Abnormality detection method, device, equipment and system based on machine learning

Abstract

The invention discloses an anomaly detection method, device, equipment and system based on machine learning, and relates to the industrial field, and the method comprises the steps: training a machine learning model according to a historical working signal generated by a channel working preset duration of each input and output component in an industrial control system; after the channel state prediction model for the corresponding type of input and output component is obtained, the current working signal of the corresponding channel is obtained during the working period of each input and output component, the corresponding channel state prediction model is input, and the channel state prediction result of the channel is quickly and accurately obtained according to the normal historical signal of the corresponding channel. Therefore, the condition that at least one abnormal channel in an abnormal working state exists in each input and output assembly is determined, the alarm information of the corresponding abnormal channel can be output in time, workers are prompted to process in time, safe and stable operation of the system is ensured, the production efficiency is improved, and the maintenance and management cost of equipment is reduced.

Description

Technical Field

[0001] The present application relates to the industrial field, and in particular to an anomaly detection method, device, equipment and system based on machine learning. Background Art

[0002] In the industrial field, the input and output (I / O) components of the distributed control system (DCS) are the interface between the system and field devices (such as sensors, solenoid valves, actuators, etc.), enabling the DCS to achieve real-time monitoring and control of industrial processes through these I / O components to ensure production stability and efficiency.

[0003] However, since the working environment of I / O components in DCS is often harsh, it is easy for the system to fail to detect abnormal signals in a timely and accurate manner when I / O component channel failures occur due to factors such as component failure, external load changes or short circuits, thus affecting the safe and normal operation of the system and even causing shutdown accidents. Summary of the invention

[0004] In view of the above problems, this application provides the following solutions:

[0005] The first aspect of the present application provides an anomaly detection method based on machine learning, the method comprising:

[0006] During the operation of each input / output component in the industrial control system, obtaining current operation signals of multiple channels in each input / output component;

[0007] The current working signal is input into the channel state prediction model for the corresponding input-output component, and a channel state prediction result of the channel is obtained according to the normal historical signal of the corresponding channel; wherein the channel state prediction result indicates that the corresponding channel is in a normal working state or an abnormal working state, and the abnormal channel state prediction model is obtained by training a machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input-output component;

[0008] If there is at least one abnormal channel in the abnormal working state among the input and output components, alarm information of the corresponding abnormal channel is output.

[0009] In a possible implementation, the outputting the alarm information of the corresponding abnormal channel includes:

[0010] Generate alarm information of the corresponding abnormal channel according to the current working signal and abnormal category information corresponding to the at least one abnormal channel;

[0011] Reporting the alarm information corresponding to the at least one abnormal channel to a host computer, and the host computer outputting the corresponding alarm information;

[0012] The method further comprises:

[0013] Obtaining a working status verification result of any of the abnormal channels; the working status verification result is obtained and fed back by the host computer in response to a staff member's working status verification operation on the corresponding abnormal channel;

[0014] If the working status check result indicates that the abnormal channel is in a normal working state, the stored current working signal of the abnormal channel is marked as a normal historical signal to optimize the corresponding channel state prediction model.

[0015] In a possible implementation, the method further includes:

[0016] Receiving a channel maintenance result fed back by a maintenance device for any of the abnormal channels;

[0017] If the channel maintenance result indicates that the abnormal channel is in a normal working state, the stored current working signal of the abnormal channel is marked as a normal historical signal to optimize the corresponding channel state prediction model.

[0018] In a possible implementation, the method further includes:

[0019] In response to a fault event for any of the input and output components, a working signal of a corresponding channel where the fault occurs is retroactively marked as an abnormal historical signal;

[0020] The abnormal historical signal marked by at least one of the channels is used to optimize and train the corresponding channel state prediction model to obtain an optimized channel state prediction model for realizing fault detection on the newly acquired current working signal of the corresponding channel.

[0021] In a possible implementation, the method further includes:

[0022] If there is at least one normal channel in the normal working state, marking the current working signal corresponding to the at least one normal channel as a normal historical signal for storage;

[0023] The corresponding channel state prediction model is optimized and trained using the newly stored normal historical signal of the at least one normal channel to obtain an optimized channel state prediction model for realizing abnormality detection on the newly acquired current working signal of the corresponding channel.

[0024] In a possible implementation, the acquiring current working signals of the plurality of channels in the input and output components includes:

[0025] Real-time backchecking of current working signals of multiple channels in each input and output component;

[0026] Storing the current working signal of each of the channels;

[0027] Wherein, each of the input and output components includes an analog input component, an analog output component, a digital input component and a digital output component;

[0028] Each of the input-output components is configured with at least one channel, and the current working signal of each of the channels includes a current current signal and a current voltage signal.

[0029] A second aspect of the present application provides an anomaly detection device based on machine learning, the device comprising:

[0030] A current working signal acquisition module, used for acquiring the current working signals of the multiple channels in each input and output component during the operation of each input and output component in the industrial control system;

[0031] A channel state prediction module, used for inputting the current working signal into a channel state prediction model for the corresponding input-output component, and obtaining a channel state prediction result of the channel according to the normal historical signal of the corresponding channel; wherein the channel state prediction result indicates that the corresponding channel is in the normal working state or the abnormal working state, and the abnormal channel state prediction model is obtained by training a machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input-output component;

[0032] The alarm information output module is used to output the alarm information of the corresponding abnormal channel if there is at least one abnormal channel in the abnormal working state in each of the input and output components.

[0033] The third aspect of the present application provides an anomaly detection device based on machine learning, the device comprising:

[0034] A signal detection circuit is used to connect various input and output components in the industrial control system and detect the current working signals of multiple channels in each of the input and output components;

[0035] an abnormality detection circuit, connected to the signal detection circuit, inputting the acquired current working signal into the channel state prediction model for the corresponding input-output component, obtaining the channel state prediction result of the corresponding channel according to the normal historical signal of the corresponding channel, and outputting the alarm information of the corresponding abnormal channel if there is at least one abnormal channel in an abnormal working state;

[0036] Wherein, the channel state prediction result indicates that the corresponding channel is in the normal working state or the abnormal working state;

[0037] The different-channel state prediction model is obtained by training a machine learning model using historical working signals generated by the preset working duration of the channels of the corresponding input and output components.

