A method for distinguishing attacks and failures in catalytic cracking fractionation systems

Abstract

This invention discloses a method for distinguishing attacks and faults in a catalytic cracking fractionation system, belonging to the field of industrial control system information security. The method first extracts abnormal states of device nodes in the system's information domain and variable nodes in the physical domain. These multi-domain abnormal features are then combined and used to train a KNN model to learn the system's patterns under attack, fault, and normal conditions. Finally, the trained KNN model is used for online attack and fault identification. By extracting multilateral features from the information and physical domains, this method can comprehensively describe the behavioral characteristics of attacks and faults, overcoming the limitation of analyzing the causes of abnormalities solely from a physical process perspective and effectively improving identification accuracy. Furthermore, the KNN model can effectively reduce identification errors caused by the crosstalk between individual attack and fault samples.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control system information security, and more specifically, relates to a method for distinguishing attacks and failures in a catalytic cracking fractionation system. Background Art

[0002] The catalytic cracking fractionation system is the main industrial control system for the production of products such as gasoline and diesel. However, the introduction of the Industrial Internet has brought huge information security risks to it, exposing it to the dual threats of attacks and failures. Due to the different protection strategies for dealing with attacks and failures, in order to ensure the safe and stable operation of the system, it is necessary to conduct research on methods for distinguishing attacks and failures to help achieve targeted system protection.

[0003] Most existing methods for identifying attacks and faults in industrial control systems utilize physical process data. For example, the paper "Identification of cyber-attack / outage / fault in zero-energy building with load and energy management strategies," published in Volume 50, 2022, of the Journal of Energy Storage, distinguishes between cyber attacks, outages, and faults by monitoring battery power, load energy, and node voltage data. The paper "Distinguishing Between Cyber ​​Attacks and Faults in Power Electronic Systems—A Noninvasive Approach," published in Issue 2, 2023, of the IEEE Journal of Emerging and Selected Topics in Power Electronics, distinguishes between false data injection attacks and distribution line faults by analyzing voltage and frequency traces. However, carefully designed new attacks can forge fault signals, thereby appearing as anomalies similar to faults in physical process data. Therefore, it is necessary to integrate communication network data for collaborative analysis. The paper "Stochastic fault and cyber-attack detection and consensus control in multi-agent systems," published in the 9th issue of the International Journal of Control in 2022, utilizes Markov methods and hybrid coding and message authentication to distinguish between attacks and faults in multi-agent systems. While these approaches recognize the importance of leveraging bilateral information from both the physical and cyber domains, they are difficult to apply to chemical control systems with multiple variables, high coupling, and multiple nonlinear relationships, and their cost is high. Distinguishing between attacks and faults in chemical control systems with complex process principles and limited resources is a significant challenge. Summary of the Invention

[0004] In response to the above-mentioned deficiencies or improvement needs of the prior art, the present invention provides a method for identifying attacks and faults in a catalytic cracking fractionation system, which improves the accuracy of attack and fault identification by comprehensively utilizing multi-domain anomaly features of the physical domain and the information domain.

[0005] To achieve the above objectives, according to a first aspect of the present invention, a method for distinguishing attacks and failures in a catalytic cracking fractionation system is provided, comprising:

[0006] Training phase:

[0007] S1, determining when the catalytic cracking fractionation system is in a normal state, an attack state, and a fault state, wherein the abnormal feature vector IF of the information domain device node is {I1, I2, ..., I m};

[0008] Among them, m is the total number of information domain device nodes. i and I j If the hash value of the sender's message is consistent with the hash value of the receiver's message, then I i =0,I j =0, otherwise I i =1,I j =1;I i , I j are the abnormal features of the i-th and j-th information domain device nodes, respectively. The value range of i and j is 1 to m.

