Method for distinguishing attack and fault of catalytic cracking fractionation system

Abstract

The invention discloses a method for distinguishing attacks and faults of a catalytic cracking fractionation system, and belongs to the field of industrial control system information security. The method comprises the following steps: firstly, extracting abnormal states of system information domain equipment nodes and physical domain variable nodes, splicing multi-domain abnormal characteristics and then training a KNN model; the modes of the system in attack, fault and normal states are learned; and finally, carrying out online attack and fault discrimination by using the trained KNN model. According to the method, the behavior characteristics of attacks and faults can be comprehensively described by extracting the multilateral characteristics of the information domain and the physical domain, the limitation that abnormal reasons are analyzed only from the perspective of the physical process is overcome, and the distinguishing accuracy can be effectively improved; in addition, the KNN model can effectively reduce the discrimination error problem caused by intersection of individual samples of attack classes and fault classes.

Description

Technical Field

[0001] The present invention belongs to the field of information security of industrial control systems, and more specifically, relates to a method for distinguishing attacks and failures of a catalytic cracking fractionation system. Background Art

[0002] The catalytic cracking fractionation system is the main industrial control system for the production of gasoline, diesel and other products. However, the introduction of the industrial Internet has brought huge information security risks to it, exposing it to the dual threats of attacks and failures. Due to the different protection strategies for attacks and failures, in order to ensure the safe and stable operation of the system, it is necessary to conduct research on methods for identifying attacks and failures, so as to help achieve targeted protection of the system.

[0003] Most of the existing industrial control system attack and fault identification methods use physical process data to achieve identification. For example, the 2022 Journal of Energy Storage Vol. 50 paper "Identification of cyber-attack / outage / fault in zero-energy building with load and energy management strategies" distinguishes cyber attacks, outages, and faults by monitoring battery power, load energy, and node voltage data; the 2023 IEEE Journal of Emerging and Selected Topics in Power Electronics No. 2 paper "Distinguishing Between Cyber ​​Attacks and Faults in Power Electronic Systems—A Noninvasive Approach" distinguishes false data injection attacks and distribution line faults by analyzing voltage and frequency trajectories. However, carefully designed new attacks can forge fault signals, thereby presenting anomalies similar to faults in physical process data, so it is necessary to combine communication network data for collaborative analysis. The article "Stochastic fault and cyber-attack detection and consensus control in multi-agent systems" in the 9th issue of the journal "International Journal of Control" in 2022 uses the Markov method and the hybrid coding and message authentication method to distinguish between attacks and faults in multi-agent systems. Although this method recognizes the importance of comprehensive utilization of bilateral information in the physical domain and the information domain, it is difficult to apply to chemical industrial control systems with multiple variables, high coupling, and multiple nonlinear relationships, and the cost of use is high. How to achieve the identification of attacks and faults in chemical industrial control systems with complex process principles and limited resources is a huge challenge. Summary of the invention

[0004] In view of the above defects or improvement needs of the prior art, the present invention provides a method for identifying attacks and faults in a catalytic cracking fractionation system, which improves the accuracy of attack and fault identification by comprehensively utilizing multi-domain abnormal characteristics of the physical domain and the information domain.

[0005] To achieve the above object, according to a first aspect of the present invention, a method for distinguishing attacks and failures in a catalytic cracking fractionation system is provided, comprising:

[0006] Training phase:

[0007] S1, determining when the catalytic cracking fractionation system is in a normal state, an attack state, and a fault state, the abnormal feature vector IF of the information domain device node is respectively {I1, I2, ..., I m};

[0008] Among them, m is the total number of information domain device nodes. i and I j , if the hash value of the sender's message is consistent with the hash value of the receiver's message, then I i =0,I j =0, otherwise I i =1,I j =1;I i ,I j are the abnormal features of the i-th and j-th information domain device nodes, respectively. The value range of i and j is 1 to m;