[0038] In a possible implementation, the abnormality detection circuit includes: at least one memory, at least one controller, and at least one communication port, wherein:

[0039] The memory is used to store each of the current working signals sent by the signal detection circuit, a plurality of computer instructions, and a channel state prediction model corresponding to each of the input and output components;

[0040] The controller is used to execute the plurality of computer instructions, input the current working signal read from the memory into the channel state prediction model for the corresponding input-output component, obtain the channel state prediction result of the corresponding channel, and if there is at least one abnormal channel in the abnormal working state, send the alarm information of the corresponding abnormal channel to the communication port;

[0041] The communication port is used to connect to a host computer, report the received alarm information to the host computer, and the host computer outputs the alarm information.

[0042] The third aspect of the present application provides an industrial control system, the system comprising: various input and output components, a host computer, and the above-mentioned machine learning-based anomaly detection device, wherein:

[0043] The input and output components are used to connect to corresponding field devices deployed for industrial scenarios to enable the industrial control system to control the field devices;

[0044] The machine learning-based anomaly detection device is used to connect the input and output components and the host computer to implement the following steps:

[0045] Acquire current working signals of the plurality of channels in each of the input and output components, input the current working signals into a channel state prediction model for the corresponding input and output components, obtain channel state prediction results of the corresponding channels, and if there is at least one abnormal channel in the abnormal working state, report alarm information of the corresponding abnormal channel to the host computer;

[0046] Wherein, the channel state prediction result indicates that the corresponding channel is in the normal working state or the abnormal working state;

[0047] The channel state prediction model is obtained by training a machine learning model using historical working signals generated by the preset working duration of the channels of the corresponding input and output components.

[0048] It can be seen that in the machine learning-based anomaly detection method provided in the present application, the historical working signals generated by the preset working time of the channels of each input and output component in the industrial control system are used to train the machine learning model to obtain the channel state prediction model for the corresponding type of input and output components. During the operation of each input and output component, the current working signal of the corresponding channel is obtained, and the corresponding channel state prediction model is input. According to the normal historical signal of the corresponding channel, the channel state prediction result of the channel is quickly and accurately obtained. Based on this, it is determined that there is at least one abnormal channel in each input and output component that is in an abnormal working state, and the alarm information of the corresponding abnormal channel can be output in time to prompt the staff to deal with it in time, so as to ensure the safe and stable operation of the system, improve production efficiency, and reduce the maintenance and management costs of equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0050] Figure 1 A flowchart of the anomaly detection method based on machine learning proposed in Example 1 of the present application;

[0051] Figure 2 This is a flow chart of the anomaly detection method based on machine learning proposed in Example 2 of the present application;

[0052] Figure 3 This is a flow chart of the anomaly detection method based on machine learning proposed in Example 3 of the present application;

[0053] Figure 4 A schematic diagram of the structure of an anomaly detection device based on machine learning proposed in an embodiment of the present application;

[0054] Figure 5 This is a schematic diagram of the structure of an industrial control system proposed in Example 1 of the present application;

[0055] Figure 6 This is a schematic diagram of the structure of an anomaly detection device based on machine learning proposed in Example 1 of the present application;

[0056] Figure 7 This is a schematic diagram of the structure of the anomaly detection device based on machine learning proposed in Example 2 of the present application. DETAILED DESCRIPTION

[0057] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation mode of the present application are only used to explain the specific embodiments of the present application and are not intended to limit the present application. The embodiments of the present application will be described below in conjunction with the drawings. It is known to those of ordinary skill in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0058] Moreover, the terms "first", "second" etc. in the full text description content and the accompanying drawings of the present application are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, and this is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0059] With regard to the description of the background technology part, after analysis, it can be known that in the process of real-time monitoring and control of industrial processes by the Distributed Control System (DCS), when a fault occurs in the input and output (I / O) module channel and the abnormal signal generated gradually accumulates to reach the fault detection threshold, the system can detect the abnormal signal. Before this, the abnormal signal generated has often been transmitted through the fault channel and adopted by the system, affecting the normal operation of the system and even causing the system to stop, which cannot meet the production requirements of high stability and high efficiency.

[0060] In order to improve the above problems, the present application proposes an anomaly detection method based on machine learning, which realizes real-time monitoring and fault diagnosis of the channels (i.e., input and output channels) of each input and output component in an industrial control system (such as the above-mentioned distributed control system), provides comprehensive, accurate and timely detection, ensures the safe and stable operation of the industrial control system, improves factory production efficiency, and reduces equipment maintenance and management costs. The implementation steps of the anomaly detection method based on machine learning proposed in the embodiment of the present application will be described in detail below.

[0061] Reference Figure 1 , is a flow chart of the anomaly detection method based on machine learning proposed in Example 1 of the present application, such as Figure 1 As shown, the anomaly detection method based on machine learning may include but is not limited to the following steps:

[0062] Step S11, during the operation of each input and output component in the industrial control system, obtaining current working signals of multiple channels in each input and output component;

[0063] In the embodiments of the present application, the various input and output components (i.e., IO modules) of the industrial control system are key components for the system to communicate with field equipment in industrial scenarios, and are generally divided into analog input (Analog Input, AI) components, analog output (Analog Output, AO) components, digital input (Digital Input, DI) components, and digital output (Digital Output, DO) components. Each IO module generally includes at least one channel (i.e., input and output channel) for transmitting signals, as well as conditioning circuits for signal conversion, amplification, filtering, isolation, and other processing to ensure signal accuracy and system stability. The present application does not elaborate on the working principles of each IO module.