[0009] S2, when the catalytic cracking fractionation system is in a normal state, the strongly correlated variables of each variable in the n-dimensional physical domain process variables and the causal relationship between the above variables are determined, and the variables are input into the LSTM network to construct a C-LSTM network; the n-dimensional physical domain process variables in the normal state are input into the C-LSTM network to train them, and the n-dimensional physical domain process variables in the attack state, the fault state and the normal state that do not participate in the training are respectively input into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable in the corresponding state, and the difference between the predicted value and the corresponding actual value is calculated. If the difference is greater than the threshold, the characteristic value of the node corresponding to the physical domain process variable is 1, otherwise it is 0, thereby obtaining the characteristic vector PF of the node corresponding to each physical domain process variable in the normal state, the attack state and the fault state = {P1, P2, ..., P n}; Among them, P n is the characteristic of the node corresponding to the nth physical domain process variable;

[0010] S3, the abnormal feature vectors IFA of all information domain device nodes in each communication cycle are calculated as follows: IFA = {IFA1, IFA2, ..., IFA m} and PF={P1,P2,...,P n} are spliced ​​to obtain the abnormal feature vectors F of the information domain and physical domain of the catalytic cracking fractionation system in each state = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n}, and use F as a sample and the state corresponding to F as a label to train the KNN model, and obtain a trained catalytic cracking fractionation system attack and fault identification model;

[0011] Among them, IFA i =I 1i ∨I 2i ∨...∨I qi , q is the number of messages in a communication cycle, I qi is the abnormal feature of the device node in the i-th information domain obtained from the q-th message;

[0012] Application stage:

[0013] The abnormal feature vectors of all information domain device nodes of the catalytic cracking fractionation system to be identified within a communication cycle are spliced ​​with the feature vectors of all physical domain process variable corresponding nodes and then input into the trained catalytic cracking fractionation system attack and fault identification model to obtain the attack and fault identification results of the catalytic cracking fractionation system to be identified.

[0014] According to a second aspect of the present invention, there is provided an electronic device comprising: a computer-readable storage medium and a processor;

[0015] The computer-readable storage medium is used to store executable instructions;

[0016] The processor is configured to read the executable instructions stored in the computer-readable storage medium and execute the method according to the first aspect.

[0017] According to a third aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method according to the first aspect.

[0018] According to a fourth aspect of the present invention, there is provided a computer program product comprising a computer program or instructions, which implement the method according to the first aspect when executed by a processor.

[0019] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0020] The method provided by the present invention, on the one hand, targets the characteristics of large-volume data in the information domain and the problem of limited resources in the industrial control system, and adopts a hash algorithm to detect abnormal states of messages. On the other hand, for the complex catalytic cracking fractionation process with multiple variables, high coupling, and multiple nonlinear relationships, a C-LSTM model is proposed. The causal relationship algorithm is introduced on the basis of the traditional LSTM model, which can greatly reduce the erroneous or redundant variable causal relationships, thereby improving the accuracy of anomaly detection and reducing training costs. In general, the method provided by the present invention is more suitable for chemical industrial control systems and has advantages in terms of security, accuracy, and resource occupancy. In addition, the method provided by the present invention fully considers the characteristics of the different data structures and time asynchrony between the information domain and the physical domain. Therefore, the bytes of the process variable part are directly extracted from the message byte stream and converted into floating point numbers, and then further analyzed. Therefore, several messages within a task cycle and the extracted process variable data can be considered consistent in terms of timestamp, that is, they constitute a sample. Compared to methods using data fusion models and manual alignment, this method is more efficient and accurate. Furthermore, the method provided by this invention uses the KNN algorithm for attack and fault identification, comprehensively utilizing bilateral information from both the information and physical domains. This overcomes the limitations of using only physical process data for attack and fault identification, fully exploiting the behavioral characteristics of attacks in the information domain and effectively improving the accuracy of attack and fault identification. Furthermore, the KNN model uses distance to distinguish sample categories, reducing the difficulty of identification caused by the overlap of individual samples within the attack and fault categories. Furthermore, the training time complexity is low, and resource usage is minimal, making it suitable for online attack and fault identification in chemical industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic flow chart of a method for identifying attacks and faults in a catalytic cracking fractionation system according to an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of the object structure of a simulation system provided by an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of multi-domain anomaly features provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0025] An embodiment of the present invention provides a method for distinguishing attacks and failures in a catalytic cracking fractionation system, comprising:

[0026] Training phase:

[0027] S1, determining when the catalytic cracking fractionation system is in a normal state, an attack state, and a fault state, wherein the abnormal feature vector IF of the information domain device node is {I1, I2, ..., I m}; where m is the total number of information domain device nodes, for both communicating parties I i and I j If the hash value of the sender's message is consistent with the hash value of the receiver's message, then I i =0,I j =0, otherwise I i =1,I j =1;I i , I j are the abnormal features of the i-th and j-th information domain device nodes, respectively. The value range of i and j is 1 to m.