[0009] S2, when the catalytic cracking fractionation system is in a normal state, the strongly correlated variables of each variable in the n-dimensional physical domain process variables and the causal relationship between the above variables are determined, and they are input into the LSTM network to construct a C-LSTM network; the n-dimensional physical domain process variables in the normal state are input into the C-LSTM network to train them, and the n-dimensional physical domain process variables in the attack state, the fault state and the normal state that do not participate in the training are respectively input into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable in the corresponding state, and the difference between the predicted value and the corresponding actual value is calculated. If the difference is greater than the threshold, the characteristic value of the node corresponding to the physical domain process variable is 1, otherwise it is 0, so as to obtain the characteristic vector PF of the node corresponding to each physical domain process variable in the normal state, the attack state and the fault state. n}; Among them, P n is the characteristic of the node corresponding to the nth physical domain process variable;

[0010] S3, the abnormal feature vectors IFA of all information domain device nodes in each communication cycle are calculated as follows: IFA = {IFA1, IFA2, ..., IFA m} and PF={P1,P2,...,P n} are spliced ​​to obtain the abnormal feature vectors F={IFA1, IFA2, ..., IFA m ,P1,P2,...,P n}, and use F as a sample and the state corresponding to F as a label to train the KNN model, and obtain a trained catalytic cracking fractionation system attack and fault identification model;

[0011] Among them, IFA i =I 1i ∨I 2i ∨...∨I qi , q is the number of messages in a communication cycle, I qi is the abnormal feature of the i-th information domain device node obtained from the q-th message;

[0012] Application phase:

[0013] The abnormal feature vectors of all information domain device nodes of the catalytic cracking fractionation system to be identified within a communication cycle are concatenated with the feature vectors of all nodes corresponding to the physical domain process variables and then input into the trained attack and fault identification model of the catalytic cracking fractionation system to obtain the attack and fault identification results of the catalytic cracking fractionation system to be identified.

[0014] According to a second aspect of the present invention, there is provided an electronic device, comprising: a computer-readable storage medium and a processor;

[0015] The computer-readable storage medium is used to store executable instructions;

[0016] The processor is used to read the executable instructions stored in the computer-readable storage medium and execute the method as described in the first aspect.

[0017] According to a third aspect of the present invention, there is provided a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, wherein the computer instructions are used to cause a processor to execute the method as described in the first aspect.

[0018] According to a fourth aspect of the present invention, there is provided a computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the method according to the first aspect is implemented.

[0019] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0020] The method provided by the present invention, on the one hand, adopts a hash algorithm to detect the abnormal state of the message in view of the characteristics of large-volume data in the information domain and the problem of limited resources of the industrial control system; on the other hand, a C-LSTM model is proposed for the complex catalytic cracking fractionation process with multiple variables, high coupling, and multiple nonlinear relationships. The causal relationship algorithm is introduced on the basis of the traditional LSTM model, which can greatly reduce the causal relationship of variables with errors or redundancy, thereby improving the accuracy of abnormal detection and reducing the training cost. In general, the method provided by the present invention is more suitable for chemical industrial control systems, and has advantages in terms of security, accuracy, and resource occupancy; and the method provided by the present invention fully considers the characteristics of different data structures and time asynchrony in the information domain and the physical domain, so the bytes of the process variable part are directly extracted from the message byte stream and converted into floating point numbers, and then further analyzed. Therefore, several messages in a task cycle and a piece of process variable data extracted can be regarded as consistent in timestamp, that is, they constitute a sample. Compared with the method using data fusion model and manual alignment, this method is more efficient and accurate; in addition, the method provided by the present invention is based on the KNN algorithm for attack and fault identification, which comprehensively utilizes the bilateral information of the information domain and the physical domain, overcomes the limitation of using only physical process data for attack and fault identification, can fully explore the behavioral characteristics of attacks in the information domain, and can effectively improve the accuracy of attack and fault identification. In addition, the KNN model uses distance to distinguish sample categories, which reduces the difficulty of identification caused by the intersection of individual samples within the attack and fault categories, and has low training time complexity and occupies less resources, which is suitable for online attack and fault identification of chemical industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic flow chart of a method for identifying an attack and fault in a catalytic cracking fractionation system provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of the simulation system object structure provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of multi-domain anomaly features provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0025] The embodiment of the present invention provides a method for distinguishing attacks and failures of a catalytic cracking fractionation system, comprising:

[0026] Training phase:

