Industrial control intrusion detection method based on graph attention network and variational auto-encoder

Abstract

The invention relates to the technical field of industrial control system intrusion detection, in particular to an industrial control intrusion detection method based on a graph attention network and a variational auto-encoder. Through the method provided by the invention, the problem that intrusion data similar to normal data is difficult to identify due to small reconstruction error is solved, and the scheme adopts the memory module to expand the reconstruction error and improve the distinguishing capability. Then, strategies based on incremental updating and gating updating mechanisms are introduced and applied to an offline training stage and an online detection stage respectively, the adaptive capacity of an algorithm to a system operation mode is enhanced, and the storage space of a memory module is reduced by combining a feature difference loss function; in addition, the reconstruction error is weighted through the feature difference, the abnormal score calculation is optimized, and the intrusion detection accuracy is further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control system intrusion detection, and in particular to an industrial control intrusion detection method based on a graph attention network and a variational autoencoder. Background Art

[0002] Intrusion detection system is one of the effective means of protection against industrial control systems when they are attacked by network. Intrusion detection system can monitor system data in real time and identify security threats in the system through effective detection algorithms. As more and more researchers participate in the field of intrusion detection of industrial control systems, intrusion detection technology has gradually diversified. Machine learning and deep learning have become research hotspots in this field in recent years. Machine learning is often used to establish a behavioral model of normal operation in the system. When any behavior that deviates from the normal model is detected, it may be marked as abnormal, thereby judging the behavior of intrusion. Machine learning algorithms can also be used to identify and extract security-related features in network traffic or system logs to help more accurately identify malicious activities. In addition, as the network environment and attack strategies change, machine learning models can adapt to these changes through continuous learning, thereby maintaining their detection efficiency. However, as the network environment becomes increasingly complex, the data in industrial control systems also presents the characteristics of high dimensionality and high noise, which poses a challenge to the accuracy of intrusion detection. Deep learning has superiority in processing complex high-dimensional data, so it is widely used in the field of industrial control intrusion detection and shows excellent detection performance.

[0003] Although deep learning methods have shown significant performance advantages in intrusion detection, they still have certain limitations in specific industrial control system application scenarios. This is mainly due to the scale of industrial control systems and the diversity of application scenarios. Systems of different sizes show obvious differences in their unique application needs. For large industrial control systems, although there are sufficient computing resources to deploy large deep learning models, due to the large number of system devices, their industrial control data has complex and high-dimensional spatiotemporal characteristics. The existing deep learning models still have the problem of insufficient detection accuracy when capturing this feature. At the same time, the binary anomaly indications output by most models lack sufficient detailed information and interpretability, making it difficult to identify and locate anomalies, increasing the time cost of fault diagnosis. In addition, there is a lot of noise in the environment of large industrial control systems, resulting in a high false alarm rate of the model. For small and medium-sized industrial control systems, although deep learning models can guarantee high accuracy, due to the complexity of their models and the large amount of computing resources required for long-term training, these high-precision intrusion detection models are difficult to deploy in actual working environments. At the same time, due to the diversity of production modes, the frequency of changes in the operation mode of small and medium-sized industrial control systems is high. However, when the operating mode of the industrial control system changes, the previously trained model can no longer be used effectively. Summary of the invention

[0004] The purpose of the present invention is to provide an industrial control intrusion detection method based on a graph attention network and a variational autoencoder to address the above-mentioned problems in the prior art.

[0005] The present invention is achieved through the following technical solutions:

[0006] An industrial control intrusion detection method based on graph attention network and variational autoencoder, comprising:

[0007] Acquire data from the industrial control system and preprocess the data, wherein the preprocessing includes data cleaning and normalizing the cleaned data; and divide the data using a sliding window;

[0008] Establishing a ME-VAE model, the ME-VAE model includes an encoder, a memory module, and a decoder, enhancing latent features through the memory module, amplifying the reconstruction error of the intrusion sample, and incrementally updating the memory in the ME-VAE model;

[0009] Determine whether the current data is used to update the memory. If so, update several memory items. If not, do nothing.