[0028] S2, determining the n-dimensional physical domain process variables (X1, X2, ..., X n ) and the causal relationship between the above variables, and input them into the LSTM network to construct a C-LSTM network; input the n-dimensional physical domain process variables in the normal state into the C-LSTM network to train it, and input the n-dimensional physical domain process variables in the attack state, fault state and normal state that do not participate in the training into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable in the corresponding state, and calculate the difference between the predicted value and the corresponding actual value. If it is greater than the threshold, the eigenvalue of the node corresponding to the physical domain process variable is 1, otherwise it is 0, thereby obtaining the eigenvector PF of the node corresponding to each physical domain process variable in the normal state, attack state and fault state = {P1, P2, ..., P n}; Among them, P n is the characteristic of the node corresponding to the nth physical domain process variable;

[0029] S3, the abnormal features IFA of all information domain device nodes in each communication cycle are calculated as follows: IFA = {IFA1, IFA2, ..., IFA m} and PF={P1,P2,...,P n} are spliced ​​to obtain the abnormal feature vectors F of the information domain and physical domain of the catalytic cracking fractionation system in each communication cycle under each state = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n}, and use F as a sample and the state corresponding to F as a label to train the KNN model, and obtain a trained catalytic cracking fractionation system attack and fault identification model;

[0030] Among them, IFA i =I 1i ∨I 2i ∨...∨I qi , q is the number of messages in a communication cycle, I qi is the abnormal feature of the device node in the i-th information domain obtained from the q-th message.

[0031] Application stage:

[0032] Determine the abnormal feature vector IFA` of the information domain device node among the abnormal feature vectors of all information domain device nodes of the catalytic cracking fractionation system to be identified within a communication cycle; input the n-dimensional physical domain process variables of the catalytic cracking fractionation system to be identified into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable under the corresponding state, and calculate the difference between the predicted value and the corresponding actual value. If the difference is greater than the threshold, the eigenvalue of the node corresponding to the physical domain process variable is 1, otherwise it is 0, thereby obtaining the eigenvector PF` of the node corresponding to each physical domain process variable in the catalytic cracking fractionation system to be identified; concatenate IFA` and PF` and input them into the trained catalytic cracking fractionation system attack and fault identification model to obtain the attack and fault identification results of the catalytic cracking fractionation system to be identified.

[0033] The method provided by the embodiments of the present invention includes a training phase and an application phase. During the training phase, abnormal features in the information and physical domains of the catalytic cracking fractionation system are first extracted. These multi-domain abnormal features are then preprocessed, i.e., sample alignment is performed. Finally, the processed features are used to train a KNN model to learn system patterns in normal, attack, and fault states. During the application phase, the trained KNN model is used to perform real-time attack and fault identification.

[0034] When extracting abnormal features from the information and physical domains of the catalytic cracking fractionation system, a hash algorithm is used to detect the correctness and integrity of the communication message data in the information domain. For the process variable data in the physical domain (time series data), a C-LSTM (Causality-LSTM, causality-long short-term memory network) model is proposed to detect abnormal states of process variables.

[0035] For information domain communication message data, any hash algorithm can be used to detect the correctness and integrity of the data. For example, SHA-224, SHA-256, SHA-384, SHA-512 and other algorithms under SHA-2 are available. The following uses the SHA-256 algorithm, which has high security and low computing power cost, as an example to illustrate the detection of message integrity and correctness.

[0036] The hash value of each message M is calculated based on the SHA-256 algorithm. The calculation process is as follows:

[0037] (1) Data padding: add a 1 at the end of M, and then add 0 to get N*512 bits of data. N is a natural number;

[0038] (2) Data block: N*512={M1,M2,...,M n}, for each M i Construct 64 32-bit words, the first 16 words are M i Split M equally i ={M i [0],M i [1],...,M i

[15] }, the remaining characters are constructed as follows:

[0039] M i [t]=σ1M i [t-2]+M i [t-7]+σ0M i [t-15]+M i [t-16],t∈[16,63];

[0040] Where + represents bitwise addition and modulo 2^32, and the calculation rules for σ1 and σ0 are:

[0041]

[0042]

[0043] Among them, S n Indicates a circular right shift of n bits, R n Indicates right shift n bits, Represents bitwise exclusive OR;

[0044] (3) Iterative calculation: N M i Calculate the hash value H after 64 iterations. N =(H N,0 ,H N,1 ,...H N,7 ).