[0027] S1, determining when the catalytic cracking fractionation system is in a normal state, an attack state, and a fault state, the abnormal feature vector IF of the information domain device node is respectively {I1, I2, ..., I m}; where m is the total number of information domain device nodes. i and I j , if the hash value of the sender's message is consistent with the hash value of the receiver's message, then I i =0,I j =0, otherwise I i =1,I j =1;I i ,I j are the abnormal features of the i-th and j-th information domain device nodes, respectively. The value range of i and j is 1 to m;

[0028] S2, determining the n-dimensional physical domain process variables (X1, X2, ..., X n ) and the causal relationship between the above variables, and input them into the LSTM network to construct a C-LSTM network; input the n-dimensional physical domain process variables in the normal state into the C-LSTM network to train them, and input the n-dimensional physical domain process variables in the attack state, fault state and normal state that do not participate in the training into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable in the corresponding state, and calculate the difference between the predicted value and the corresponding actual value. If it is greater than the threshold, the characteristic value of the node corresponding to the physical domain process variable is 1, otherwise it is 0, so as to obtain the characteristic vector PF={P1,P2,...,P n}; Among them, P n is the characteristic of the node corresponding to the nth physical domain process variable;

[0029] S3, the abnormal features of all information domain device nodes in each communication cycle IFA={IFA1, IFA2, ..., IFA m} and PF={P1,P2,...,P n} are spliced ​​to obtain the abnormal feature vectors F={IFA1, IFA2, ..., IFA m ,P1,P2,...,P n}, and use F as a sample and the state corresponding to F as a label to train the KNN model, and obtain a trained catalytic cracking fractionation system attack and fault identification model;

[0030] Among them, IFA i =I 1i ∨I 2i ∨...∨I qi , q is the number of messages in a communication cycle, I qi is the abnormal feature of the i-th information domain device node obtained from the q-th message.

[0031] Application phase:

[0032] Determine the abnormal feature vector IFA` of the information domain device node among the abnormal feature vectors of all information domain device nodes of the catalytic cracking fractionation system to be identified within a communication cycle; input the n-dimensional physical domain process variables of the catalytic cracking fractionation system to be identified into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variables under the corresponding state, and calculate the difference between the predicted value and the corresponding actual value. If it is greater than the threshold, the eigenvalue of the node corresponding to the physical domain process variable is 1, otherwise it is 0, thereby obtaining the eigenvector PF` of the node corresponding to each physical domain process variable in the catalytic cracking fractionation system to be identified; splice IFA` and PF` and input them into the trained catalytic cracking fractionation system attack and fault identification model to obtain the attack and fault identification results of the catalytic cracking fractionation system to be identified.

[0033] The method provided by the embodiment of the present invention includes a training phase and an application phase. In the training phase, first, the abnormal features of the information domain and the physical domain of the catalytic cracking fractionation system are extracted; then, the multi-domain abnormal features are preprocessed, i.e., sample alignment is performed; finally, the processed features are used to train the KNN model to learn the system modes in the three states of normal, attack, and fault. In the application phase, the trained KNN model is used to perform real-time attack and fault identification.

[0034] When extracting the abnormal features of the information domain and physical domain of the catalytic cracking fractionation system, the hash algorithm is used to detect the correctness and integrity of the communication message data in the information domain. For the process variable data in the physical domain (time series data), a C-LSTM (Causality-LSTM) model is proposed to detect the abnormal state of the process variables.

[0035] For information domain communication message data, any hash algorithm can be used to detect the correctness and integrity of the data, for example, SHA-224, SHA-256, SHA-384, SHA-512 and other algorithms under SHA-2. The following uses the SHA-256 algorithm with high security and low computing cost to detect the integrity and correctness of the message as an example.

[0036] The hash value of each message M is calculated based on the SHA-256 algorithm. The calculation process is as follows:

[0037] (1) Data padding: Add a 1 at the end of M, and then add 0 to get N*512 bits of data. N is a natural number;

[0038] (2) Data block: N*512={M1,M2,...,M n}, for each M i Construct 64 32-bit words, the first 16 words are M i Split M equally i ={M i [0],M i [1],...,M i

[15] }, the remaining words are constructed as follows:

[0039] M i [t] = σ1M i [t-2]+M i [t-7]+σ0M i [t-15]+M i [t-16], t∈[16,63];

[0040] Where + means bitwise addition and modulo 2^32, and the calculation rules of σ1 and σ0 are:

[0041]

[0042]

[0043] Among them, S n Indicates circular right shift n bits, R n It means right shift n bits. Represents bitwise exclusive OR;

[0044] (3) Iterative calculation: N M i After 64 iterations, the hash value H is obtained. N =(H N,0 ,H N,1 ,...H N,7 ).