[0010] Obtain the difference between the latent features and the features enhanced by the memory module, weight the reconstruction error of the data, make an intrusion judgment based on the weighted reconstruction error, and output the judgment result.

[0011] Preferably, establishing the ME-VAE model includes:

[0012] Given a time input sequence, it is encoded and sampled by an encoder consisting of a GRU module and a fully connected layer, and the potential representation of the intermediate layer is output;

[0013] Using the latent representation as the query vector, the similarity with each memory item is calculated in the memory module, and the query vector and the memory item are combined into a new latent feature vector according to the similarity;

[0014] The latent feature vector is passed to the decoder for reconstruction, restoring the temporal input sequence.

[0015] Preferably, said enhancing the potential features comprises:

[0016] Calculate the distance between the query vector and each unit in the memory module to obtain a weight vector;

[0017] w i =Softmax(d cos (z,m i ))

[0018]

[0019] And the weight vector is modified by vector sparsification;

[0020]

[0021] In the formula, w i is the first weight vector, d cos (z,m i ) is the cosine similarity between the latent feature vector and the memory item, z is the latent feature vector, m i is a unit in the memory module, is the corrected weight vector, λ is the sparse threshold, ε is a positive scalar, and max(.,0) is the ReLU activation function.

[0022] Preferably, the incremental updating of the memory includes:

[0023]

[0024] In the formula, v′ i is the second weight vector, v i is the matching probability, is the new potential feature vector, v j is the j-th probability among all possible values ​​after softmax calculation, is the cosine similarity between the new potential feature vector and the memory item, and i, j, and L are natural numbers.

[0025] Preferably, updating the memory item includes:

[0026] Calculate the distance score between the current input data and the memory item, and update the memory module when the distance score is less than an update threshold;

[0027] The calculation of the distance score between the current input data and the memory item includes:

[0028]

[0029] In the formula, D(z,m i ) is the distance between the latent feature vector and the memory item, γ is the exponential weighting factor, k and i are natural numbers, and Score(z) is the distance score;

[0030] Get the potential feature vector and the k items whose first weight vector is not 0 after the memory module query, and arrange them in order from small to large.

[0031] Preferably, it also includes establishing a loss function to balance the training effect of the ME-VAE model through the loss function, and the loss function includes:

[0032]

[0033] In the formula, is the mean square error, m is the number of data, y i is the predicted value, y′ i is the actual value, is the divergence loss, is the loss function reconstructed by VAE, is the difference loss function, is the Euclidean distance, is the total number of all features, μ is the mean, σ is the variance, m j is the jth potential feature representation vector, η is the trade-off loss function Hyperparameters of .

[0034] Preferably, the method further includes adjusting the reconstruction error by using the difference between the input and output characteristics of the memory module:

[0035]

[0036] Where S(t) is the adjusted reconstruction error, ε ′ is the correction parameter, x t is the input data feature, is the reconstructed data feature, z t is the initial feature, Reassemble the generated features for the memory module.

[0037] Preferably, it also includes:

[0038] A prediction model is established based on graph attention network and gated recurrent unit. The prediction model predicts the data of the industrial control system and filters and removes noise from the predicted data.

[0039] Preferably, the prediction model includes:

[0040]

[0041] In the formula, is the feature of node i after aggregating neighbor nodes, α ij is the attention coefficient of node j to node i in the GAT network, W is the learnable weight matrix, Ψ(i) is the neighbor of node i obtained from the adjacency matrix, is the sliding window input for node i, is the sliding window input for node j, is the concatenation of the sensor embedding and its corresponding sliding window input, v i ′ is the feature embedding vector of node i, e ij The attention coefficient after activation using the nonlinear activation function LeakyReLU, eik is the unnormalized value of the attention coefficient between node i and its neighbor node k, a is a learnable parameter vector, z ′(t) is the feature vector of n sensors containing spatiotemporal features in the sliding window, x (t) is the industrial control system data, z (t) is the output of the GAT network.