[0064] During the operation of the above-mentioned input and output components, when the input and output components fail, such as short circuit, open circuit and load characteristic changes of internal devices and external loads, the channel status of the input and output components will be abnormal. For example, damage to the optocoupler or other semiconductor devices may cause abnormal current flow, which may cause the input and output components to overheat, be damaged or burn out; wiring errors of field devices such as sensors or actuators may cause power or signal lines to be accidentally connected together, causing a sharp increase in current and damaging the input and output components or field devices; internal open circuit problems caused by aging, damage or poor connection of internal devices; wiring of sensors or actuators may fall off; changes in the resistance or current demand of external loads; open circuits (not connected or disconnected) at the load end may cause abnormal output signals, such as abnormal voltage or current readings.

[0065] According to the above analysis, in the process of the input and output components from normal operation to failure, the working signal of its channel will change with the change of the working state, such as the change of voltage and current waveform, so as to determine the type and cause of the fault by analyzing the change of voltage and circuit waveform, and take corresponding maintenance measures in time to improve the stability of the operation of the industrial control system. Regarding the change of the working signal of its own channel when the IO module fails, it depends on the situation and this application does not impose any restrictions.

[0066] Therefore, in order to timely identify whether the working state of each input-output component's own channel is abnormal, the current working signal of each input-output component's own channel can be detected in real time. The current working signal represents the current working state of the corresponding channel, so that the abnormal signal of the current channel can be determined in time through comparison based on the known normal historical signal of the corresponding channel in normal working state. Combined with the above analysis, the current working signal of each channel in the present application may include the current current signal and the current voltage signal, etc., which can be obtained by sampling the voltage signal and current signal output by the conditioning circuit of the corresponding input-output component to the external device. The present application does not limit the method of obtaining the current working signal of step S11.

[0067] Step S12, inputting the current working signal into the channel state prediction model for the corresponding input-output component, and obtaining the channel state prediction result of the channel according to the normal historical signal of the corresponding channel; the channel state prediction result indicates that the corresponding channel is in a normal working state or an abnormal working state, and the abnormal channel state prediction model is obtained by training the machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input-output component;

[0068] The present application can call a general model of the channel operating conditions of the same type of input and output components applicable to industrial control systems (the general models of various types of IO modules here can also be the same), that is, a machine learning model. Afterwards, the present application will optimize and train the machine learning model after the corresponding type of input and output components work for a preset period of time for actual industrial scenarios, using the historical working signals of the corresponding channels obtained within the preset period of time, to obtain a channel state prediction model that is more suitable for this type of input and output components in actual industrial scenarios, so as to more accurately identify the working state of the input and output component's own channel in actual industrial scenarios, and promptly discover abnormal input and output channels.

[0069] Among them, during the training process of the above-mentioned channel state prediction model, the staff can view the historical working signals of the corresponding input and output channels within the preset time period through the host computer, and combine their own experience or use diagnostic equipment to perform abnormal analysis on the historical working signals, and mark the historical working signals that are determined to be in normal working condition as normal historical signals, and then use these normal historical signals to optimize the training of the machine learning model to obtain a channel state prediction model that can more accurately identify the normal working signals of the corresponding channels, that is, to improve the efficiency and accuracy of the channel state prediction model for the abnormal working signals of the channels of the corresponding types of input and output components themselves.

[0070] Exemplarily, for the voltage waveform change of the input-output component's own channel, if the input channel is short-circuited, causing the input voltage path to be pulled down, the input voltage may be 0V (volts) or close to 0V; if the output channel is short-circuited, causing the output voltage to be pulled down by the external short-circuit path, the output voltage is reduced; if the load resistance is reduced, causing the output voltage to be reduced, if the output channel load is open-circuited, the output voltage may be the supply voltage or a voltage value close to the supply voltage. Therefore, the present application can mark the normal voltage signal (i.e., the voltage signal without the voltage waveform change of various abnormal conditions in the example) in the historical voltage signal of each channel, and can also mark the abnormal voltage signal as needed to achieve optimized training of the machine learning model to accurately identify whether the current voltage signal of each channel is normal.

[0071] Similarly, for the current waveform changes of the input and output component's own channel, if the input channel is short-circuited, the output current will increase sharply; if the output channel is short-circuited, the input current will increase sharply, which may exceed the maximum current limit, causing overcurrent protection to be activated, affecting the normal operation of the corresponding input and output components; if the input / output channel is short-circuited, the corresponding input / output current may be 0; if the load resistance decreases, the current increases; if the load resistance increases, the current decreases; if the output channel load is open, the output current is 0. Based on this, the present application can mark the normal current signal (i.e., the current signal without the current waveform changes of various abnormal situations in the examples) in the historical current signal (input / output current) of each channel, and can also mark the abnormal current signal as needed to achieve optimized training of the machine learning model to accurately identify whether the current current signal of each channel is normal.

[0072] Based on the above analysis, after the current working signals of each channel sampled in real time are input into the corresponding channel state prediction model, the channel state prediction model can quickly and accurately predict whether the corresponding channel is in a normal working state or an abnormal working state based on the learning results of the normal historical signals of the corresponding channel, or the channel state prediction model compares the normal historical signals of the corresponding channel with the received current working signals.

[0073] Among them, the channel state prediction result for each channel can be the predicted probability that the corresponding channel is in an abnormal working state, that is, the fault probability, which can be determined based on the comparison result. The larger the predicted probability, the greater the probability that the corresponding channel is abnormal. If the predicted probability is greater than the first probability threshold (such as 80%, etc.), it can be considered that the channel belongs to an abnormal channel, that is, the output and input channel is in an abnormal working state. The corresponding abnormal category information can also be obtained, such as by comparing with the abnormal historical signals of various types of abnormal working states (such as the various fault types in the examples above). It can also be output through the host computer and identified by the staff to avoid the occurrence of model misjudgment, etc. The present application does not limit the content of the abnormal category information and the method of obtaining it.

[0074] Step S13: if there is at least one abnormal channel in an abnormal working state in each input and output component, output alarm information of the corresponding abnormal channel.