[0045] The hash value TH of the sender's message TM is calculated using the above method, and the hash value RH of the receiver's message RM is calculated using the above method. The hash values ​​TH and RH of the sender and receiver are compared, and the abnormal features of the information domain device node are extracted based on them.

[0046] Information domain device node abnormality feature IF={I1,I2,...,I m}, I i Refers to the status of a device; m is the number of device nodes in the information domain.

[0047] If TH and RH are consistent, it means that the communication process is normal. i =0,I j =0; otherwise, it indicates an abnormality, so that both parties of the communication i =1,I j =1; the value range of i and j is 1 to m. It can be understood that if the hash value of the sender and receiver determines that the information domain device node A communicates normally with the information domain device node B, but does not communicate normally with the information domain device node C, then I A and I C are equal to 1, I A Equal to 0. For example, if I1 and I2 are normal, and I2 and I3 are abnormal, then I2 and I3 are both equal to 1, and I2 is equal to 0.

[0048] For physical domain process variable data, the C-LSTM network is used to detect abnormal states of process variables, including the following steps:

[0049] (1) First, the correlation between process variables is analyzed by calculating the mutual information value between process variables.

[0050] The mutual information value between process variables can be calculated using existing methods, and the k-nearest neighbor estimation method based on mutual information is preferably used to analyze the correlation between process variables:

[0051]

[0052] in, is the mutual information measure between variables X and Y, ψ(x) is the Digamma function, k is the number of neighboring points, generally defaulted to 3, N is the total number of samples, n x (i) is x i The number of samples within the k nearest neighbor range, n y (i) is y i The number of samples within the k-nearest neighbor range;

[0053] (2) Using the above method, we can obtain the n-dimensional physical domain process variables (X1, X2, ..., X n ) to X k The mutual information value Ik =(I k1 ,...I kp ,...,I kn ), k=1,2,…,n, and according to mean(I k )+1.5*std(I k ) to filter out strongly correlated variables, where mean represents the mean and std represents the standard deviation.

[0054] (3) Calculate the causal relationship between strongly correlated variables.

[0055] According to the calculation formula of the mutual information value of variables X and Y, the time lag parameter is introduced to calculate the mutual information value between variables, thereby determining the causal relationship between the variables:

[0056] IM1:X[t:t+n],Y[t+i:t+n+i],i=0~T max

[0057] IM2:Y[t:t+n],X[t+i:t+n+i],i=0~T max

[0058] IM1 is the time-lagged mutual information of the lagged Y variable to the X variable, and IM2 is the opposite. If IM1 is greater than IM2, the causal relationship is X→Y. In the above formula, T max Indicates the maximum skew value, the minimum is one signal cycle.

[0059] (4) Provide the causal relationship results to the LSTM network for feature selection;

[0060] For n-dimensional variables {X1,X2,...,X n}, taking k = 1 as an example, assuming that the variables strongly correlated with X1 are X3 and X7, and the causal relationship with X1 is {X3→X1, X7→X1}, then X3, X7 and themselves are selected as the input variables of the LSTM, and X1 is used as the output variable of the LSTM. This allows the LSTM to learn the relationship between X1 and X3 and X7, and so on, to construct a C-LSTM.

[0061] (5) The process variable data set under normal state (i.e., n-dimensional physical domain process variables (X1, X2, ..., X n The data is input into the C-LSTM network for training to learn the characteristic patterns of each process variable node under the normal state of the system. Then, the attack, fault and normal data sets that did not participate in the training are used as test sets and input into the trained network for prediction. The absolute value of the difference between the predicted value and the actual value is calculated.

[0062] (6) Construct the abnormal feature of the physical domain process variable node PF = {P1, P2, ..., P n}, Pi (i = 1 ~ n) refers to the state of a device, which is a Boolean value;

[0063] If the absolute value of the difference between the predicted value and the actual value is greater than the detection threshold determined by the ROC curve, the node under the sample is considered to be in an abnormal state, and P i =1, otherwise P i =0.