[0042] Preferably, filtering and denoising the predicted data includes:

[0043] Obtain an error sequence, reconstruct the error sequence in a phase space within a given embedding dimension elimination filter window of the error sequence, and divide the error sequence into a number of subsequences;

[0044] Calculate the similarity between any two reconstructed vectors. The distance between two reconstructed vectors is defined as the maximum absolute value of the difference between the corresponding elements of the two sequences.

[0045] Calculate the logarithmic probability of all sequences and find the average value, and use the average value to calculate the approximate entropy of the error sequence in the filter window;

[0046] Compare the approximate entropy with the entropy threshold, judge the abnormal data and output it.

[0047] The technical solution of the present invention has at least the following advantages and beneficial effects:

[0048] 1. The existing lightweight intrusion detection algorithms cannot take into account both detection accuracy and efficiency and are difficult to adapt to the changing operation modes of small and medium-sized industrial control systems. The method provided by the present invention solves the problem that intrusion data similar to normal data is difficult to identify due to small reconstruction errors. This solution uses a memory module to expand the reconstruction error and improve the ability to distinguish. Then, strategies based on incremental update and gated update mechanisms are introduced, which are applied to the offline training and online detection stages respectively, to enhance the algorithm's ability to adapt to the system's operating mode, and to reduce the storage space of the memory module by combining the feature difference loss function. In addition, the reconstruction error is weighted by feature differences, the calculation of anomaly scores is optimized, and the accuracy of intrusion detection is further improved.

[0049] 2. In view of the problems that existing intrusion detection algorithms are insufficient in device correlation extraction and model anomaly interpretability and have a high false alarm rate, the method provided by the present invention extracts the temporal and spatial characteristics of sensor data by fusing the graph attention network (GAT) and the gated recurrent unit (GRU), thereby making up for the shortcomings of traditional intrusion detection algorithms in capturing dependencies between sensors. In order to solve the problem that the original GAT requires a priori graph structure and the graph update process lacks continuity, a graph structure update mechanism based on similarity constraints is proposed. At the same time, in order to solve the problem of high false alarm rate caused by environmental noise, a two-stage composite discrimination method combining threshold and entropy is proposed. This method first uses the threshold for preliminary discrimination, and then uses approximate entropy to filter out anomalies caused by noise, thereby reducing the false alarm rate. In addition, in order to allow technicians to quickly locate the cause of system anomalies, an anomaly interpretation method based on aggregated neighbor anomaly scores is proposed. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 The overall architecture of the ME-VAE model of the present invention;

[0052] Figure 2 is the specific structure of the ME-VAE model of the present invention;

[0053] Figure 3 The characteristic reorganization enhancement process of the present invention;

[0054] Figure 4 The latent representation sparsification process of the present invention;

[0055] Figure 5 This is a comparison diagram of the effects of the present invention and other models;

[0056] Figure 6 It is the overall framework of SC-GRN of the present invention;

[0057] Figure 7 It is the continuous graph structure update process of the present invention;

[0058] Figure 8 The SC-GRN data prediction model of the present invention;

[0059] Fig. 9 It is a schematic diagram for explaining the system abnormality of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0061] Please refer to Figure 1 and Figure 2 , an industrial control intrusion detection method based on graph attention network and variational autoencoder, comprising:

[0062] S101: Acquire data from an industrial control system and preprocess the data, wherein the preprocessing includes data cleaning, normalizing the cleaned data, and dividing the data using a sliding window;

[0063] After obtaining the original sensor data from the industrial control system, the data needs to be preprocessed to ensure the quality and applicability of the data and provide a solid foundation for subsequent analysis. It is specifically divided into three steps: data cleaning, data normalization, and sliding window sampling.

