotemporal feature analysis branch is as follows: (1) First, the original sensor data matrix X of the spatiotemporal feature analysis branch is linearly transformed to obtain ; (2) Then Input spatiotemporal encoder I, which is connected to stack L spatiotemporal attention modules. Together with E´, it is the long-term spatiotemporal dynamic information of sensor data, which is encoded and integrated to obtain the potential feature space matrix ; (3) Then enter the frequency enhancement attention module, the formula is: ； in, is the output of the frequency enhancement attention module, is the Fourier transform formula of the frequency enhancement attention module, E is the spatiotemporal embedding matrix of the input sensor data signal matrix sequence, and E´ is the spatiotemporal embedding matrix of the output sensor data signal matrix sequence; (4) Next, we enter the spatiotemporal prediction decoder, whose input is the output of the frequency enhancement attention module, namely ; Spatiotemporal prediction decoder stack A spatiotemporal attention module captures the spatiotemporal dynamics in the latent space and finally maps it to the predicted target, i.e. the future sensor value, through linear projection. .

5. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 4 is characterized in that: The spatiotemporal attention module includes a spatial attention module and a temporal attention module. The implementation process of the spatial attention module and the temporal attention module is the same. The implementation process of the spatial attention module is as follows: a. Receive input sensor data signal tensor , spatiotemporal embedding STE and mask tensor mask; b. Input sensor data signal tensor It is concatenated with the spatiotemporal embedding STE along the feature dimension to obtain a new tensor X´´; c. Initialize the query and key weight matrices of the multi-head attention mechanism using learnable parameters; d. Perform multi-head attention calculation on the initialized query and key weight matrix G and tensor X´´ to obtain the attention weighted result h; e. Add the attention weighted result h to the input tensor Perform multi-head attention calculations to obtain the final result of the spatial attention mechanism.

6. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 5 is characterized in that: The spatial and temporal attention are operated as follows: The output of the spatiotemporal attention module is expressed as ; Combine it with the spatiotemporal embedding matrix of the input sensor data matrix sequence Connect, get , and Enter the spatiotemporal attention module; Represents all time slices about the node Input, use Indicates time slice Input of all nodes above; In the time dimension, the time of the sensor data signal vector Defined as The time reference point in the temporal attention of the spatiotemporal attention module is calculated as follows in the temporal attention module: ； ； in, For the multi-head self-attention formula, the temporal attention module first pays attention to the input Will Convert to , the updated time reference point Contains the original long input The global sensor data information finally generates the node Time code representation ; The temporal attention module processes the input of each node in parallel, using represents the time-coded representation of all nodes; Similarly, in the spatial dimension, introducing space vector As a spatial reference point, the spatial attention module then processes the input on each time slice in parallel, with the following formula: ； ； in, is the spatial encoding representation of all nodes at time t, represents the spatial encoding representation of all time slices; finally, the output of the spatial attention module is The sum.

7. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 2 is characterized in that: The frequency enhancement attention module includes an encoder, a decoder and a Fourier enhancement structure, wherein the encoder and the decoder both adopt a multi-layer structure, and a Fourier enhancement structure is used between the encoder and the decoder. The Fourier enhancement structure adopts Fourier transform and inverse Fourier transform, and uses the Fourier transform frequency enhancement attention mechanism to process the encoder data. The Fourier enhancement structure converts time domain data into frequency domain data by applying Fourier transform, and executes the Fourier transform frequency enhancement attention mechanism in the frequency domain, and applies inverse Fourier transform to convert frequency domain data into time domain data.

8. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 2 is characterized in that: The encoder in the spatiotemporal self-supervised learning branch is the same as the encoder used in the spatiotemporal feature analysis branch. In the spatiotemporal encoder of the spatiotemporal self-supervised learning branch, the mask value in the softmax function input is set to -∞, so that the masked sensor data does not participate in the calculation. The output of the spatiotemporal encoder of the spatiotemporal self-supervised learning branch is recorded as ; The input of the spatiotemporal reconstruction decoder is recorded as , which consists of two parts. One part is the spatiotemporal encoder output of the spatiotemporal self-supervised learning branch. ,The other part is the mask marker vector, which occupies all the mask positions and reveals the missing of the true value; Refactoring the decoder stack A spatiotemporal attention module recovers the sensor data in the latent space and finally outputs , which is calculated by the spatiotemporal encoder in the spatiotemporal feature analysis branch Match.

9. The unsupervised anomaly detection method for industrial control networks based on spatiotemporal codec according to claim 8 is characterized in that: In the spatiotemporal self-supervised learning branch, a masking algorithm based on spatiotemporal feature data is used to perform self-supervised learning on sensor data. First, the sensor data signal matrix is ​​divided into small blocks, i.e., a block with a length of Then, the patch is randomly masked using spatiotemporal agnostic sampling; The steps for self-supervised learning of sensor data are as follows: (1) Input raw sensor data matrix , P is the length of the input sensor data matrix sequence, N is the number of sensors, and C is the number of features; (2) Generate mask tensor , the elements of the tensor are set to 1; (3) Divide the sensor data signal matrix into patches, namely , ; (4) Calculate the number of mask patches ; (5) Randomly from Extract The corresponding patch index is recorded as ; (6) Loop traversal ; (7) The tensor The All elements of the patch are set to 0; (8) Output mask tensor .

10. Unsupervised anomaly detection system for industrial control networks based on spatiotemporal codec, characterized in that: Used to implement the unsupervised anomaly detection method for industrial control networks based on a spatiotemporal codec as described in any one of claims 1 to 9, the system includes a data processing module, a sample construction module, an unsupervised deep learning model based on a spatiotemporal codec, and an anomaly warning module; The data processing module performs data cleaning and standardization operations on the raw sensor data; The sample construction module is used to collect historical sensor data to obtain a sensor data sequence, obtain multiple sensor data subsequences in a sliding window form, and use the normalized data subsequences as sample sequences; The unsupervised deep learning model based on the spatiotemporal codec includes a spatiotemporal feature analysis module, which includes a spatiotemporal feature analysis branch and a self-supervised learning branch, performs sensor value prediction for each sensor data sequence to be tested, and outputs the sensor value of a predetermined period in the future as a predicted value; The abnormal warning module is used to determine the confidence space as the normal range of the sensor value, and trigger the industrial control network abnormal warning when the actual sensor value at the current moment is not within the normal range.

Images