[0075] Following the above analysis, through real-time backchecking of the status of each input and output channel, each input and output channel in an abnormal working state can be discovered in time, and the abnormal channel can be quickly and accurately located. The corresponding alarm information can then be output in time to prompt the staff to repair the corresponding abnormal channel in time, to avoid the abnormal working signal generated for a long time being transmitted to the system and being adopted, causing the system to stop. Compared with the way staff discover channel abnormalities through periodic maintenance, this application can detect and feedback channel abnormal status in time, ensure that the system takes solution measures as soon as possible, ensure the normal and stable operation of the system, effectively avoid system shutdown problems, and improve production efficiency.

[0076] In a possible implementation, as analyzed above, the alarm information of the corresponding abnormal channel can be reported to the host computer, and the host computer outputs the alarm information, such as displaying the alarm information in the alarm window, or controlling the alarm to output alarm sound and light signals, or controlling the audio player to broadcast the alarm information, etc. The alarm information can also be sent to the staff's terminal according to the pre-recorded communication method of the staff, so as to promptly inform the staff who are not at the host computer of the alarm information and handle the abnormal channel in time.

[0077] Reference Figure 2 , which is a flow chart of the anomaly detection method based on machine learning proposed in Example 1 of the present application. This embodiment can describe the process of obtaining the channel state prediction model, such as Figure 2 As shown, the anomaly detection method based on machine learning may include but is not limited to the following steps:

[0078] Step S21, obtaining a machine learning model;

[0079] Step S22, controlling each input and output component to work for a preset time in an industrial scenario, and storing historical working signals of the corresponding channels;

[0080] Step S23, obtaining a normal historical signal marked as being in a normal working state from each historical working signal:

[0081] Step S24, using normal historical signals, trains the machine learning model of the corresponding type of input and output component to obtain a channel state prediction model for the type of input and output component.

[0082] In combination with the description of the corresponding parts of the above embodiments, the basic model for identifying the channel conditions of the same type of input and output components, that is, the machine learning model, can be combined with the actual industrial scenario, after the corresponding type of input and output components work for a period of time (that is, a preset duration, the value can be determined based on actual conditions, and the present application does not limit the size of the preset duration), and then based on the normal historical signals of the marked channels in normal working conditions, learn and optimize the original machine learning model of the corresponding channel, so that it can more accurately identify the channel conditions of the corresponding type of input and output components working in the current working scenario, thereby improving the adaptability and robustness of the channel state prediction model.

[0083] In some embodiments, the channel state prediction model trained in the present application can also be a classifier based on machine learning. The channel working state includes two types: normal working state and abnormal working state. For the abnormal working state, the sub-type can be further refined according to the fault type to accurately correspond to the abnormal type information. In this case, the historical working signals of each channel are obtained according to but not limited to the method described above, and the normal historical signals and abnormal historical signals are marked, that is, the category labels of each historical working signal are determined, such as normal working state and abnormal working state / various fault types, etc. The classifier can be trained accordingly to obtain a channel state prediction model that can identify the category of the current working signal of the channel. The training process is not described in detail in this application.

[0084] It should be noted that the working signals of each channel obtained in the present application (such as the normal working signals and historical working signals mentioned above) can be the characteristics of the changing relationship between the input and output voltage / current and time, that is, the changing characteristics of the input and output voltage value / current value as time increases, such as the sharp increase or decrease or update to a specific value in the above example, which is determined for different fault types.

[0085] For the channel state prediction model obtained through training above, in the subsequent prediction process, especially when a channel is predicted to be in an abnormal working state, it can be judged through manual experience or actual maintenance equipment to determine whether its channel state prediction result is a false alarm. After marking the corresponding current working signal according to the judgment result, the corresponding channel state prediction model is optimized and trained to improve the performance of the channel state prediction model. Similarly, in the case of a real fault, the corresponding historical working signal, that is, the working signal generated when the fault occurs, can be marked by reverse backtracking, and then the corresponding channel state prediction model can be optimized and trained accordingly to further improve the prediction accuracy of the model for abnormal channels.

[0086] Reference Figure 3 , which is a flow chart of the anomaly detection method based on machine learning proposed in Example 1 of the present application. Based on the channel state prediction model acquisition process described in the above text embodiment, and the prediction process of the channel working conditions of each input and output component currently working using the channel state prediction, the prediction results can be verified and the model can be optimized according to the method proposed in this embodiment but not limited to it, such as Figure 3 Said method may include:

[0087] Step S31, determining, based on the channel state prediction result, that there is at least one abnormal channel in each input and output component that is in an abnormal working state;

[0088] Step S32, generating alarm information of the corresponding abnormal channel according to the current working signal and abnormal category information corresponding to the at least one abnormal channel;

[0089] Combined with the above description of the alarm information, the current working signal sampled by the corresponding input / output component's own channel is analyzed through the channel status prediction model, such as comparing it with the normal historical signal of the corresponding channel that has been stored and marked (such as the various analog / digital input / output channels in the above examples, etc.) in normal working state, to determine whether the current channel is working normally, that is, whether the corresponding current working signal is a normal signal. If not, it means that the input / output status of the corresponding channel is abnormal, and the corresponding alarm information can be directly output to remind the staff to check and repair.

[0090] Of course, as described in step S32, the communication status prediction model predicts the abnormal type information of each abnormal channel. The abnormal category information can indicate the fault type that may occur in the input and output components with the corresponding abnormal channels, including but not limited to the several fault types listed above. The present application can mark the abnormal historical signals corresponding to different fault types in accordance with the marking method of the normal historical signals as described above, so that in the model training process, the machine learning model can be trained using the abnormal historical signals and normal historical signals marked for the same input and output components, so that the trained communication status prediction model can not only determine whether the corresponding channel belongs to a normal channel or an abnormal channel by analyzing the current normal signal, that is, whether the corresponding channel is in a normal working state or an abnormal working state, but also further determine which abnormality it belongs to when it is in an abnormal working state, that is, determine the fault type, such as predicting the predicted probability that the current working signal belongs to abnormal historical signals of different fault types, and determining the fault type with a predicted probability greater than the first probability threshold as the fault type that occurred in the corresponding input and output component, thereby obtaining the corresponding abnormal category information, but is not limited to the implementation method described in this embodiment.

