Industrial control system timing anomaly detection method, electronic device and storage medium

Abstract

The present invention provides a method for detecting time series anomalies in an industrial control system, comprising the following steps: constructing a time series, the time series comprising process data at T moments and the number of bytes and data packets flowing within the time interval; each process data comprising the values ​​of m industrial parameters; slicing the time series using a sliding window to obtain a training sample set; performing dimensionality conversion on the slicing operation to obtain inter-slice perspectives and intra-slice perspectives; processing the inter-slice perspectives and intra-slice perspectives sequentially through a temporal convolutional network, a channel attention mechanism, and a self-attention network to obtain inter-slice representations and intra-slice representations; unifying the inter-slice representations and intra-slice representations, and calculating the difference between the two representations using KL divergence. When the difference is greater than or equal to a threshold, an anomaly is determined. This enables a deep learning model to simultaneously model from both the network domain and the physical domain, making the model more accurate.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control system detection, and in particular to an industrial control system timing anomaly detection method, electronic equipment, and storage medium. Background Art

[0002] An Industrial Control System (ICS) is an automated control system composed of computers and industrial process control components. It includes the Industrial Control Network (ICN) and all related industrial production equipment. ICS are widely used in sectors such as power generation, water conservancy, wastewater treatment, and petrochemicals. Through a series of sensors, actuators, and controllers, ICS collects and responds to data related to industrial processes, ensuring the normal operation of industrial facilities. While ICS plays a vital role in optimizing production efficiency and facilitating industrial process automation, their increasing intelligence makes them vulnerable to various security threats due to their connectivity to external networks and direct interaction with physical devices. These threats include industrial control network viruses, security vulnerabilities in industrial communication protocols, and advanced persistent threats. These threats can not only lead to information leakage and ICS downtime, but also have direct impacts on the real world, as ICS controls the operation of critical infrastructure.

[0003] To protect ICS security, intrusion detection systems (IDS) have been introduced. An IDS is a system capable of monitoring and identifying potential security threats within ICNs. Currently, the most actively researched deep learning-based IDS can be categorized into supervised, unsupervised, and semi-supervised. Supervised IDSs offer high detection accuracy but are unable to address unknown threats. Unsupervised IDSs can identify unknown threats but suffer from a high false positive rate. IDSs detect both ICN network traffic data and process data from industrial physical processes, including sensor data and control commands. Since ICSs are typically pre-configured, their interactive behavior patterns rarely change during normal operation. Therefore, traffic within ICNs typically exhibits regularity and periodicity. Detection of industrial control traffic can be accomplished through header and payload inspection, similar to traditional IT network traffic, or by leveraging the unique characteristics of industrial control traffic. Process data is generally considered time series data. Both detection of process data and detection of network traffic data, leveraging the unique characteristics of industrial control traffic, can be categorized as time-series anomaly detection (TAD). These methods typically use network traffic or process data as input to a deep learning algorithm to build a behavioral model of the ICS under normal operating conditions. Any deviation from this model is considered an anomaly and a potential attack. ICS are cyber-physical systems that integrate sensing, computing, control, and networking into industrial processes, creating a tight coupling between the cyber domain (industrial control network) and the physical domain (industrial physical process). Most attacks against ICS are cyber-physical, impacting both the cyber and physical domains. However, current time-series anomaly detection methods in the industrial control field typically utilize information from only one domain. This results in the constructed models' inability to accurately characterize normal ICS behavior, ultimately limiting attack detection effectiveness and generating a large number of false negatives. Furthermore, for attacks affecting both the network and physical sides, focusing on only one side of the information may result in a small discrepancy between normal and abnormal data, leading to false positives. Summary of the Invention

[0004] The present invention proposes a method, electronic device and storage medium for detecting timing anomalies in industrial control systems to solve the technical problem that existing timing anomaly detection methods in the industrial control field only focus on the network domain (network traffic) or the physical domain (process data), resulting in poor attack detection effect.

