Industrial Internet of Things attack prediction method based on BiAPRN

Abstract

The invention relates to the technical field of Internet of Things security, in particular to an industrial Internet of Things attack prediction method based on BiAPRN, and the method comprises the steps: firstly introducing an improved single-gate structure gating recursive unit model, and remarkably improving the performance of the model through a self-attention mechanism and a loss compensation mechanism; and then a new bidirectional attention simple recursive network (BiAPRN) neural network model is constructed. The BiAPRN effectively extracts data features by combining linear combinations of forward and backward aprn, more deeply mines the correlation of time sequences, and significantly reduces prediction errors. And finally, obtaining an industrial Internet of Things attack prediction framework through the BiAPRN model, and performing attack prediction by using the trained BiAPRN model, thereby realizing accurate and efficient industrial Internet of Things attack prediction.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to an industrial Internet of Things attack prediction method based on BiAPRN. Background Art

[0002] Industrial IoT faces severe security challenges such as data leakage, malicious attacks, and virus infection. In traditional defense systems, technical means such as intrusion detection and key establishment have been implemented, and advanced security equipment has been equipped. However, these technologies can only provide passive defense and cannot actively discover or predict attacks through network behavior and threat analysis. This limitation hinders the effective use of network threat strategies, resulting in high false alarm rates and major challenges.

[0003] In order to conduct active defense, people have adopted the technical solution of attack prediction. Attack prediction is an effective security mechanism that analyzes historical network traffic data and establishes accurate prediction models to predict future attacks. Deploying such a system allows IIoT security administrators to monitor and predict attacks, implement defense measures in advance, and provide real-time protection for IIoT devices and systems. In conjunction with machine learning and deep learning, models such as deep neural networks (DNN), convolutional neural networks (CNN), and recurrent neural networks (RNN) are used to identify network threats. However, existing RNNs and their variants, such as gated recurrent units (GRUs), show limitations in processing network traffic data, especially in long- and short-term information processing and data representation learning.

[0004] Given the large scale, complexity, and time-series nature of IIoT network traffic, these models need to be improved in terms of real-time processing, efficiency, and prediction accuracy. Summary of the invention

[0005] The purpose of the present invention is to provide an industrial Internet of Things attack prediction method based on BiAPRN, design a bidirectional attention minimalist recursive network model, eliminate redundant information in the past hidden state, and achieve accurate and efficient industrial Internet of Things attack prediction.

[0006] To achieve the above object, the present invention provides an industrial Internet of Things attack prediction method based on BiAPRN, comprising the following steps:

[0007] Step 1: Improve the GRU model to obtain an attention-based minimalist recursive network model;

[0008] Step 2: Build a bidirectional attention minimalist recurrent neural network model;

[0009] Step 3: Collect data generated by industrial IoT devices;

[0010] Step 4: Preprocess the collected data and complete the data set partitioning;

[0011] Step 5: Input the data of the data set into the bidirectional attention simplified recurrent neural network model for training;

[0012] Step 6: Use the trained bidirectional attention simplified recurrent neural network model to predict the results of the test data set;

[0013] Step 7: Apply the trained bidirectional attention minimalist recurrent neural network model to a real industrial IoT environment and visualize the results.

[0014] Specifically, during the execution of step 1, the gating mechanism module and the self-attention module are used to replace the update gate in the GRU model;

[0015] In the gating mechanism module, when x t When fed into the gating mechanism module, the gating mechanism enables the network to discern when to update or ignore information in the hidden state, as expressed by:

[0016] x t =tanh(w h ·x t +b h )×δ(w s ·x t +b s )+x t

[0017] Among them, tanh is the hyperbolic tangent function, δ is the sigmoid function, and w h 、w s 、b h 、b s These are all learnable parameters of the gating mechanism;

[0018] Reset gate module,The role of the reset gate is to determine to what extent past information should be forgotten and how much should be considered when updating the current state. The reset gate r, can be calculated as follows:

[0019] r=δ(w ir ·x t +b ir +w hr ·h t-1 +b hr )

[0020] Among them, δ is the sigmoid function, w ir , whr , b ir and b hr are all learnable parameters of the reset gate.