[0064] After the above processing, the abnormal characteristics of the information domain and physical domain of the catalytic cracking fractionation system IF={I1,I2,...,I m} and PF={P1,P2,...,P n Then, preprocess the above multi-domain anomaly features, including sample alignment:

[0065] (1) Processing the information domain sample features, all the abnormal features of the information domain device nodes in a communication cycle IF={I1,I2,...,I m} form a sample IFA;

[0066] When there are q messages in a communication cycle, each message can obtain an information domain device node abnormality feature IF={I1,I2,...,I m}, that is, there are IF1~IF q , for example, IF1={I 11 ,I 12 ,...,I 1m}, with I 11 For example, the first 1 represents the first message, the second 1 represents the first information domain device node, I 11 That is, the abnormal feature of the first information domain device node obtained from the first message.

[0067] In order to characterize the characteristic state of a device node i in an information domain from 1 to m during a communication cycle, it is necessary to perform an “OR” logic operation on the characteristic values ​​of q messages, i.e., IFA i =I 1i ∨I 2i ∨...∨I qi , so as to obtain the abnormal feature samples of all information domain device nodes in a communication cycle IFA={IFA1,IFA2,...,IFA m}.

[0068] (2) Merge the abnormal features of the information domain and the physical domain one by one to form a sample set;

[0069] Since the process variable data is derived from the communication data, IFA and PF have a one-to-one correspondence. i With PFi Combined into a sample feature set F = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n For example, if the process variables include a temperature variable and a pressure variable, and the acquisition frequency is 1 second and the acquisition duration is 1 hour, then there are a total of 2 (dimensions) * 3600 (seconds) = 7200 sample data. In the Excel spreadsheet, the first column is the temperature variable, and the value may fluctuate between 3600°C and 3700°C; the second column is the pressure variable, and the value may fluctuate between 1.0 MPa and 1.05 MPa.

[0070] According to different experimental scenarios, add working condition labels so that F={IFA1,IFA2,...,IFA m ,P1,P2,...,P n ,S wc}, where S wc When it is 0, it indicates the normal set; when it is 1, it indicates the attack set; when it is 2, it indicates the fault set.

[0071] The pre-processed multi-domain anomaly features are used to train the KNN model to learn the system patterns in normal, attack and fault states.

[0072] (1) The normal set, attack set, and fault set in the sample set are randomly divided into M folds, and then the samples in each fold are split into training set and test set in a ratio of 6:4. Finally, the training set and test set of each fold of the three types of sample sets are combined into an M-fold dataset, and each fold contains a training set and a test set;

[0073] The normal set FN with the working condition label of 0, the attack set FA with the working condition label of 1, and the fault set FF with the working condition label of 2 in the sample set F are randomly divided into M folds, that is, FN={FN1,...,FN M}、FA={FA1,...,FA M}、FF={FF1,...,FF M};

[0074] Each fold of samples is split into a training set and a test set in a ratio of 6:4, for example, FN1 = {FN1_t, FN1_v};

[0075] The three types of sample sets are combined one by one to form an M-fold data set, for example:

[0076] D1={FN1,FA1,FF1}={{FN1_t,FA1_t,FF1_t},{FN1_v,FA1_v,FF1_v}};

[0077] (2) Specify a natural number M∈[a,b] and traverse all values ​​to perform KNN model training on M-fold data;

[0078] (a) Let K be initially a and calculate the distance between samples in the training set using Euclidean distance:

[0079]

[0080] Among them, x 1k Represents the kth feature of sample x1, and the same applies to x 2k ;

[0081] (b) For all test samples in a folded dataset, calculate the K sample points closest to the sample, calculate the category with the most occurrences, that is, the category of the test sample, and compare it with the actual working condition label to obtain the classification accuracy ACC of the folded dataset;

[0082] (c) Calculate the recognition accuracy of the M-fold dataset:

[0083]

[0084] (d) Repeat the operation from (a) and traverse all K values ​​of [a, b];

[0085] (3) The best K value is the one with the highest recognition accuracy.