[0045] The hash value TH of the sender's message TM is calculated using the above method, and the hash value RH of the receiver's message RM is calculated using the above method. The hash values ​​TH and RH of the sender and receiver are compared, and the abnormal features of the information domain device nodes are extracted accordingly.

[0046] Information domain device node abnormality feature IF={I1,I2,...,I m}, I i Refers to the status of a certain device; m is the number of device nodes in the information domain.

[0047] If TH and RH are consistent, it means that the communication process is normal. i =0,I j = 0; otherwise, it indicates an abnormality, and the communication parties I i =1,I j =1; the value range of i and j is 1 to m. It can be understood that if the hash values ​​of the sender and receiver determine that the information domain device node A communicates normally with the information domain device node B, but does not communicate normally with the information domain device node C, then I A and I C are equal to 1, I A Equal to 0. For example, if I1 and I2 are normal, and I2 and I3 are abnormal, then I2 and I3 are both equal to 1, and I2 is equal to 0.

[0048] For the physical domain process variable data, the C-LSTM network is used to detect the abnormal state of the process variable, including the following steps:

[0049] (1) First, the correlation between process variables is analyzed by calculating the mutual information value between process variables.

[0050] The existing method can be used to calculate the mutual information value between process variables, and the k-nearest neighbor estimation method based on mutual information is preferably used to analyze the correlation relationship between process variables:

[0051]

[0052] in, is the mutual information measure between variables X and Y, ψ(x) is the Digamma function, k is the number of neighboring points, generally defaulted to 3, N is the total number of samples, n x (i) is x i The number of samples within the k nearest neighbors, n y (i) is y i The number of samples within the k nearest neighbor range;

[0053] (2) Using the above method, we can obtain the n-dimensional physical domain process variables (X1, X2, ..., X n ) to X k The mutual information value Ik =(I k1 ,...I kp ,...,I kn ), k=1,2,…,n, and according to mean(I k )+1.5*std(I k ) to filter out strongly correlated variables, where mean represents the mean and std represents the standard deviation.

[0054] (3) Calculate the causal relationship between strongly correlated variables.

[0055] According to the calculation formula of the mutual information value of variables X and Y, the time lag parameter is introduced to calculate the mutual information value between variables, so as to determine the causal relationship between the variables:

[0056] IM1:X[t:t+n],Y[t+i:t+n+i],i=0~T max

[0057] IM2:Y[t:t+n],X[t+i:t+n+i],i=0~T max

[0058] IM1 is the time-lagged mutual information of the lagged Y variable to the X variable, and IM2 is the opposite. If IM1 is greater than IM2, the causal relationship is X→Y. In the above formula, T max Indicates the maximum skew value, the minimum is one signal cycle.

[0059] (4) Provide the causal relationship results to the LSTM network for feature selection;

[0060] For n-dimensional variables {X1,X2,...,X n}, taking k=1 as an example, assuming that the variables strongly correlated with X1 are X3 and X7, and the causal relationship with X1 is {X3→X1,X7→X1}, then select X3, X7 and themselves as the input variables of LSTM, and use X1 as the output variable of LSTM. In this way, LSTM can learn the rules between X1 and X3 and X7, and so on, to construct C-LSTM;

[0061] (5) The process variable data set under normal conditions (i.e., n-dimensional physical domain process variables (X1, X2, ..., X n )) is input to the C-LSTM network for training to learn the characteristic patterns of each process variable node under the normal state of the system; then the attack, fault and normal data sets that are not involved in the training are used as test sets and input into the trained network for prediction, and the absolute value of the difference between the predicted value and the actual value is calculated;

[0062] (6) Construct the physical domain process variable node abnormal feature PF = {P1, P2, ..., P n}, Pi (i = 1 ~ n) refers to the state of a device, which is a Boolean value;

[0063] If the absolute value of the difference between the predicted value and the actual value is greater than the detection threshold determined by the ROC curve, the node under the sample is considered to be in an abnormal state. i =1, otherwise P i =0.