[0021] In the self-attention module, by splicing and h t-1 Construct a candidate set to prepare for the subsequent self-attention mechanism learning data. The formula is as follows:

[0022]

[0023] Among them, h t-1 Indicates past tense The hidden state of the moment, h t Indicates the hidden state at the current moment, represents the candidate set, w in , w hn , b in and b hn are all learnable parameters of the candidate set, stack is a matrix concatenation operation, h s It is the result of splicing.

[0024] In the attention-saving recursive network model, self-attention is used to learn the relationship between the past hidden state and the current input. The corresponding formula is as follows:

[0025] h t ' -1 =Self-Attention(h s )

[0026]

[0027] Specifically, the output of the bidirectional attention simplified recurrent neural network model in step 2 consists of two parts, expressed as follows:

[0028]

[0029] in, Indicates the future status information being output to the APRN. Represents the past state information output to the APRN. is the forward APRN model, is the backward APRN model, w1, w2, and b are learnable parameters of the linear combination.

[0030] The present invention provides an industrial Internet of Things attack prediction method based on BiAPRN. First, an improved single-gate structure gated recursive unit model is introduced, which significantly improves the performance of the model through a self-attention mechanism and a loss compensation mechanism. Then a new bidirectional attention parsimonious recursive network (BiAPRN) neural network model is constructed. BiAPRN effectively extracts data features by combining the linear combination of forward and backward APRNs, and more deeply mines the correlation of time series, significantly reducing the prediction error. Finally, an industrial Internet of Things attack prediction framework is obtained through the BiAPRN model, and the trained BiAPRN model is used for attack prediction to achieve accurate and efficient industrial Internet of Things attack prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 It is a schematic flow chart of the steps of an industrial Internet of Things attack prediction method based on BiAPRN of the present invention.

[0033] Figure 2 It is a structural schematic diagram of the APRN model of the present invention.

[0034] Figure 3 It is a structural schematic diagram of the BiAPRN model of the present invention.

[0035] Figure 4 It is a schematic diagram of the workflow of attack prediction based on the BiAPRN model of the present invention.

[0036] Figure 5 It is a schematic diagram of the confusion matrix of the BiAPRN model based on various data sets in the specific embodiment examples of the present invention.

[0037] Figure 6 It is a schematic diagram of effectiveness evaluation of various schemes in a specific embodiment of the present invention on a data set.

[0038] Figure 7 It is a comparison chart of the training time overhead of various schemes in the specific implementation example of the present invention.

[0039] Figure 8 It is a comparison chart of the test time overhead of various schemes in the specific implementation example of the present invention. DETAILED DESCRIPTION

[0040] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0041] The following is a semantic explanation of some of the English term abbreviations that appear in this invention:

[0042] Gate Recurrent Unit, GRU: gated recurrent unit;

[0043] Attention Parsimonious Recurrent Network, APRN: Attention Parsimonious Recurrent Network;

[0044] BidirectionalAttention Parsimonious RecurrentNetwork, BiAPRN: Bidirectional Attention Parsimonious Recurrent Network.

[0045] Bidirectional Long Short-Term Memory, BiDLSTM: Bidirectional long short-term memory network.

[0046] Parsimonious memory unit forrecurrent neural networks: Parsimonious memory recurrent unit.

[0047] See also Figure 1 The present invention provides an industrial Internet of Things attack prediction method based on BiAPRN, comprising the following steps:

[0048] S1: Improve the GRU model to obtain an attention-based minimalist recurrent network model;

[0049] S2: Construct a bidirectional attention minimalist recurrent neural network model;

[0050] S3: Collect data generated by industrial IoT devices;

[0051] S4: preprocess the collected data and complete the data set partitioning;

[0052] S5: inputting the data of the data set into the bidirectional attention simplified recurrent neural network model for training;

[0053] S6: Use the trained bidirectional attention minimalist recurrent neural network model to predict the results of the test dataset;

[0054] S7: Apply the trained bidirectional attention minimalist recurrent neural network model to a real industrial IoT environment and visualize the results.

[0055] The following is a further explanation based on the specific implementation steps and related technical solutions:

[0056] In step S1, the present invention introduces the APRN model to alleviate the problem that the gating structure of the standard GRU may cause omission of key content in a long sequence.