[0086] In the application phase, the trained KNN model is used for real-time attack and fault identification, including:

[0087] (1) Capturing message data from a running catalytic cracking fractionation system, obtaining process variable data according to the IEEE 754 standard, and obtaining multi-domain anomaly features according to the aforementioned multi-domain anomaly detection method;

[0088] (2) Perform sample alignment;

[0089] (3) The trained KNN model calculates the K samples closest to the test sample according to the Euclidean distance based on the optimal K value. If the one that appears most frequently is the normal class, it is identified as normal; if the one that appears most frequently is the attack class, it is identified as an attack; if the one that appears most frequently is the fault class, it is identified as a fault.

[0090] The following combination Figure 2 The experimental scenario shown is used to explain in detail the method provided by the embodiment of the present invention.

[0091] Training phase:

[0092] Step 1: Capture message data during system operation and extract multi-domain anomaly features, as follows:

[0093] Step 1.1: For information domain anomaly detection, first obtain the data-carrying messages from both communicating parties;

[0094] For a communication process with data, the content TM of the message sender and the content RM of the message receiver can be obtained;

[0095] Step 1.2: Check the correctness and integrity of the message based on the SHA-256 algorithm;

[0096] The message receiver removes the last 256 bits of data (hash value) from RM and calculates the hash value RH of the remaining message RMM. The calculation method is as follows:

[0097] (a) Data padding: pad the end of RMM with a 1 and then pad with 0 to obtain N*512 bits of data, where N is a natural number;

[0098] (b) Data block: N*512={M1,M2,...,M n}, for each M i Construct 64 32-bit words, the first 16 words are M i Split M equally i ={M i [0],M i [1],...,M i

[15] }, the remaining characters are constructed as follows:

[0099] M i [t]=σ1M i [t-2]+M i [t-7]+σ0M i [t-15]+M i [t-16],t∈[16,63];

[0100] Where + represents bitwise addition and modulo 2^32, and the calculation rules for σ1 and σ0 are:

[0101]

[0102]

[0103] Among them, S n Indicates a circular right shift of n bits, R n Indicates right shift n bits, Represents bitwise exclusive OR;

[0104] (c) Iterative calculation: N M i Do 64 iterations and the hash value RH=(RH N,0 ,RH N,1 ,...,,RH N,7 );

[0105] Step 1.3: Compare the messages of both communicating parties to see if they are consistent;

[0106] The message sender has calculated the message hash value TH and embedded it at the end of TM, which is consistent with the last 256 bits of RM. Therefore, it is only necessary to compare the hash value RH obtained in step 1.2 with TH.

[0107] Step 1.4: Extract abnormal features of information domain device nodes;

[0108] according to Figure 2 The nine key information domain devices in the ,construct the abnormal characteristics of the information domain device node IF={I1,I2,...,I9},I i Refers to the status of a device;

[0109] If TH and RH are consistent, it means that the communication process is normal. i =0,I j =0; otherwise, it indicates an abnormality, so that both parties of the communication i =1,I j =1;

[0110] Step 1.5: For physical domain anomaly detection, first obtain the corresponding physical process variable data from the message data, and use the following equations (1 to 4) to obtain the causal relationship between the variables;

[0111]

[0112] mean(I1)+1.5*std(I1)(2)

[0113] I1:X[t:t+n],Y[t+i:t+n+i],i=0~T max (3)

[0114] I2:Y[t:t+n],X[t+i:t+n+i],i=0~T max (4)

[0115] in, is the mutual information measure between variables X and Y, ψ(x) is the Digamma function, k is the number of neighbors, the default is 3, N is the total number of samples, n x (i) is x i The number of samples within the k nearest neighbor range, n y (i) is y i The number of samples within the k-nearest neighbor range;

[0116] Formula (1) obtains the mutual information value of n-dimensional variable pair X1 I1=(I 11 ,...I 1j ,...,I 1n), according to formula (2), we can select the strongly correlated variables. In formula (2), mean represents the mean and std represents the standard deviation. Then, we can calculate the causal relationship between the variables by formula (3), where I1 is the time-lagged mutual information of the lagged Y variable to the X variable, and I2 is the opposite. If I1 is ahead of I2, the causal relationship is X→Y. In the above formula, T max Indicates the maximum lag value, the minimum is one signal cycle;

[0117] Step 1.6: Input the normal state data set into the C-LSTM network for training, and input the normal, attack, and fault data sets into the test state to extract the node features of the physical domain process variables;

[0118] According to the variable causal relationship obtained in step 1.5, the corresponding input variables are selected. For example, for n-dimensional variables {X1, X2, ..., X n}, determine that the causal relationship to X1 is {X3→X1,X7→X1}, then select X3, X7 and itself as the input variables of LSTM;

[0119] Construct the abnormal feature of physical domain process variable node PF={P1,P2,...,P n}, P i Refers to the status of a device;

[0120] If the absolute value of the difference between the predicted value and the actual value is greater than the detection threshold determined by the ROC curve, the node under the sample is considered to be in an abnormal state, and P i =1, otherwise P i =0.