[0064] After the above processing, the abnormal characteristics of the information domain and physical domain of the catalytic cracking fractionation system have been obtained. m} and PF={P1,P2,...,P n} Then, preprocess the above multi-domain anomaly features, including sample alignment:

[0065] (1) Processing the information domain sample features, all the abnormal features of the information domain device nodes in a communication cycle IF = {I1, I2, ..., I m} forms a sample IFA;

[0066] When there are q messages in a communication cycle, each message can obtain an information domain device node abnormal feature IF = {I1, I2, ..., I m}, that is, there are IF1~IF q , for example, IF1 = {I 11 ,I 12 ,...,I 1m}, with I 11 For example, the first 1 represents the first message, the second 1 represents the first information domain device node, I 11 That is, the first information domain device node abnormal feature obtained from the first message.

[0067] In order to characterize the characteristic state of a device node i in an information domain in 1~m during the communication cycle, it is necessary to perform an “or” logic operation on the characteristic values ​​of q messages, that is, IFA i =I 1i ∨I 2i ∨...∨I qi , so as to obtain the abnormal feature samples of all information domain device nodes in a communication cycle IFA={IFA1,IFA2,...,IFA m}.

[0068] (2) Merge the abnormal features of the information domain and the physical domain one by one to form a sample set;

[0069] Since the process variable data is derived from the communication data, IFA and PF correspond one to one. i With PFi The combination is a sample feature set F = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n}; For example, if there is a temperature variable and a pressure variable in the process variables, assuming the acquisition frequency is 1 second and the acquisition time is 1 hour, there are 2 (dimensions) * 3600 (seconds) = 7200 sample data in total. In the Excel table, the first column is the temperature variable, and the value may fluctuate in the range of 3600℃ to 3700℃; the second column is the pressure variable, and the value may fluctuate in the range of 1.0MPa to 1.05MPa.

[0070] According to different experimental scenarios, add working condition labels so that F = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n ,S wc}, where S wc When it is 0, it indicates the normal set; when it is 1, it indicates the attack set; and when it is 2, it indicates the fault set.

[0071] The preprocessed multi-domain anomaly features are used to train the KNN model to learn the system modes in normal, attack and fault states.

[0072] (1) The normal set, attack set, and fault set in the sample set are randomly divided into M folds, and then the samples in each fold are split into training set and test set in a ratio of 6:4. Finally, the training set and test set of each fold of the three types of sample sets are combined into an M-fold data set, and each fold contains a training set and a test set;

[0073] The normal set FN with the working condition label of 0, the attack set FA with the working condition label of 1, and the fault set FF with the working condition label of 2 in the sample set F are randomly divided into M folds, that is, FN={FN1,...,FN M}、FA={FA1,...,FA M}、FF={FF1,...,FF M};

[0074] Each fold of samples is split into a training set and a test set in a ratio of 6:4, for example, FN1 = {FN1_t, FN1_v};

[0075] The three types of sample sets are combined one by one to form an M-fold data set, for example:

[0076] D1={FN1,FA1,FF1}={{FN1_t,FA1_t,FF1_t},{FN1_v,FA1_v,FF1_v}};

[0077] (2) Specify a natural number M∈[a,b] and traverse all values ​​to perform KNN model training on M-fold data;

[0078] (a) Let K be initially a and use the Euclidean distance to calculate the distance between samples in the training set:

[0079]

[0080] Among them, x 1k represents the kth feature of sample x1, and the same applies to x 2k ;

[0081] (b) For all test samples in a folded data set, calculate the K sample points closest to the sample, calculate the category with the most occurrences, that is, the category of the test sample, and compare it with the actual working condition label to obtain the recognition accuracy ACC of the folded data set;

[0082] (c) Calculate the recognition accuracy of the M-fold data set:

[0083]

[0084] (d) Repeat the operation from (a) and traverse all K values ​​of [a,b];

[0085] (3) The best K value is the one with the highest recognition accuracy.