[0091] Among them, since the signal described above can be a signal waveform in which the current value and voltage value of the corresponding channel change with time, the similarity between the marked normal signal waveform (i.e., the normal historical signal) and the currently sampled working signal waveform (i.e., the current working signal) can be calculated, and based on the obtained similarity, the predicted probability that the channel state of the corresponding channel is predicted to be an abnormal working state can be obtained, such as directly determining the similarity as the predicted probability, or converting the currently calculated similarity based on the conversion relationship between the pre-configured similarity and the predicted probability to obtain the predicted probability of the corresponding channel, etc. This application does not limit the method for obtaining the predicted probability. It should be understood that the greater the similarity, the smaller the predicted probability that the corresponding channel is in an abnormal working state.

[0092] In this way, after obtaining the abnormal category information corresponding to each channel in an abnormal working state (this application can record the channel as an abnormal channel to distinguish it from the channel predicted to be in a normal working state, that is, the normal channel), the current working signal currently checked back by the abnormal channel can be combined to generate corresponding alarm information, such as generating a document or audio signal or control instruction in a specified format / template containing the abnormal category information and the current working signal. This application does not limit the content of the alarm information, which can be an information format that matches the output method supported by the alarm device that actually outputs the alarm information (such as the above-mentioned display screen, alarm or audio player, etc.).

[0093] Step S33, reporting the alarm information corresponding to the at least one abnormal channel to the host computer, and the host computer outputs the corresponding alarm information;

[0094] The host computer is a specially designed computer, which may be a personal computer, workstation or professional industrial computer. Its main task is to issue control instructions to the lower computer (such as PLC or single-chip microcomputer) that directly interacts with machines and equipment. In this way, the device that implements the abnormality detection method based on machine learning in this application can send the generated alarm information to the host computer, and the alarm device of the host computer outputs the alarm information to directly prompt the staff to take corresponding maintenance measures in time, and the fault channel that is quickly located is accurately and timely processed, effectively avoiding system shutdown failures.

[0095] It can be seen that the present application monitors the channel status of each input and output component in real time, stores the current working signal sampled in real time, and then directly uses the trained corresponding channel status prediction model for analysis, timely and accurately detects abnormal signals of the channel, and diagnoses the abnormal status of the input and output communication of each input and output component in advance, thereby maximizing the guarantee of safe and stable operation of the industrial control system.

[0096] Step S34, obtaining the working status verification result of any abnormal channel; the working status verification result is obtained and fed back by the host computer in response to the staff's working status verification operation on the corresponding abnormal channel;

[0097] Step S35, if the working status check result indicates that the abnormal channel is in a normal working state, the stored current working signal of the abnormal channel is marked as a normal historical signal to optimize the corresponding channel state prediction model.

[0098] In an embodiment of the present application, in order to avoid the misjudgment of the channel state by the channel state prediction model, especially the misjudgment of the abnormal channel predicted to be in an abnormal working state, when the channel state prediction result indicates at least one abnormal channel, the corresponding alarm information can be informed to the staff according to the method described above, and the staff can analyze the current working signal of the corresponding channel based on personal experience and knowledge to determine whether it is an abnormal working signal generated under an abnormal working state. If so, it means that the model prediction is accurate, and the current working signal of the abnormal channel can be marked as an abnormal historical signal; if not, it means that the model prediction is wrong, the abnormal channel should be a normal channel, and the current working signal of the channel is marked as a normal historical signal.

[0099] Afterwards, the channel state prediction model used for this prediction can be optimized and trained based on the working state type marked by the staff for the current working signal, that is, the marked normal historical signal or abnormal historical signal, such as adjusting the model parameters of the channel state prediction model to reduce the prediction loss and improve the model prediction performance. It should be understood that if the above-mentioned channel state prediction model is obtained by training the machine learning model based on the normal historical signal, the normal historical signal marked this time can be used to learn and optimize the channel state prediction model, and then the optimized channel state prediction model can be used to continue to analyze the current working signal obtained next time.

[0100] In some other embodiments proposed in the present application, an alarm message can be sent to a maintenance device to trigger the maintenance device to perform maintenance on the abnormal channel contained in the alarm message to obtain a corresponding channel maintenance result, or a maintenance instruction for the corresponding abnormal channel can be generated based on the output alarm message, and the maintenance instruction can be sent to the corresponding maintenance device to perform maintenance on the abnormal channel, and the obtained channel maintenance result can be fed back to a device that executes the machine learning-based anomaly detection method proposed in the present application, i.e., an anomaly detection device based on machine learning.

[0101] In this way, after the machine learning-based anomaly detection device receives the channel maintenance result, if the channel maintenance result indicates that the corresponding abnormal channel is in a normal working state, that is, the maintenance equipment inspects the input and output components of the corresponding abnormal channel and determines that it has not failed, it means that the model prediction is wrong, and timely feedback will be given to mark the stored current working signal of the abnormal channel as a normal historical signal to optimize the training of the corresponding channel state prediction model. The model optimization training process can refer to the description of the corresponding part of the above embodiment, and this embodiment will not be repeated here.

[0102] It should be noted that in actual applications, after the alarm information is output, the manual verification and equipment maintenance methods described above can be combined to verify the abnormal channels predicted by the model, reliably avoid misjudgment of abnormalities predicted by the model, and use machine learning technology for self-learning optimization to improve model performance.

[0103] Optionally, in the case where the model determines the working status type of the channel through prediction probability, as analyzed above, when the predicted probability is greater than a first probability threshold (such as 80%) and less than a second probability threshold (such as 95%), further misjudgment processing can be continued according to the method described above. If the predicted probability is greater than or equal to the second probability threshold, the model prediction is considered to be accurate and no further misjudgment processing is required.

