Industrial control system time sequence anomaly detection method, electronic equipment and storage medium

By combining the time series of network traffic and process data, using deep learning methods and attention mechanisms, the problem of poor attack detection results caused by single attention network or physical domain in the prior art is solved, and high-accuracy anomaly detection of industrial control systems is achieved.

CN119717765AActive Publication Date: 2025-03-28WUHAN UNIV OF TECH
5 Cites 0 Cited by

Patent Information

Application Number
CN202411868614.1
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-12-18
Publication Date
2025-03-28
Estimated Expiration
2044-12-18

AI Technical Summary

Technical Problem

The existing industrial control system timing abnormality detection methods only focus on the network domain or physical domain, resulting in poor attack detection results and it is difficult to detect attacks on the network and physical sides at the same time.

Method used

By constructing a time series combining network traffic and process data, using deep learning methods such as sliding window sharding processing and time convolution networks, combining channel attention mechanism and self-attention network, the representation differences between slices and within slices are calculated and determined to be abnormal.

Benefits of technology

The dual-domain information combination of industrial control systems is realized, the accuracy of detection of network physical attacks is improved, the rate of missed and false alarms is reduced, and the performance of abnormal detection is improved.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention provides a time sequence anomaly detection method for an industrial control system, and the method comprises the following steps: constructing a time sequence which comprises process data at T moments, and the number of bytes and the number of data packets flowing through within a moment interval; each piece of process data comprises values of m industrial parameters; carrying out fragmentation processing on the time sequence through a sliding window to obtain a training sample set; carrying out fragmentation operation to carry out dimension conversion to obtain visual angles between the fragments and visual angles in the fragments; processing the visual angles between the fragments and the visual angles in the fragments through a time convolutional network, a channel attention mechanism and a self-attention network in sequence to obtain expressions between the fragments and expressions in the fragments; and after the inter-fragment representation and the intra-fragment representation are subjected to dimension unification, calculating a difference value of the two representations by utilizing KL divergence, and when the difference value is greater than or equal to a threshold value, judging that the representation is abnormal. The deep learning model can be modeled from two aspects of a network domain and a physical domain at the same time, so that the model is more accurate.
Need to check novelty before this filing date? Find Prior Art