[0057] like Figure 2 As shown, the present invention adopts r and x t Represent the reset gate and the input at the current moment respectively. At the same time, h t-1 Represents the hidden state of the past moment, with h t Indicates the hidden state at the current moment, using Denote the candidate set, using h t ' -1 Represents the hidden information of the past moments since attention learning.

[0058] Gating mechanism module, when x t When fed into the gating mechanism module, the gating mechanism enables the network to discern when to update or ignore information in the hidden state. The formula is:

[0059] x t =tanh(w h ·x t +b h )×δ(w s ·x t +b s )+x t

[0060] Where tanh is the hyperbolic tangent function, w h 、w s 、b h 、b s are all learnable parameters of the gating mechanism.

[0061] Reset gate module,The role of the reset gate is to determine to what extent past information should be forgotten and how much should be considered when updating the current state. The reset gate r, can be calculated as follows:

[0062] r=δ(w ir ·x t +b ir +w hr ·h t-1 +b hr )

[0063] Where δ is the sigmoid function, w ir 、bir 、w h 、b hr are all learnable parameters of the reset gate r.

[0064] The self-attention module, the present invention is achieved by splicing and h t-1 Construct a candidate set to prepare for the subsequent self-attention mechanism learning data. The relevant formula is as follows:

[0065]

[0066] Among them, w in , w hn , b in and b hn are all learnable parameters of the candidate set, stack is a matrix concatenation operation, h s It is the result of splicing.

[0067] Finally, self-attention is used to learn the relationship between past hidden states and current input. The relevant formula is as follows:

[0068] h t ' -1 =Self-Attention(h s )

[0069]

[0070] In step S2, BiAPRN extends the traditional APRN model and improves attack prediction performance. It trains two APRNs: one on the original input data and the other on the reversed input data. This bidirectional modeling allows the network to consider both past and future information at the same time, capturing patterns and regularities in time series data. Unlike traditional bidirectional networks, BiAPRN uses linear combination techniques for more efficient feature learning. Therefore, in tasks such as network traffic attack prediction, BiAPRN improves the prediction accuracy of the model.

[0071] The specific structure of the BiAPRN model is as follows Figure 3 As shown, the current APRN output, for example, y t , consists of two components, Indicates the future status information being output to the APRN. Represents the past state information output by the backward APRN. The formula is as follows:

[0072]

[0073] in, is the forward APRN model, is the backward APRN model, w1, w2, and b are learnable parameters of the linear combination.

[0074] After obtaining the BiAPRN model, Figure 4 The figure shows a typical workflow of the attack prediction scheme based on BiAPRN, and for details, see steps S3 to S7 of the method of the present invention.

[0075] Step S3: At the data collection layer, industrial IoT devices will generate a large amount of network traffic data when participating in the industrial production environment, and the generated data needs to be collected.

[0076] Step S4: At the data processing layer, data acquisition involves collecting raw data from IIoT devices. After acquisition, data preprocessing ensures high-quality and effective deep learning model training. Preprocessing includes normalization, character encoding, and dataset partitioning.

[0077] Step S5: In the model training layer, the dataset from the data processing layer is used. The data is then input into the Bi-APRN model. The BiAPRN model includes forward and backward neural networks to capture temporal dynamics and attention mechanisms for key features. The trained BiAPRN model is then used for attack prediction.

[0078] Step S6: In the test and prediction layer, the trained Bi-APRN model predicts the results of the test dataset. The performance and generalization of the model are measured using criteria such as Accuracy, Precision, and Recall, and the F1 score is utilized. These metrics provide insights into the accuracy and reliability of the predictions.

[0079] Step S7: At the result presentation layer, the trained BiAPRN model is applied to a real IIoT environment and the results are visualized, enabling IIoT security administrators to monitor potential cyber attacks.