[0005] To solve the above technical problems, the present invention provides a method for detecting time sequence anomalies in an industrial control system, comprising the following steps:

[0006] Step S1: constructing a time series, wherein the time series includes process data at T moments and the number of bytes and data packets flowing within the time interval; each process data includes the values ​​of m industrial parameters;

[0007] Step S2: After the time series is sliced ​​by a sliding window, a training sample set is obtained. The training sample set is represented as k t The dimension is expressed as (channel, sequence), T represents the length of the time series, s represents the size of the sliding window, w represents the step size of the sliding window, and channel represents the training sample k t The length is s, sequence represents the training sample k t The number of channels is m+2;

[0008] Step S3: Perform sharding on the sequence dimension, with each shard of size p, to obtain the inter-shard perspective (channel, p, n). Swap the row and column dimensions to obtain the intra-shard perspective (channel, n, p), where p × n = sequence.

[0009] Step S4: The inter-slice perspective and the intra-slice perspective are processed in turn by the temporal convolutional network, the channel attention mechanism and the self-attention network to obtain the inter-slice representation (channel, n×n) and the intra-slice representation (channel, p×p).

[0010] Step S5: After unifying the dimensions of the inter-shard representation and the intra-shard representation, the difference between the two representations is calculated using KL divergence. When the difference is greater than or equal to a threshold, it is determined to be abnormal.

[0011] Preferably, the method for calculating the number of bytes flowing through a time period in the time series includes: assuming that a total of S traffic packets pass through the entire industrial control network in the entire time series, using the set P = {p1, p2, ..., p s ,…,p S} means that the number of bytes flowing during the time period is calculated using the following expression:

[0012]

[0013] Where, time(p i ) indicates p i Timestamp; [x t-1 ,x t ] represents x t-1 with x t The time period between.

[0014] Preferably, the method for calculating the number of data packets flowing through a time period in the time series includes: assuming that a total of S traffic packets pass through the entire industrial control network in the entire time series, using the set P = {p1, p2, ..., p s ,…,p S} means that the number of packets flowing through the time period is calculated using the following expression:

[0015]

[0016] Where, Count() represents count; [x t-1 ,x t ] represents x t-1 with x t The time period between.

[0017] Preferably, in step S2, the step size w of the sliding window is set to 1.

[0018] Preferably, step S4 includes: assuming the number of convolution kernels of the temporal convolutional network TCN is d model After TCN and channel attention mechanism processing and dimension swapping, the intra-slice perspective and inter-slice perspective become (channel, n×d model ) and (channel,p×d model ); Finally, the self-attention network is used to process the results to obtain the inter-slice representation (channel, n×n) and intra-slice representation (batch×channel, p×p) of the time series.

[0019] Preferably, in step S5, the method for dimensional unification includes: each element in the inter-slice representation is repeatedly upsampled p times along the row and column dimensions respectively, and the intra-slice representation is repeatedly upsampled n times along the row and column dimensions as a whole.

[0020] The present invention also provides an electronic device, comprising: a memory, a processor and a computer program, wherein the computer program is stored in the memory and configured to be executed by the processor to implement the above method.

[0021] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the above method.

[0022] The beneficial effects of the present invention include at least:

[0023] 1) Combining traffic statistics (network domain) and process data (physical domain) based on the characteristics of time intervals such as time series. This combination method is simple to operate, highly feasible, and can be extended to most industrial control data sets.

[0024] 2) The input data combines traffic statistics and process data, enabling the deep learning model to model the normal behavior of ICS from both the network and physical domains, making the model more accurate.

[0025] 3) The addition of traffic statistics can make up for the poor detection performance of anomaly detection methods based on process data when detecting cyber-physical attacks against ICS.