[0086] In the application stage, the trained KNN model is used for real-time attack and fault identification, including:

[0087] (1) Capturing message data from a running catalytic cracking fractionation system, obtaining process variable data according to the IEEE 754 standard, and obtaining multi-domain anomaly features according to the aforementioned multi-domain anomaly detection method;

[0088] (2) Perform sample alignment;

[0089] (3) The trained KNN model calculates the K samples closest to the test sample according to the Euclidean distance based on the optimal K value. If the sample with the most occurrences belongs to the normal class, it is identified as normal; if the sample with the most occurrences belongs to the attack class, it is identified as attack; if the sample with the most occurrences belongs to the fault class, it is identified as fault.

[0090] Combine the following Figure 2 The experimental scenario shown is used to explain in detail the method provided by the embodiment of the present invention.

[0091] Training phase:

[0092] Step 1: Capture the message data during system operation and extract multi-domain anomaly features, as follows:

[0093] Step 1.1: For information domain anomaly detection, first obtain the data-carrying messages of both communicating parties;

[0094] For a communication process with data, the content TM of the message sender and the content RM of the message receiver can be obtained;

[0095] Step 1.2: Check the correctness and integrity of the message based on the SHA-256 algorithm;

[0096] The message receiver removes the last 256 bits of data (hash value) in RM and calculates the hash value RH of the remaining message RMM. The calculation method is as follows:

[0097] (a) Data padding: pad a 1 at the end of RMM, and then pad 0 to obtain N*512 bits of data, where N is a natural number;

[0098] (b) Data block: N*512={M1,M2,...,M n}, for each M i Construct 64 32-bit words, the first 16 words are M i Split M equally i ={M i [0],M i [1],...,M i

[15] }, the remaining words are constructed as follows:

[0099] M i [t] = σ1M i [t-2]+M i [t-7]+σ0M i [t-15]+M i [t-16], t∈[16,63];

[0100] Where + means bitwise addition and modulo 2^32, and the calculation rules of σ1 and σ0 are:

[0101]

[0102]

[0103] Among them, S n Indicates circular right shift n bits, R n It means right shift n bits. Represents bitwise exclusive OR;

[0104] (c) Iterative calculation: N M i After 64 iterations, the hash value RH = (RH N,0 ,RH N,1 ,...,,RH N,7 );

[0105] Step 1.3: Compare the messages of both communicating parties to see if they are consistent;

[0106] The message sender has calculated the message hash value TH and embedded it at the end of TM, which is consistent with the last 256 bits of RM. Therefore, it is only necessary to compare the hash value RH obtained in step 1.2 with TH.

[0107] Step 1.4: Extract abnormal features of information domain device nodes;

[0108] according to Figure 2 The nine key information domain devices in the information domain are constructed to construct the abnormal characteristics of the information domain device node IF = {I1, I2, ..., I9}, I i Refers to the status of a device;

[0109] If TH and RH are consistent, it means that the communication process is normal. i =0,I j = 0; otherwise, it indicates an abnormality, and the communication parties I i =1,I j =1;

[0110] Step 1.5: For physical domain anomaly detection, first obtain the corresponding physical process variable data from the message data, and use the following formulas (1 to 4) to obtain the causal relationship between the variables;

[0111]

[0112] mean(I1)+1.5*std(I1)(2)

[0113] I1:X[t:t+n],Y[t+i:t+n+i],i=0~T max (3)

[0114] I2:Y[t:t+n],X[t+i:t+n+i],i=0~T max (4)

[0115] in, is the mutual information measure between variables X and Y, ψ(x) is the Digamma function, k is the number of neighbors, the default value is 3, N is the total number of samples, n x (i) is x i The number of samples within the k nearest neighbors, n y (i) is y i The number of samples within the k nearest neighbor range;

[0116] Formula (1) obtains the mutual information value I1=(I 11 ,...I 1j ,...,I 1n), according to formula (2), strongly correlated variables are selected, where mean represents the mean and std represents the standard deviation, and then the causal relationship between variables is calculated by formula (3), where I1 is the time-lagged mutual information of the lagged Y variable to the X variable, and I2 is the opposite. If I1 is ahead of I2, the causal relationship is X→Y. In the above formula, T max Indicates the maximum lag value, the minimum is one signal cycle;

[0117] Step 1.6: Input the normal data set into the C-LSTM network for training, input the normal, attack and fault data sets into the test, and extract the node features of the physical domain process variables;