[0121] Taking a one-dimensional variable as an example, during the training phase, 10 consecutive sample values ​​of a process variable are taken, with the sample values ​​of the first nine time steps as input, to predict the result of the 10th step (pre), which is then subtracted from the actual sample value of the 10th step (real). When the system is in the online operation phase, 10 historical sample values ​​of a process variable from the current moment are taken, and the first nine sample values ​​are input into the C-LSTM network to obtain the predicted value of the 10th sample (i.e., the predicted value at the current moment), which is then subtracted from the actual value of the 10th sample.

[0122] Step 2: Perform sample alignment preprocessing on the multi-domain anomaly features. The specific steps are as follows:

[0123] Perform sample alignment within a communication cycle and add the working condition label S wc ,get Figure 3 The sample set F = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n ,S wc}, where S wcWhen it is 0, it indicates the normal set; when it is 1, it indicates the attack set; when it is 2, it indicates the fault set.

[0124] Step 3: Use the obtained sample set to train the KNN model to obtain the optimal K value. The specific steps are as follows:

[0125] Step 3.1: Perform a 50-fold split on the normal, attack, and fault samples in the sample set, and then split them into training and test sets at a ratio of 6:4 to form a 50-fold dataset. For example, the first fold dataset is:

[0126] D1={FN1,FA1,FF1}={{FN1_t,FA1_t,FF1_t},{FN1_v,FA1_v,FF1_v}}={D1_t,D1_v}; FN1, FA1, and FF1 are the first fold data of the three types of sample sets respectively, and FN1_t and FN1_v are the training set and test set of FN1 respectively;

[0127] Step 3.2: Let K be initially 3 and use formula (5) to calculate the distance between samples;

[0128]

[0129] Among them, x 1k Represents the kth feature of sample x1, and the same applies to x 2k ;

[0130] Step 3.3: For all test samples in each fold dataset, calculate the K sample points closest to the sample, calculate the category with the most occurrences, that is, the category of the test sample, and compare it with the actual working condition label to obtain the recognition accuracy of the fold dataset. Take the average value to obtain the recognition accuracy of the 5-fold dataset;

[0131] Step 3.4: Repeat steps 3.2 to 3.3, and let K traverse a natural number between 3 and 10. The value with the highest recognition accuracy is the optimal K value.

[0132] Application stage:

[0133] Use the trained KNN model to perform online attack and fault identification. The specific steps are as follows:

[0134] Step A: Capture message data from the running catalytic cracking fractionation system, obtain process variable data according to the IEEE 754 standard, and obtain multi-domain anomaly features according to step 1;

[0135] Step B: Perform sample alignment as in step 2

[0136] Step C: Based on the optimal K value obtained in step 3.4, calculate the K samples closest to the test sample according to formula (6). If the one that appears most times is the normal class, it is judged as normal; if the one that appears most times is the attack class, it is judged as an attack; if the one that appears most times is the fault class, it is judged as a fault.

[0137] It is understandable that the traversal range of the K value can be adjusted according to the sample size.

[0138] The catalytic cracking fractionation system attack and fault identification method provided by the embodiment of the present invention first designs a hash algorithm-based anomaly detection method and a C-LSTM-based anomaly detection model based on the characteristics of information domain data and physical domain data, respectively. Based on the above multi-domain anomaly detection method, multi-domain anomaly features describing the system status are extracted; to facilitate the use of features, sample alignment is performed on the above multi-domain anomaly features; the processed features are used for KNN model training, and the optimal K value is obtained through K-fold cross-validation; and the trained KNN model is used for online attack and fault identification.

[0139] An embodiment of the present invention provides an electronic device, comprising: a computer-readable storage medium and a processor;

[0140] The computer-readable storage medium is used to store executable instructions;

[0141] The processor is configured to read the executable instructions stored in the computer-readable storage medium and execute the method described in any one of the above embodiments.