[0064] S102: Establishing a ME-VAE model, wherein the ME-VAE model includes an encoder, a memory module, and a decoder, enhancing potential features through the memory module, amplifying the reconstruction error of the intrusion sample, and incrementally updating the memory in the ME-VAE model;

[0065] This step is the offline training stage of the model. In this stage, the latent features are enhanced through the memory module to make them closer to normal features, thereby amplifying the reconstruction error of the intrusion sample. Then, the memory is incrementally updated during model training. When the model is trained offline, since most of the data is normal, the model pays more attention to the impact of noise data, so the memory items are directly updated using the incremental update method.

[0066] S103: determining whether the current data is used to update the memory, if so, updating the plurality of memory items, if not, not performing any operation;

[0067] This step is the online testing phase of the model. At this stage, the system's operating mode may change. At this time, the model pays more attention to changes in data distribution, uses the gating mechanism to determine whether to use the current data to update the memory, and updates some memory items. This update method allows the model to have the ability to adapt when the data mode changes, rather than retraining the model.

[0068] S104: Obtain the difference between the latent features and the features enhanced by the memory module, weight the reconstruction error of the data, make an intrusion determination based on the weighted reconstruction error, and output the determination result.

[0069] The present invention first uses GRU and fully connected layers to form a VAE network, which accelerates the convergence speed of the model while extracting the time series features of the data. Secondly, in view of the problem of noise in the normal data involved in the training, a method of using incremental memory updates is proposed; in view of the problem that the operating mode of small and medium-sized systems may change, it is proposed to use a gating mechanism to selectively update the memory to improve the model's adaptability to changing data. Subsequently, the feature difference loss is used to increase the difference of features in the memory module and reduce the consumption of the memory module. Finally, it is proposed to combine the reconstruction error and the feature error to calculate the anomaly score, further amplify the difference between normal data and abnormal data, and improve the accuracy of intrusion detection.

[0070] In an exemplary embodiment of the present invention, data cleaning is one of the key steps of data preprocessing, which involves identifying and processing abnormal, missing or inconsistent parts in the data. Since time series data has time dependence, missing values ​​are generally not directly deleted, but filled with the previous or next data of the missing data point.

[0071] Data normalization. In industrial multivariate time series analysis, the numerical differences between different sensors are large. Data with larger values ​​will increase the scale interval, making the model insensitive to changes in smaller values. Therefore, the data needs to be scaled to make the data have the same scale. This section uses the maximum and minimum normalization method to alleviate the adverse effects of large numerical differences between variables in time series data and normalize each dimension of the time series data.

[0072] Use sliding windows to partition the data. Since sensor data usually contains a large number of time points, it is impossible to input the complete time series into the intrusion detection model at the same time. In order to capture the temporal dependency between data, a sliding window with a width of w and a step size of l is used to obtain continuous data segments as model input.

[0073] is the time step of the sliding window moving on the time axis each time. In order to capture the dependency of time series data, increase the number of training samples, and thus reduce information loss, it is usually practiced to allow adjacent windows to overlap to a certain extent. In the test phase, in order to reduce the computational cost and better simulate the actual situation, the training set step length l of this solution is set to 1, and the test set l is set to be the same as the length of the sliding window w.

[0074] In intrusion detection of industrial control systems, the system runs in normal mode most of the time, and real intrusion events are relatively rare. Traditional intrusion detection models identify abnormal behaviors by learning the characteristics of normal operating data. However, when the intrusion data is only slightly different from the normal data, these intrusion activities are difficult to detect. The abnormal data points of these three types of sensors during the intrusion period are concentrated around the median line, and the gap between them and the normal data is small. The model often has difficulty distinguishing such intrusion samples.

[0075] In order to solve this problem, the present invention stores the data features during normal operation through a memory module, and uses these features to optimize the latent space of VAE, so that the latent representation is closer to the characteristics of normal behavior, thereby amplifying the reconstruction error of the intrusion sample.