[0118] According to the variable causal relationship obtained in step 1.5, the corresponding input variables are selected. For example, for n-dimensional variables {X1, X2, ..., X n}, determine that the causal relationship to X1 is {X3→X1,X7→X1}, then select X3, X7 and themselves as the input variables of LSTM;

[0119] Construct the abnormal feature PF of the physical domain process variable node = {P1,P2,...,P n}, P i Refers to the status of a device;

[0120] If the absolute value of the difference between the predicted value and the actual value is greater than the detection threshold determined by the ROC curve, the node under the sample is considered to be in an abnormal state. i =1, otherwise P i =0.

[0121] Taking a 1-dimensional variable as an example, in the training phase, 10 consecutive sample values ​​of a process variable and the sample values ​​of the first 9 time steps are taken as input to predict the result pre of the 10th step, and then the result is subtracted from the actual value real of the sample of the 10th step. When the system is in the online operation phase, 10 historical sample values ​​of a process variable from the current moment are taken, and the first 9 sample values ​​are input into the C-LSTM network to obtain the predicted value of the 10th sample (i.e. the predicted value at the current moment), and the result is subtracted from the actual value of the 10th sample.

[0122] Step 2: Perform sample alignment preprocessing on the multi-domain anomaly features. The specific steps are as follows:

[0123] Perform sample alignment within a communication cycle and add the working condition label S wc ,get Figure 3 The sample set F = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n ,S wc}, where S wcWhen it is 0, it indicates the normal set; when it is 1, it indicates the attack set; and when it is 2, it indicates the fault set.

[0124] Step 3: Use the obtained sample set to train the KNN model to obtain the optimal K value. The specific steps are as follows:

[0125] Step 3.1: Split the normal set, attack set, and fault set samples in the sample set into 50% each, and then split them into training set and test set in a ratio of 6:4, to form a 50% dataset. For example, the first fold dataset:

[0126] D1={FN1,FA1,FF1}={{FN1_t,FA1_t,FF1_t},{FN1_v,FA1_v,FF1_v}}={D1_t,D1_v}; FN1, FA1, FF1 are the first fold data of the three types of sample sets respectively, FN1_t and FN1_v are the training set and test set of FN1 respectively;

[0127] Step 3.2: Let K be 3 initially and use formula (5) to calculate the distance between samples;

[0128]

[0129] Among them, x 1k represents the kth feature of sample x1, and the same applies to x 2k ;

[0130] Step 3.3: For all test samples in each fold data set, calculate the K sample points closest to the sample, calculate the category with the most occurrences, that is, the category of the test sample, and compare it with the actual working condition label to obtain the recognition accuracy of the fold data set, and take the average value to obtain the recognition accuracy of the 5-fold data set;

[0131] Step 3.4: Repeat steps 3.2 to 3.3, let K traverse the natural numbers between 3 and 10, and take the one with the highest recognition accuracy as the optimal K value.

[0132] Application phase:

[0133] Use the trained KNN model to perform online attack and fault identification. The specific steps are as follows:

[0134] Step A: Capture message data from the running catalytic cracking fractionation system, obtain process variable data according to the IEEE 754 standard, and obtain multi-domain anomaly features according to step 1;

[0135] Step B: Perform sample alignment as in step 2

[0136] Step C: Based on the optimal K value obtained in step 3.4, calculate the K samples closest to the test sample according to formula (6). If the one that appears most frequently is the normal class, it is judged as normal; if the one that appears most frequently is the attack class, it is judged as an attack; if the one that appears most frequently is the fault class, it is judged as a fault.

[0137] It is understandable that the traversal range of the K value can be adjusted according to the sample size.

[0138] The catalytic cracking fractionation system attack and fault identification method provided by the embodiment of the present invention first designs an anomaly detection method based on a hash algorithm and an anomaly detection model based on a C-LSTM according to the characteristics of information domain data and physical domain data, respectively, and based on the multi-domain anomaly detection method, extracts multi-domain anomaly features describing the system state; to facilitate the use of features, samples of the multi-domain anomaly features are aligned; the processed features are used for KNN model training, and the optimal K value is obtained through K-fold cross validation; and the trained KNN model is used for online attack and fault identification.