[0080] Furthermore, in order to further illustrate the benefits of the industrial Internet of Things attack prediction method, the present invention proposes a specific embodiment, which is explained by comparing with the existing solution:

[0081] 1. Theoretical computational complexity

[0082] The comparison with some existing schemes is shown in Table 1. In general, it is assumed that the dimension of the input data is m and the number of hidden units is n. GRU uses reset gate and update gate to control the information flow. Therefore, through the GRU double gating mechanism, the total number of its operations is T(3×n×m+6×n 2 +4×n), the time complexity is O(n 2). On the other hand, BiDLSTM consists of two LSTMs. Therefore, the total number of operations of BiDLSTM is T(2×(4×n×m+4×n2+4×n)) and the time complexity is O(n 2 ). The gate structure of PMU is much cleaner, so its total number of operations is T(2×n×m+2×n2+2×n) and its time complexity is O(n 2 ). As for APRN, it consists of Self-Attention and a gating unit. The total number of operations required for self-attention is T(12×n2+2×n), and the time complexity is O(n 2 ). It can be seen that the total number of operations required by BiAPRN is T(2×(2×n×m+16×n2+6×n)), and the time complexity is O(n 2 ).

[0083] Table 1 Time complexity comparison

[0084] method Operation time Complexity GRU <![CDATA[T(3×n×m+6×n 2 +4×n)]]> <![CDATA[O(n 2 )]]> PMU <![CDATA[T(2×n×m+2×n 2 +2×n)]]> <![CDATA[O(n 2 )]]> BiDLSTM <![CDATA[T(2×(4×n×m+4×n 2 +4×n))]]> <![CDATA[O(n 2 )]]> APRN <![CDATA[T(2×n×m+16×n 2 +6×n)]]> <![CDATA[O(n 2 )]]> BiAPRN <![CDATA[T(2×(2×n×m+16×n 2 +6×n))]]> <![CDATA[O(n 2 )]]>

[0085] 2. Comparison of multiple experimental data sets:

[0086] 1) Experimental environment: All simulations were performed on a desktop computer with Windows 11 and 16 GB RAM. CUDA 10.0, cuDNN 7.4.2, and Python 3.7 were installed on the desktop. The CPU was an Intel Core i5-8300H at 2.30 GHz, and the GPU was an NVIDIA GeForce GTX 1050Ti. The deep learning framework used was PyTorch 1.8.

[0087] 2) Experimental Dataset: NSL-KDD is a widely recognized public dataset. It includes KDDTrain+ as a training set for model learning, and KDDTesn+ and KDDTest-21 as test sets for evaluating the performance of trained models. In order to enhance the realism of network traffic simulation, the test dataset contains many attack types that do not exist in the training set. For optimal model training, KDDTrain+ is mainly used as the training set, and KDDTest+ is used as the test set in the experiment.

[0088] The UNSW-NB15 dataset is one of the widely used benchmark datasets. As a modern dataset, UNSW-NB15 is very different from the previous NSL-KDD dataset, reflecting more complex and diverse network traffic scenarios. The UNSW-NB15 dataset covers nine modern and common network attack types.

[0089] The Bot-IoT dataset was created by designing a realistic network environment in the UNSW Canberra Cyber ​​Range Laboratory. This dataset contains a large amount of network attack traffic from IIoT devices, normal traffic, and botnet attacks. The pcap file size captured by this dataset is 69.3GB and contains more than 72,000,000 records. This example uses the training set and test set in the "5%" folder as the experimental dataset.

[0090] 3) Evaluation criteria: A variety of evaluation parameters are used to evaluate the capabilities of the proposed BiAPRN model. The main classifications of true positive (TP), true negative (TN), false positive (FP) and false negative (FN) are given through the confusion matrix. The present invention will comprehensively adopt ConfusionMatrix, Accuracy, Precision, Recall and F1_score as evaluation indicators to ensure the thoroughness of the evaluation.

[0091] 4) Implementation: The BiAPRN model is implemented in Python using Pytorch. Hyperparameters are adjusted according to dataset differences. For the NSL-KDD dataset, the Adaptive Moment Estimation (Adam) optimizer is used with a learning rate of 0.001. The BiAPRN hidden layer has 180 neurons, 256 batches, and 700 training epochs. For the USNW-NB15 dataset, the Adam optimizer is used with a learning rate of 0.001. The hidden layer has 100 neurons, 512 batches, and 300 training epochs. For the BoT-IoT dataset with more than 23,000,000 samples, the Adam optimizer is used with a learning rate of 0.001. The hidden layer has 150 neurons, 1024 batches, and 200 training epochs, reducing time overhead while ensuring performance.