[0076] VAE, as the basic network structure of the reconstruction model, mainly uses the encoder to compress sample data into the latent space, and reconstructs the representation in the latent space into the original data through the decoder. Moreover, VAE has stronger generalization ability than traditional autoencoders and can better reconstruct and generate data when faced with unseen data.

[0077] The ME module is a key part of the Memory-Enhanced Lightweight Variational Autoencoder (ME-VAE), which records the latent features of normal data. This module reconstructs the data by comparing the latent variables of the input data with the memory items, then selecting similar features for combination, and finally using this combination as the input of the decoder. This process helps to reduce the impact of abnormal data, because the memory items that are continuously updated during training will make the reconstruction of intrusion samples more similar to normal samples, resulting in higher reconstruction errors. In this way, ME-VAE improves the detection sensitivity of minor anomalies while maintaining the resource efficiency of the system.

[0078] In an exemplary embodiment of the present invention, establishing a ME-VAE model includes:

[0079] S201: Given a time input sequence, it is encoded and sampled by an encoder consisting of a GRU module and a fully connected layer, and the potential representation of the intermediate layer is output;

[0080] S202: using the latent representation as a query vector, calculating the similarity with each memory item in the memory module, and combining the query vector and the memory item into a new latent feature vector according to the similarity;

[0081] S203: The latent feature vector is passed to the decoder for reconstruction to restore the time input sequence.

[0082] In this embodiment, in order to realize a lightweight intrusion detection model, the encoder and decoder of VAE have only one layer. The encoder consists of a GRU module and two fully connected layers. Since the industrial control sensor data has the characteristics of time series, GRU can learn the hidden time series dependencies in the time window samples.

[0083] Compared with the existing technology TSMAE that uses LSTM as the encoder network, GRU is more computationally efficient and has fewer parameters. This is because GRU only updates the state through the update gate and reset gate, while LSTM has three gates, so GRU further meets the requirement of lightweight model. After GRU collects the time series features in the data, a fully connected layer is usually added to convert the output of the GRU layer into the mean μ and variance σ of the latent space. These parameters will be used for sampling the latent variables. Another fully connected layer samples the intermediate layer in a re-parameterized manner. Specifically.

[0084] z=μ+σ⊙ζ

[0085] Where z is the potential vector generated by the last encoder, ζ is a random variable, and the fully connected layer uses RELU as the activation function.

[0086]

[0087] Where x is the input parameter, and the decoder of VAE consists of a GRU layer and a fully connected layer. The GRU layer is similar to the encoder and is used to convert the latent variables into a temporal output sequence. The final fully connected layer is used to map the latent variables to an output sequence with the same dimension as the input data.

[0088] like Figure 3 As shown, in an exemplary embodiment of the present invention, enhancing potential features includes:

[0089] The latent representation is reorganized through the attention mechanism, so that the reorganized latent representation can be closer to the normal features, thereby amplifying the reconstruction error of abnormal samples and effectively improving the detection effect of the model.

[0090] Calculate the distance between the query vector and each unit in the memory module to obtain a weight vector;

[0091] w i =Softmax(d cos (z,m i ))

[0092]

[0093] The similarity is then normalized by the Softmax function. Since memory cells with high similarity represent more likely normal patterns of samples, the new latent representation is weighted and synthesized by similarity.

[0094]

[0095] like Figure 4 As shown in the figure, the above process uses a limited number of memory items in the memory module to resynthesize potential features, which makes the intrusion sample produce a large reconstruction error, making it easy to detect. However, some abnormal features may also be reconstructed through complex combinations of many memory items. In order to avoid this problem, vector sparsification is used for correction;

[0096]

[0097] In the formula, w i is the first weight vector, d cos (z,m i ) is the cosine similarity between the latent feature vector and the memory item, z is the latent feature vector, m i is a unit in the memory module, is the modified weight vector, λ is the sparse threshold, ε is a positive scalar, max(.,0) is the ReLU activation function, M is the dimension of the memory module, is the new potential feature vector.