[0142] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method described in any of the above embodiments.

[0143] An embodiment of the present invention provides a computer program product, including a computer program or instructions, which implements the method described in any of the above embodiments when executed by a processor.

[0144] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for distinguishing attacks and failures in a catalytic cracking fractionation system, characterized in that: include: Training phase: S1, determining when the catalytic cracking fractionation system is in a normal state, an attack state, and a fault state, wherein the abnormal feature vector IF of the information domain device node is {I1, I2, ..., I m }; Among them, m is the total number of information domain device nodes. i and I j If the hash value of the sender's message is consistent with the hash value of the receiver's message, then I i =0,I j =0, otherwise I i =1,I j =1;I i , I j are the abnormal features of the i-th and j-th information domain device nodes, respectively. The value range of i and j is 1 to m. S2, when the catalytic cracking fractionation system is in a normal state, the strongly correlated variables of each variable in the n-dimensional physical domain process variables and the causal relationship between the above variables are determined, and the variables are input into the LSTM network to construct a C-LSTM network; the n-dimensional physical domain process variables in the normal state are input into the C-LSTM network to train them, and the n-dimensional physical domain process variables in the attack state, the fault state and the normal state that do not participate in the training are respectively input into the trained C-LSTM network to obtain the predicted value of the n-dimensional physical domain process variable in the corresponding state, and the difference between the predicted value and the corresponding actual value is calculated. If the difference is greater than the threshold, the characteristic value of the node corresponding to the physical domain process variable is 1, otherwise it is 0, thereby obtaining the characteristic vector PF of the node corresponding to each physical domain process variable in the normal state, the attack state and the fault state = {P1, P2, ..., P n }; Among them, P n is the characteristic of the node corresponding to the nth physical domain process variable; S3, the abnormal feature vectors IFA of all information domain device nodes in each communication cycle are calculated as follows: IFA = {IFA1, IFA2, ..., IFA m } and PF={P1,P2,...,P n } are spliced ​​to obtain the abnormal feature vectors F of the information domain and physical domain of the catalytic cracking fractionation system in each state = {IFA1, IFA2, ..., IFA m ,P1,P2,...,P n }, and use F as a sample and the state corresponding to F as a label to train the KNN model, and obtain a trained catalytic cracking fractionation system attack and fault identification model; Among them, IFA i =I 1i ∨I 2i ∨...∨I qi , q is the number of messages in a communication cycle, I qi is the abnormal feature of the device node in the i-th information domain obtained from the q-th message; Application stage: The abnormal feature vectors of all information domain device nodes of the catalytic cracking fractionation system to be identified within a communication cycle are spliced ​​with the feature vectors of all physical domain process variable corresponding nodes and then input into the trained catalytic cracking fractionation system attack and fault identification model to obtain the attack and fault identification results of the catalytic cracking fractionation system to be identified.

2. The method according to claim 1, wherein In step S2, the n-dimensional physical domain process variables (X1, X2, ..., X n ) The method of obtaining the strongly correlated variables of each variable in is as follows: Calculate the n-dimensional physical domain process variables (X1, X2, ..., X n ) and X k The mutual information value I k =(I k1 ,I k2 , ... ,I kn ), if I kp Greater than or equal to mean(I k )+1.5*std(I k ), then X p For X k The values ​​of p and k are both from 1 to n; mean represents the mean, and std represents the standard deviation.

3. The method according to claim 1 or 2, wherein: In step S2, the causal relationship between variables is obtained as follows: For variables X and Y, if the time-lagged mutual information IM1 of the lagged Y variable with respect to the X variable is greater than the time-lagged mutual information IM2 of the lagged X variable with respect to the Y variable, then the causal relationship is X→Y; otherwise, the causal relationship is Y→X.

4. The method according to claim 1, wherein The SHA-256 algorithm is used to calculate the hash value of the communication message of each information domain device node.

5. An electronic device, characterized in that: include: Computer-readable storage medium and processor; The computer-readable storage medium is used to store executable instructions; The processor is configured to read the executable instructions stored in the computer-readable storage medium and execute the method according to any one of claims 1 to 4.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute the method according to any one of claims 1 to 4.

7. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images