[0026] 4) Temporal Convolutional Networks (TCNs) can both apply the channel independence assumption and better extract temporal dependencies between and within shards. The channel attention mechanism allows the model to focus more on process data and traffic statistics that have a significant impact on the results. The dual adversarial architecture consisting of TCNs, channel attention mechanisms, and self-attention networks can effectively improve anomaly detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Schematic diagram of a method flow in an embodiment of the present invention;

[0028] Figure 2 A schematic diagram of a single-channel sharding operation according to an embodiment of the present invention;

[0029] Figure 3 Schematic diagram of inter-slice and intra-slice upsampling according to an embodiment of the present invention;

[0030] Figure 4 Schematic diagram of the performance comparison between the embodiment of the present invention, USMD, and DC-detector on the WDT dataset. DETAILED DESCRIPTION

[0031] The following is a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts are within the scope of protection of the present invention.

[0032] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting time sequence anomalies in an industrial control system, comprising the following steps:

[0033] Step S1: Construct a time series, which includes process data at T moments and the number of bytes and data packets flowing within the time interval; each process data includes the values ​​of m industrial parameters.

[0034] Specifically, the process data is processed into time series data, that is, the time interval between each record except the first record and the previous record is fixed. Suppose the time series of the entire process data is X = {x1, x2, ..., x t ,…,x T}, x t ∈R m The length of the entire process data time series is T, which means there are T records in total, representing the industrial process data at T moments, and each moment records the value of m industrial parameters, ensuring that x t with x t-1 The time interval is a fixed value.

[0035] For network domain data, within the T time periods mentioned above, a total of S traffic packets pass through the entire ICN, represented by the set P = {p1, p2, ..., p s ,…,p S} means sorting by timestamp. t Corresponding traffic statistics (network data transmission rate), calculate x t-1 to x t The number of bytes flowing through ICN during this period, bytenum t and the number of packets flowing through packetentnum t , and the two are calculated according to the following formulas:

[0036]

[0037] In the above formula, time(p i ) indicates p i Timestamp, Count() represents the count, [x t-1 ,x t ] represents x t-1 with x t The time period between.

[0038] Get bytenum by calculation t and bytenum t Then, combine the two with x t Merge to get the new input vector v t , v t ∈R m+2 Ultimately, the entire process data time series X plus traffic statistics will be converted into a new time series V. The new time series V contains not only the original process data but also traffic statistics, thus combining network domain data with physical domain data.

[0039] ICS is a combination of network and physical systems. Simply relying on traffic or process data alone cannot fully describe and model ICS behavior. This embodiment combines network traffic and process data, using fixed time intervals in process data to calculate the data transmission rate (i.e., traffic statistics) that describes the current ICN status. The process data represents physical domain information, while the network data transmission rate represents network domain information. These two are combined through timestamp alignment to form a new time series. This new time series, incorporating information from both the network and physical domains, can better help deep learning models describe ICS behavior, leading to more effective detection of cyber-physical attacks.

[0040] Step S2: After the time series is sliced ​​by sliding window, a training sample set is obtained. The training sample set is expressed as k t The dimension is expressed as (channel, sequence), T represents the length of the time series, s represents the size of the sliding window, w represents the step size of the sliding window, and channel represents the training sample k t The length is s, sequence represents the training sample k t The number of channels is m+2.

[0041] Specifically, this embodiment uses a sliding window w with a size of s and a step size of 1 to divide the entire time series V, thereby obtaining training samples. V={v1,v2,…,v T}, after division, we get K={k1,k2,…,k t ,…,k T-s+1}, K represents the sample set, and the number of samples is T-s+1. t ∈R s×(m+2) , represents a sample, which is a small time series. The sequence length is s, that is, s moments, each moment has m+2 features. Since the present invention adopts the assumption of channel independence, there are m+2 channels. Channel represents the number of channels, k t The dimension is expressed as (channel, sequence).

[0042] After the dataset is normalized, normal data is fed into the network for training in batches. The input data is in the form of (batch, channel, sequence), where batch represents the size of the training data fed into the model at once. Based on the assumption of channel independence, the batch and channel dimensions are fused to obtain (batch × channel, sequence).

[0043] Step S3: Perform sharding on the sequence dimension, with each shard of size p, to obtain the inter-shard perspective (channel, p, n), swap the row and column dimensions to obtain the intra-shard perspective (channel, n, p), where p×n=sequence.