[0104] In some other embodiments proposed in the present application, the input and output components can continue to work, and in response to a fault event of any input and output component, that is, a real fault occurs during the operation of the input and output component, a corresponding fault event will be generated and sent to an abnormality detection device based on machine learning. In response to the fault event, the working signal of the corresponding channel where the fault occurs can be traced back and marked as an abnormal historical signal. Thereafter, the abnormal historical signal marked by at least one channel can be used to optimize and train the corresponding channel state prediction model to obtain an optimized channel state prediction model, so as to realize fault detection on the current working signal of the corresponding channel obtained.

[0105] It can be seen that when the industrial control system is applied to any industrial scenario, during the operation of each input and output component in the industrial control system, the current working signal of the corresponding channel is checked in real time, written into the memory for storage, and the pre-trained channel state prediction model is called. According to the pre-marked normal historical signal, the current working signal of the corresponding type of input and output component’s own channel is analyzed, and the working state type of the corresponding channel is quickly and accurately identified. Based on this, the stored corresponding current working signal is marked as a normal historical signal or an abnormal historical signal for storage, so as to continue to learn and optimize the channel state prediction model and improve the system’s adaptability and robustness.

[0106] Therefore, after the channel state prediction model predicts the state of each channel, if there is at least one normal channel in a normal working state, the current working signal corresponding to the at least one normal channel is marked as a normal historical signal for storage, and the corresponding channel state prediction model is optimized and trained using the newly stored normal historical signal of the at least one normal channel to obtain an optimized channel state prediction model, which is used to realize abnormality detection of the newly acquired current working signal of the corresponding channel. The implementation process is not described in detail in this application.

[0107] In summary, in the anomaly detection method based on machine learning proposed in the embodiment of the present application, as the working time increases, the channel state prediction model will be continuously learned and optimized to improve the prediction efficiency and accuracy. When it is determined that any channel is in an abnormal working state, it is promptly identified through the alarm function and uploaded to the host computer through communication, and an alarm is issued to the staff, thereby improving the working safety and reliability of each input and output component, avoiding abnormal signals from being adopted by the central control system, reducing the risk of parking, improving factory production efficiency, and reducing the maintenance and management costs of equipment. And combined with manual or maintenance equipment or fault backtracking and other methods, the prediction results are corrected to further improve the accuracy of anomaly detection.

[0108] The above introduces a machine learning-based anomaly detection method provided in an embodiment of the present application. The following will introduce a device for executing the above machine learning-based anomaly detection method.

[0109] Reference Figure 4 , is a schematic diagram of the structure of an abnormality detection device based on machine learning proposed in an embodiment of the present application, such as Figure 4 As shown, the anomaly detection device based on machine learning may include:

[0110] The current working signal acquisition module 41 is used to acquire the current working signals of the multiple channels in each input and output component during the operation of each input and output component in the industrial control system;

[0111] The channel state prediction module 42 is used to input the current working signal into the channel state prediction model for the corresponding input-output component, and obtain the channel state prediction result of the channel according to the normal historical signal of the corresponding channel; wherein the channel state prediction result indicates that the corresponding channel is in the normal working state or abnormal working state, and the abnormal channel state prediction model is obtained by training the machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input-output component;

[0112] The alarm information output module 43 is used to output the alarm information of the corresponding abnormal channel if there is at least one abnormal channel in the abnormal working state among the input and output components.

[0113] In a possible implementation, the alarm information output module 43 may include:

[0114] An alarm information generating unit, configured to generate alarm information of a corresponding abnormal channel according to a current working signal and abnormal category information corresponding to the at least one abnormal channel;

[0115] An alarm information reporting unit, used for reporting the alarm information corresponding to the at least one abnormal channel to a host computer, and the host computer outputs the corresponding alarm information;

[0116] Based on this, the above-mentioned abnormality detection device based on machine learning may also include:

[0117] A working status verification result acquisition module is used to obtain the working status verification result of any of the abnormal channels; the working status verification result is obtained and fed back by the host computer in response to the staff's working status verification operation on the corresponding abnormal channel;

[0118] The first marking module is used to mark the stored current working signal of the abnormal channel as a normal historical signal if the working status check result indicates that the abnormal channel is in a normal working state, so as to optimize the corresponding channel state prediction model.

[0119] In some further embodiments, the above-mentioned abnormality detection device based on machine learning may further include:

[0120] A channel maintenance result receiving module is used to receive the channel maintenance result fed back by the maintenance equipment for any of the abnormal channels;

[0121] The second marking module is used to mark the stored current working signal of the abnormal channel as a normal historical signal if the channel maintenance result indicates that the abnormal channel is in a normal working state, so as to optimize the corresponding channel state prediction model.

[0122] In some further embodiments, the above-mentioned abnormality detection device based on machine learning may further include:

[0123] A second marking module is used to respond to a fault event of any of the input and output components and to retroactively mark the working signal of the corresponding channel where the fault occurs as an abnormal historical signal;

[0124] The first optimization module is used to optimize and train the corresponding channel state prediction model using the abnormal historical signal marked by at least one of the channels to obtain an optimized channel state prediction model for realizing fault detection on the newly acquired current working signal of the corresponding channel.

[0125] In some further embodiments, the above-mentioned abnormality detection device based on machine learning may further include:

[0126] A third marking module is used for marking the current working signal corresponding to the at least one normal channel as a normal historical signal for storage if there is at least one normal channel in the normal working state;

[0127] The second optimization module is used to use the newly stored normal historical signal of the at least one normal channel to optimize the training of the corresponding channel state prediction model to obtain an optimized channel state prediction model, which is used to realize abnormality detection of the newly acquired current working signal of the corresponding channel.