[0092] Specifically, this embodiment compares the attack prediction scheme based on APRN, the attack prediction scheme based on PMU, the attack prediction scheme based on BiDLSTM and the attack prediction scheme based on GRU, and explains it from the following aspects:

[0093] 1) Attack prediction model robustness: In order to better evaluate the effectiveness and robustness of the BiAPRN model, this embodiment conducted a series of complementary experiments considering ablation. The BiAPRN model is based on the principles of the gating mechanism (GM) and the self-attention (SA) module; these components are further aggregated to produce the final model. In this case, this embodiment created two BiAPRN variants: w / o GM and w / o SA. In the w / o GM variant, the gating mechanism responsible for regulating the information flow is deleted. In the w / o SA variant, the self-attention mechanism and residual connections are deleted.

[0094] The corresponding parameter configurations are shown above and applied to all ablation experiments, and the results are shown in Table 2. It is observed that all performance indicators of the w / o GM and w / o SA models are significantly lower than the BiAPRN model on various datasets. The full implementation of BiAPRN achieves excellent results, which shows that removing any module will have a significant impact on the results. Therefore, the resilience and effectiveness of the BiAPRN model are verified.

[0095] Table 2 Comparison of ablation test results

[0096]

[0097]

[0098] 2) Accuracy and generalizability: The training process of deep learning is essentially a self-learning process, where the model learns from a large amount of data through iterative training. In this case, the diagonal entries of the confusion matrix are particularly important because they represent the number of correct identifications for each category. Essentially, larger numbers on the diagonal indicate that the deep learning model has successfully learned and acquired more knowledge. Figure 5 5a, 5b and 5c show that the BiAPRN model of the present invention effectively learns from the training dataset.

[0099] In addition, in order to ensure the comprehensiveness of the evaluation, this embodiment comprehensively adopts the evaluation indicators of Accuracy, Precision, Recall and F1 score to verify the effectiveness of the method of the present invention.

[0100] Effectiveness evaluation based on the NSL-KDD dataset. In the analysis of the NSL-KDD dataset, Figure 6 As shown in Figure 1, the BiAPRN solution proposed in the present invention shows excellent performance in multiple evaluation indicators. Among them, the accuracy of the BiAPRN model of the present invention reached 81.44%, which is significantly better than the APRN, PMU, BiDSLTM and GRU models, whose accuracy rates are 78.56%, 79.02%, 79.51% and 79.79% respectively. In terms of Precision, Recall and F1 scores, the BiAPRN model of the present invention reached 82.59%, 81.19% and 78.91% respectively, which is better than the APRN, PMU, BiDSLTM and GRU models.

[0101] The effectiveness is evaluated based on the UNSW-NB15 dataset. Figure 6It can be clearly seen in b that the scheme proposed in the present invention has achieved significant advantages in four indicators based on the UNSW-NB15 dataset - accuracy, precision, recall rate and F1 score. For example, the accuracy of the scheme proposed in the present invention is 96.5%, while the accuracies of the other four schemes are 94.54%, 94.62%, 94.42% and 93.20% respectively. For another example, the F1 score of the scheme proposed in the present invention is 96.60%, which is significantly higher than the F1 scores of other schemes by 2%, because the F1 scores of other schemes are 94.59%, 94.42%, 94.50% and 93.31% respectively. Therefore, the comprehensive effectiveness of the scheme proposed in the present invention is superior.

[0102] Effectiveness evaluation based on the Bot-IoT dataset. In contrast to the UNSW-NB15 dataset, the BoT-IoT dataset is mainly composed of attack traffic, and normal traffic data accounts for less than 1% of the dataset. Figure 6 c. It can be observed that all attack prediction schemes can achieve high Accuracy, Precision, Recall and F1 scores. The accuracy, precision, recall and F1 scores of BiAPRN proposed by the present invention are 99.99%, 96.67%, 99.99% and 98.18% respectively. In general, BiAPRN has more advantages than the other four models.

[0103] Overall, compared with some existing schemes, the proposed scheme has significant improvements in all indicators: accuracy, precision, recall and F1 score. This is because in BiAPRN, the present invention achieves better feature extraction through a bidirectional network and designs a loss compensation mechanism that significantly reduces the loss of data features. Therefore, BiAPRN has stronger effectiveness, versatility and generalization ability.