[0044] Specifically, the sharding operation is performed on the sequence dimension as follows Figure 2 As shown, assuming the size of each shard is p, then k t The dimension becomes (channel, p, n), where p×n=sequence. After the sharding operation is completed, the order of row and column dimensions is swapped and k t It becomes two perspectives: inter-shard perspective (channel, p, n) and intra-shard perspective (channel, n, p).

[0045] Step S4: The inter-slice perspective and the intra-slice perspective are processed sequentially by the temporal convolutional network, the channel attention mechanism, and the self-attention network to obtain the inter-slice representation (channel, n×n) and the intra-slice representation (channel, p×p).

[0046] Specifically, for the two perspectives, the temporal convolutional network and the channel attention mechanism are used to perform convolution operations on the two perspectives along the last dimension to obtain the temporal dependency between the same positions in different slices and the temporal dependency between different positions in the same slice. In this embodiment, the number of convolution kernels of TCN is set to d model , then the two perspectives become (channel,n×d model ) and (channel,p×d model Finally, the results are further processed using a self-attention network to determine the degree of correlation between a slice and itself and other slices, as well as the degree of correlation between a position within a slice and itself and other positions, resulting in inter-slice and intra-slice representations of the time series. The inter-slice representation represents the correlation between the same position in different slices, while the intra-slice representation represents the correlation between different positions in the same slice. These two perspectives represent temporal dependencies in time series. The neural networks processing these two representations share weights, creating a dual adversarial architecture.

[0047] Step S5: After unifying the dimensions of the inter-shard representation and the intra-shard representation, the difference between the two representations is calculated using KL divergence. When the difference is greater than or equal to the threshold, it is determined to be abnormal.

[0048] Specifically, since the inter-shard representation ignores the time dependency between different moments within a shard, the intra-shard representation loses the time dependency between different shards, resulting in dimensional inconsistency between the two. In order to compare the differences between the two representations, the shards perform upsampling on the two representations. Each element in the inter-shard representation is repeated p times along the row and column dimensions, while the intra-shard representation is repeated n times along the row and column dimensions. For example, if the representation is repeated twice, Figure 3 shown.

[0049] After upsampling, the dimensions of both representations become (channel, sequence, sequence). Next, the two representations are summed and averaged per channel to form (1, sequence, sequence), integrating the inter-shard and intra-shard representations across all channels. Finally, the KL divergence is used to calculate the difference between the two representations, yielding sequence difference values. If the difference at a given moment is greater than a specified threshold, the data at that moment is considered anomalous; otherwise, it is considered normal.

[0050] Verification experiments for the embodiments of this invention were conducted on the WDT dataset, collected from a laboratory-scale water supply system. It is one of the most advanced datasets for intrusion detection in industrial control systems. The dataset encompasses three primary attack types: cyber attacks, physical attacks, and cyber-physical attacks. These are further broken down into four specific attack types, as shown in Table 1. The dataset contains 214,580 normal records and 60,048 abnormal (attack) records.

[0051] Table 1: Attack types in the WDT dataset

[0052] ID Attack Type describe 1 MITM Man-in-the-middle attacks 2 DoS Sending a large number of meaningless packets to legitimate devices 3 Scan Scanning industrial control devices on the network 4 Physical default Physically altering the normal operation of the device

[0053] The verification experiment used USMD and DC-detector as baselines for comparison with the proposed solution. Attack samples were defined as positive, and normal samples as negative. The number of positive samples correctly identified was TP, while the number of negative samples incorrectly identified as positive was FP. The number of negative samples correctly identified was TN, while the number of positive samples incorrectly identified as negative was FN. The evaluation metrics included precision, recall, accuracy, and F1 score. The definitions of each metric are shown below.

[0054] Accuracy = (TP + TN) / (TN + FN + TP + FP);

[0055] Precision = (TP) / (TP+FP);

[0056] Recall = (TP) / (FN+TP);

[0057] F1=(2TP) / (2TP+FP+FN);

[0058] The performance of USMD, DC-detector and the method of the present invention on the WDT dataset is shown in the figure. Figure 3 As shown in Table 3. The method proposed in this paper, which combines dual-domain features and is based on a dual adversarial structure, has obvious advantages over the currently advanced time series anomaly detection methods USMD and DC-detector on the WDT dataset, and has a large range of improvements in various performance indicators.