[0128] Based on the above analysis, the current working signal acquisition module 41 may include:

[0129] A checkback module, used for checking the current working signals of the multiple channels in each input and output component in real time;

[0130] A storage module, used for storing the current working signal of each of the channels;

[0131] Wherein, each of the input and output components includes an analog input component, an analog output component, a digital input component and a digital output component;

[0132] Each of the input-output components is configured with at least one channel, and the current working signal of each of the channels includes a current current signal and a current voltage signal.

[0133] Also provided in an embodiment of the present application is a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any one of the machine learning-based anomaly detection methods provided in the embodiments of the present application.

[0134] Wherein, when the computer program instructions are loaded and executed on a computer (electronic device), all or part of the above-mentioned process or function according to the embodiment of the present application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center.

[0135] Reference Figure 5 , is a schematic diagram of the structure of an industrial control system proposed in Example 1 of the present application, such as Figure 5 As shown, the system may include: various input and output components 500, a host computer 600 and an abnormality detection device 700 based on machine learning, wherein:

[0136] The input-output component (i.e., the above-mentioned IO module) 500 is used to connect corresponding field devices (such as sensors, solenoid valves, etc.) deployed for industrial scenarios to realize the control of field devices by the industrial control system. In practical applications, each input-output component usually has at least one channel and a conditioning circuit. This application does not elaborate on the structure and working principle of each input-output component.

[0137] The machine learning-based anomaly detection device 700 is used to connect the various input and output components 500 and the host computer 600 to implement the machine learning-based anomaly detection method proposed in the embodiment of the present application. The implementation process can refer to the description of the corresponding part of the method embodiment above, which will not be repeated in this embodiment.

[0138] Reference Figure 6 , is a structural diagram of an abnormality detection device based on machine learning proposed in Example 1 of the present application. The device may be a lower computer of an industrial control system, which realizes communication connection with a host computer and field equipment respectively, such as Figure 6The machine learning-based anomaly detection device 700 may include: a signal detection circuit 710 and an anomaly detection circuit 720, wherein:

[0139] The signal detection circuit 710 is used to connect various input and output components in the industrial control system and detect the current working signals of multiple channels in each input and output component;

[0140] The abnormality detection circuit 720 is used to connect to the signal detection circuit 710, input the acquired current working signal into the channel state prediction model for the corresponding input and output components, and obtain the channel state prediction result of the channel based on the normal historical signal of the corresponding channel under the normal working state. If there is at least one abnormal channel in the abnormal working state, the alarm information of the corresponding abnormal channel is output.

[0141] Among them, the channel state prediction result indicates that the corresponding channel is in a normal working state or an abnormal working state; the abnormal channel state prediction model is obtained by training the machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input and output components, and the training process can refer to the description of the corresponding part of the method embodiment above.

[0142] In the embodiment of the present application, the abnormality detection circuit 710 can maintain the abnormal channel of the input and output components of the predicted abnormality to solve the abnormality problem. Upon receiving a fault event generated by any input and output component, the corresponding abnormal historical signal can be traced back and marked according to the method described above to learn and optimize the corresponding channel state prediction model. The implementation process can refer to the description of the corresponding part of the above embodiment, and this embodiment will not be repeated here.

[0143] In the actual application of the present application, the signal detection circuit 710 can be an ADC (Analog to Digital Converter) sampling circuit to convert an analog signal that is continuous in time and amplitude within the sampling time into a digital signal that is discrete in time and amplitude for subsequent processing. The present application does not limit the structure of the ADC sampling circuit and its working principle.

[0144] In some embodiments, Figure 7 As shown, the above-mentioned abnormality detection circuit 720 includes: at least one memory 721, at least one controller 722 and at least one communication port 723, wherein:

[0145] The memory 721 can be used to store various current working signals sent by the signal detection circuit 710, multiple computer instructions, and channel state prediction models corresponding to various input and output components.

[0146] In an embodiment of the present application, the memory 721 may include a volatile memory (volatile memory), such as a random access memory (Random Access Memory, RAM), and may also include a non-volatile memory (non-volatile memory), such as a read-only memory (read-only memory, ROM), a flash memory, a mechanical hard disk (Hard Disk Drive, HDD) or a solid state drive (Solid State Drive, SSD) and other one or more forms of storage media.

[0147] The controller 722 can be used to execute multiple computer instructions, input the current working signal read from the memory 721 into the channel state prediction model for the corresponding input and output components, obtain the channel state prediction result of the corresponding channel, and if there is at least one abnormal channel in an abnormal working state, send the alarm information of the corresponding abnormal channel to the communication port 723. In the embodiment of the present application, the controller 722 can be a single-chip microcomputer or other processors, such as a microprocessor (MP), an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). One or more.

[0148] The communication port 723 can be used to connect to a host computer, report the received alarm information to the host computer 600, and the host computer 600 outputs the alarm information.

[0149] In the embodiment of the present application, the communication port 723 may include but is not limited to: supporting one or more communication elements corresponding to wireless communication methods such as wifi, 5G / 6G mobile communication, Bluetooth and / or near-field channel, GSM (Global System of Mobile communication) communication, GPRS (General Packet Radio Service) communication, etc. According to actual needs, the communication port 723 may also include interfaces such as general-purpose input / output (GPIO) interface, USB interface, universal asynchronous receiver / transmitter (UART) interface, etc., supporting wired communication methods to realize data transmission between the internal components of the device or the control circuit content. The present application does not limit the type and number of the communication port 723.

[0150] It should be understood that Figure 7 The structure of the anomaly detection device based on machine learning shown in the figure does not constitute a limitation on the anomaly detection device based on machine learning in the embodiment of the present application. In practical applications, the anomaly detection device based on machine learning may include: Figure 7 More or fewer components as shown, or combinations of certain components, such as maintenance equipment, etc., are not listed one by one in this application.

[0151] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any one of the machine learning-based anomaly detection methods provided in the embodiment of the present application.

[0152] The computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a training device or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0153] In addition, it should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course can also be implemented by dedicated hardware including dedicated integrated circuits, dedicated CPUs, dedicated memories, dedicated components, etc. That is to say, in the above embodiments, all or part of the implementation can be achieved by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product.