[0139] An embodiment of the present invention provides an electronic device, including: a computer-readable storage medium and a processor;

[0140] The computer-readable storage medium is used to store executable instructions;

[0141] The processor is used to read the executable instructions stored in the computer-readable storage medium and execute the method described in any of the above embodiments.

[0142] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method described in any of the above embodiments.

[0143] An embodiment of the present invention provides a computer program product, including a computer program or instructions, and when the computer program or instructions are executed by a processor, the method described in any of the above embodiments is implemented.

[0144] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for distinguishing attacks and failures in a catalytic cracking fractionation system, characterized in that: include: Training phase: S1, determining when the catalytic cracking fractionation system is in a normal state, an attack state, and a fault state, the abnormal feature vector IF of the information domain device node is respectively {I1, I2, ..., I m }; Among them, m is the total number of information domain device nodes. i and I j , if the hash value of the sender's message is consistent with the hash value of the receiver's message, then I i =0,I j =0, otherwise I i =1,I j =1;I i ,I j are the abnormal features of the i-th and j-th information domain device nodes, respectively. The value range of i and j is 1 to m; S2, when the catalytic cracking fractionation system is in a normal state, the strongly correlated variables of each variable in the n-dimensional physical domain process variables and the causal relationship between the above variables are determined, and they are input into the LSTM network to construct a C-LSTM network; the n-dimensional physical domain process variables in the normal state are input into the C-LSTM network to train them, and the n-dimensional physical domain process variables in the attack state, the fault state and the normal state that do not participate in the training are respectively input into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable in the corresponding state, and the difference between the predicted value and the corresponding actual value is calculated. If the difference is greater than the threshold, the characteristic value of the node corresponding to the physical domain process variable is 1, otherwise it is 0, so as to obtain the characteristic vector PF of the node corresponding to each physical domain process variable in the normal state, the attack state and the fault state. n }; Among them, P n is the characteristic of the node corresponding to the nth physical domain process variable; S3, the abnormal feature vectors IFA of all information domain device nodes in each communication cycle are calculated as follows: IFA = {IFA1, IFA2, ..., IFA m } and PF={P1,P2,...,P n } are spliced ​​to obtain the abnormal feature vectors F={IFA1, IFA2, ..., IFA m ,P1,P2,...,P n }, and use F as a sample and the state corresponding to F as a label to train the KNN model, and obtain a trained catalytic cracking fractionation system attack and fault identification model; Among them, IFA i =I 1i ∨I 2i ∨...∨I qi , q is the number of messages in a communication cycle, I qi is the abnormal feature of the i-th information domain device node obtained from the q-th message; Application phase: The abnormal feature vectors of all information domain device nodes of the catalytic cracking fractionation system to be identified within a communication cycle are concatenated with the feature vectors of all nodes corresponding to the physical domain process variables and then input into the trained attack and fault identification model of the catalytic cracking fractionation system to obtain the attack and fault identification results of the catalytic cracking fractionation system to be identified.

2. The method according to claim 1, characterized in that In step S2, the n-dimensional physical domain process variables (X1, X2, ..., X n ) The method of obtaining the strongly correlated variables of each variable is as follows: Calculate the n-dimensional physical domain process variables (X1, X2, ..., X n ) and X k The mutual information value I k =(I k1 ,I k2 , ... ,I kn ), if I kp Greater than or equal to mean(I k )+1.5*std(I k ), then X p For X k The values ​​of p and k are both from 1 to n. Mean represents the mean and std represents the standard deviation.

3. The method according to claim 1 or 2, characterized in that In step S2, the causal relationship between variables is obtained as follows: For variables X and Y, if the time-lagged mutual information IM1 of the lagged Y variable on the X variable is greater than the time-lagged mutual information IM2 of the lagged X variable on the Y variable, the causal relationship is X→Y, otherwise the causal relationship is Y→X.

4. The method according to claim 1, characterized in that The SHA-256 algorithm is used to calculate the hash value of the communication message of each information domain device node.

5. An electronic device, characterized in that: include: A computer readable storage medium and a processor; The computer-readable storage medium is used to store executable instructions; The processor is used to read the executable instructions stored in the computer-readable storage medium and execute the method according to any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method according to any one of claims 1 to 4.

7. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images