[0059] Table 3: Comparison of detection effects of the present invention, USMD and DC-detector

[0060]

[0061] The technical features of the above embodiments may be combined in any manner. To simplify the description, not all possible combinations of the technical features in the above embodiments are described. Only preferred embodiments of the present invention are presented. While the description is relatively specific and detailed, it should not be construed as limiting the scope of the present invention. As long as there are no conflicts in the combination of these technical features, they should be considered to be within the scope of this specification.

[0062] It should be noted that, for those skilled in the art, various modifications and improvements can be made without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for detecting timing anomalies in an industrial control system, characterized by: The following steps are involved: Step S1: constructing a time series, wherein the time series includes process data at T moments and the number of bytes and data packets flowing within the time interval; each process data includes the values ​​of m industrial parameters; Step S2: After the time series is sliced ​​by a sliding window, a training sample set is obtained. The training sample set is represented as k t The dimension is expressed as (channel, sequence), T represents the length of the time series, s represents the size of the sliding window, w represents the step size of the sliding window, and channel represents the training sample k t The length is s, sequence represents the training sample k t The number of channels is m+2; Step S3: Perform sharding on the sequence dimension, with each shard of size p, to obtain the inter-shard perspective (channel, p, n), swap the row and column dimensions to obtain the intra-shard perspective (channel, n, p), where p × n = sequence; Step S4: The inter-slice perspective and the intra-slice perspective are processed sequentially by the temporal convolutional network, the channel attention mechanism, and the self-attention network to obtain the inter-slice representation (channel, n×n) and the intra-slice representation (channel, p×p); Step S5: After unifying the dimensions of the inter-shard representation and the intra-shard representation, the difference between the two representations is calculated using KL divergence. If the difference is greater than or equal to a threshold, it is determined to be abnormal. Step S4 includes: assuming the number of convolution kernels of the temporal convolutional network TCN is d model After TCN and channel attention mechanism processing and dimension swapping, the intra-slice perspective and inter-slice perspective become (channel, n×d model ) and (channel,p×d model ); finally, the self-attention network is used to process the results to obtain the inter-slice representation (channel, N×N) and intra-slice representation (batch×channel, p×p) of the time series; batch represents the size of the training data input to the model at one time.

2. The method for detecting timing anomalies in an industrial control system according to claim 1, wherein: The method for calculating the number of bytes flowing through a time period in a time series includes: assuming that a total of S traffic packets pass through the entire industrial control network in the entire time series, and using the set P = {p1, p2, ..., p s ,…,p S } means that the number of bytes flowing during the time period is calculated using the following expression: Where, time(p i ) indicates p i Timestamp; [x t-1 ,x t ] represents x t-1 with x t The time period between.

3. The method for detecting timing anomalies in an industrial control system according to claim 1, wherein: The method for calculating the number of data packets flowing through a time period in a time series includes: assuming that a total of S traffic packets pass through the entire industrial control network in the entire time series, and using the set P = {p1, p2, ..., p s ,…,p S } means that the number of packets flowing through the time period is calculated using the following expression: Where, Count() represents count; [x t-1 ,x t ] represents x t-1 with x t The time period between.

4. The method for detecting timing anomalies in an industrial control system according to claim 1, wherein: In step S2, the step size w of the sliding window is set to 1.

5. The method for detecting timing anomalies in an industrial control system according to claim 1, wherein: In step S5, the method for dimensional unification includes: each element in the inter-slice representation is repeatedly upsampled p times along the row and column dimensions respectively, and the intra-slice representation is repeatedly upsampled n times along the row and column dimensions as a whole.

6. An electronic device comprising: A memory, a processor and a computer program, characterized in that the computer program is stored in the memory and is configured to be executed by the processor to implement the method according to any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method according to any one of claims 1 to 5.

Images