Claims

1. A machine learning-based anomaly detection method, characterized in that: The method comprises: During the operation of each input / output component in the industrial control system, obtaining current operation signals of multiple channels in each input / output component; The current working signal is input into the channel state prediction model for the corresponding input-output component, and a channel state prediction result of the channel is obtained according to the normal historical signal of the corresponding channel; wherein the channel state prediction result indicates that the corresponding channel is in a normal working state or an abnormal working state, and the abnormal channel state prediction model is obtained by training a machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input-output component; If there is at least one abnormal channel in the abnormal working state among the input and output components, alarm information of the corresponding abnormal channel is output.

2. The method according to claim 1, characterized in that The output of the alarm information of the corresponding abnormal channel includes: Generate alarm information of the corresponding abnormal channel according to the current working signal and abnormal category information corresponding to the at least one abnormal channel; Reporting the alarm information corresponding to the at least one abnormal channel to a host computer, and the host computer outputting the corresponding alarm information; The method further comprises: Obtaining a working status verification result of any of the abnormal channels; the working status verification result is obtained and fed back by the host computer in response to a staff member's working status verification operation on the corresponding abnormal channel; If the working status check result indicates that the abnormal channel is in a normal working state, the stored current working signal of the abnormal channel is marked as a normal historical signal to optimize the corresponding channel state prediction model.

3. The method according to claim 1, characterized in that The method further comprises: Receiving a channel maintenance result fed back by a maintenance device for any of the abnormal channels; If the channel maintenance result indicates that the abnormal channel is in a normal working state, the stored current working signal of the abnormal channel is marked as a normal historical signal to optimize the corresponding channel state prediction model.

4. The method according to claim 1, characterized in that: The method further comprises: In response to a fault event for any of the input and output components, a working signal of a corresponding channel where the fault occurs is retroactively marked as an abnormal historical signal; The abnormal historical signal marked by at least one of the channels is used to optimize and train the corresponding channel state prediction model to obtain an optimized channel state prediction model for realizing fault detection on the newly acquired current working signal of the corresponding channel.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If there is at least one normal channel in the normal working state, marking the current working signal corresponding to the at least one normal channel as a normal historical signal for storage; The corresponding channel state prediction model is optimized and trained using the newly stored normal historical signal of the at least one normal channel to obtain an optimized channel state prediction model for realizing abnormality detection on the newly acquired current working signal of the corresponding channel.

6. The method according to any one of claims 1 to 4, characterized in that: The obtaining of the current working signals of the plurality of channels in each of the input and output components comprises: Real-time backchecking of current working signals of multiple channels in each input and output component; Storing the current working signal of each of the channels; Wherein, each of the input and output components includes an analog input component, an analog output component, a digital input component and a digital output component; Each of the input-output components is configured with at least one channel, and the current working signal of each of the channels includes a current current signal and a current voltage signal.

7. An anomaly detection device based on machine learning, characterized in that: The device comprises: A current working signal acquisition module, used for acquiring the current working signals of the multiple channels in each input and output component during the operation of each input and output component in the industrial control system; A channel state prediction module, used for inputting the current working signal into a channel state prediction model for the corresponding input-output component, and obtaining a channel state prediction result of the channel according to the normal historical signal of the corresponding channel; wherein the channel state prediction result indicates that the corresponding channel is in the normal working state or abnormal working state, and the abnormal channel state prediction model is obtained by training a machine learning model using the historical working signal generated by the preset working time of the channel of the corresponding input-output component; The alarm information output module is used to output the alarm information of the corresponding abnormal channel if there is at least one abnormal channel in the abnormal working state in each of the input and output components.

8. An anomaly detection device based on machine learning, characterized in that: The device comprises: A signal detection circuit is used to connect various input and output components in the industrial control system and detect the current working signals of multiple channels in each of the input and output components; an abnormality detection circuit, connected to the signal detection circuit, inputting the acquired current working signal into the channel state prediction model for the corresponding input-output component, obtaining the channel state prediction result of the corresponding channel according to the normal historical signal of the corresponding channel, and outputting the alarm information of the corresponding abnormal channel if there is at least one abnormal channel in an abnormal working state; Wherein, the channel state prediction result indicates that the corresponding channel is in the normal working state or the abnormal working state; The different-channel state prediction model is obtained by training a machine learning model using historical working signals generated by the preset working duration of the channels of the corresponding input and output components.

9. The device according to claim 8, characterized in that The abnormality detection circuit comprises: at least one memory, at least one controller and at least one communication port, wherein: The memory is used to store each of the current working signals sent by the signal detection circuit, a plurality of computer instructions, and a channel state prediction model corresponding to each of the input and output components; The controller is used to execute the plurality of computer instructions, input the current working signal read from the memory into the channel state prediction model for the corresponding input-output component, obtain the channel state prediction result of the corresponding channel, and if there is at least one abnormal channel in the abnormal working state, send the alarm information of the corresponding abnormal channel to the communication port; The communication port is used to connect to a host computer, report the received alarm information to the host computer, and the host computer outputs the alarm information.

10. An industrial control system, characterized in that: The system comprises: various input and output components, a host computer, and the machine learning-based anomaly detection device as claimed in claim 8 or 9, wherein: The input and output components are used to connect to corresponding field devices deployed for industrial scenarios to enable the industrial control system to control the field devices; The machine learning-based anomaly detection device is used to connect the input and output components and the host computer to implement the following steps: Acquire current working signals of the plurality of channels in each of the input and output components, input the current working signals into a channel state prediction model for the corresponding input and output components, obtain channel state prediction results of the corresponding channels, and if there is at least one abnormal channel in the abnormal working state, report alarm information of the corresponding abnormal channel to the host computer; Wherein, the channel state prediction result indicates that the corresponding channel is in the normal working state or the abnormal working state; The channel state prediction model is obtained by training a machine learning model using historical working signals generated by the preset working duration of the channels of the corresponding input and output components.

Images