[0104] 3) Low detection latency: The running time of the experimental test is divided into model training and testing time overhead.

[0105] Comparison of training time overhead. In this experiment, the present invention trained the deep learning model and tested the time overhead, such as Figure 7 As shown. The training time overhead of the BiAPRN model on the NSL-KDD, UNSW-NB15 and Bot-IoT datasets are 106.66min, 104.33min and 84.63min respectively. The present invention finds that the training time overhead using the UNSW-NB15 dataset is slightly lower than that of the NSL-KDD dataset. Compared with the UNSW-NB15 dataset, the NSL-KDD dataset has a smaller batch size and more training epochs. Due to the forward and reverse sequential input, learning process and loss compensation of BiAPRN, the scheme proposed by the present invention has the highest training time overhead.

[0106] Comparison of test time costs. Calculate the average test time for every 100 samples to standardize the test time. Figure 8 a. Figure 8 b and Figure 8 As shown in Figure c, the test overhead of the BiAPRN model on the three data sets is 3.23ms, 3.9ms and 3.63ms respectively. Compared with other methods, the method proposed in the present invention prolongs the processing time. This extension is due to the inclusion of the forward model, inverse model and self-attention mechanism in BiAPRN, which leads to additional time overhead. Although it costs more time overhead, the scheme proposed in the present invention achieves more attractive effectiveness. In addition, the test time overhead and difference are negligible and acceptable without significantly affecting the performance. The performance requirements for low latency in the IIoT environment are met, ensuring efficient and timely data transmission.

[0107] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A BiAPRN-based industrial Internet of Things attack prediction method, characterized in that: The following steps are involved: Step 1: Improve the GRU model to obtain an attention-based minimalist recursive network model; Step 2: Build a bidirectional attention minimalist recurrent neural network model; Step 3: Collect data generated by industrial IoT devices; Step 4: Preprocess the collected data and complete the data set partitioning; Step 5: Input the data of the data set into the bidirectional attention simplified recurrent neural network model for training; Step 6: Use the trained bidirectional attention simplified recurrent neural network model to predict the results of the test data set; Step 7: Apply the trained bidirectional attention minimalist recurrent neural network model to a real industrial IoT environment and visualize the results.

2. The industrial Internet of Things attack prediction method based on BiAPRN as claimed in claim 1, characterized in that: During the execution of step 1, the gating mechanism module and the self-attention module are used to replace the update gate in the GRU model; In the gating mechanism module, when x t When loaded into the gating mechanism module, the gating mechanism enables the network to discern when to update or ignore information in the hidden state, expressed as: x t =tanh(w h ·x t +b h )×δ(w s ·x t +b s )+x t Where tanh is the hyperbolic tangent function, δ is the sigmoid function, and w h 、w s , b h , b s These are all learnable parameters of the gating mechanism; Reset gate module,The role of the reset gate is to determine to what extent past information should be forgotten and how much should be considered when updating the current state; the reset gate r can be calculated as follows: r=δ(w ir ·x t +b ir +w hr ·h t-1 +b hr ) Among them, δ is the sigmoid function, w ir , w hr , b ir and b hr are all learnable parameters of the reset gate; In the self-attention module, by splicing and h t-1 Construct a candidate set to prepare for the subsequent self-attention mechanism learning data. The formula is as follows: Among them, h t-1 represents the hidden state at the past moment, h t Indicates the hidden state at the current moment, represents the candidate set, w in , w hn , b in and b hn are all learnable parameters of the candidate set, stack is a matrix concatenation operation, h s It is the result of splicing.

3. The industrial Internet of Things attack prediction method based on BiAPRN as claimed in claim 2, characterized in that: In the attention-saving recursive network model, self-attention is used to learn the relationship between the past hidden state and the current input. The corresponding formula is as follows: h t ′ -1 =Self-Attention(h s ) 4. The industrial Internet of Things attack prediction method based on BiAPRN as claimed in claim 3, characterized in that: The output of the bidirectional attention simplified recurrent neural network model in step 2 consists of two parts, expressed as follows: in, Indicates the future state information being output to the APRN. Represents the past state information output to the APRN. is the forward APRN model, is the backward APRN model, w1, w2, and b are learnable parameters of the linear combination.

Images