[0098] At the same time, considering that as a weight factor, its sum must be 1, so the weight matrix is ​​normalized. This is because the physical meaning of the weight matrix is ​​to combine different memory items into a new potential feature. Each item in the weight vector represents a certain proportion, and the normalization operation is finally passed. The new potential representation is calculated. This process realizes the composition of the data potential features through the memory items of the memory module. This method can cause the intrusion sample to produce a large reconstruction error, where is the normalized latent feature.

[0099] In an exemplary embodiment of the present invention, incrementally updating the memory includes:

[0100] The memory module recombines the potential features to make them closer to the normal mode features, thereby amplifying the reconstruction error of the model for the intrusion sample. However, in real industrial control scenarios, the normal data collected is often not all normal sample data, and there may be noise or other abnormalities. Since the memory module will learn the noisy data as normal data during training and store it in the memory module, the model detection performance will be reduced. Therefore, this section proposes a method for incrementally updating the memory module by querying The weighted average of , rather than the direct addition, can focus more on similar items. To prevent the memory module from being affected by noise during training, and thus avoid learning rare abnormal features, the update method is as follows:

[0101]

[0102] In the formula, v i ′ is the second weight vector, v i is the matching probability, is the new potential feature vector, v j is the j-th probability among all possible values ​​after softmax calculation, is the cosine similarity between the new potential feature vector and the memory item, and i, j, and L are natural numbers.

[0103] In an exemplary embodiment of the present invention, the updating of the memory item includes:

[0104] During the intrusion detection model training phase, the sensor data collected during the normal operation of the system is used for training, and the memory module can accurately remember the normal mode through the incremental update mechanism. However, the system's operating mode may change, which may cause the distribution of data to change, resulting in a decrease in the model's detection performance. For small and medium-sized industrial control systems with flexible positioning, such changes are more frequent, which requires the intrusion detection model to be able to adapt to changes in the system's operating mode.

[0105] However, training the model offline and then redeploying it will cause unnecessary waste of resources. Therefore, this section proposes to update the memory module through a gated update mechanism during the online learning phase, so that the model can quickly adapt to the new normal mode.

[0106] In the intrusion detection phase of the model, the input data includes not only normal data but also intrusion data. Through incremental updates, abnormal patterns will be introduced into the memory module. A gating mechanism is proposed to determine whether the current input is used to update the memory.

[0107] S301: Calculate the distance score between the current input data and the memory item, and update the memory module when the distance score is less than an update threshold;

[0108] S302: Calculating the distance score between the current input data and the memory item includes:

[0109] When calculating the distance score, the distance between the new data and the memory item is calculated, and then the weighted distance score is calculated using the Exponential Weighted Average (EWA). The EWA-weighted distance score gives more weight to similar data, allowing the model to adapt to such changes more quickly and respond more quickly to emerging normal patterns. The EWA-weighted distance score of the potential features of the current data is calculated as follows:

[0110]

[0111] In the formula, D(z,m i ) is the distance between the potential feature vector and the memory item, γ is the exponential weighting factor, k is a natural number, and Score(z) is the distance score;

[0112] S303: Obtain the potential feature vector and k items whose first weight vectors are not 0 after querying the memory module, and arrange them in ascending order.

[0113] D(z,m1)≤...≤D(z,m k )

[0114] Where D(z,m1) is the distance between the potential feature vector and memory item 1, and D(z,m k ) is the distance between the potential feature vector and the memory item k,

[0115] The distance score is compared with the update threshold. If the score is less than the threshold, the new feature is updated to the memory module, which ensures that abnormal patterns are not updated to the memory. The updated memory item is selected with the smallest distance score and placed in front of D(z,m1), and z is used to replace the item.

[0116] An exemplary embodiment of the present invention further includes establishing a loss function to balance the training effect of the ME-VAE model through the loss function.

[0117] This solution uses VAE to reconstruct data, requiring the normal samples to be restored as much as possible. The input samples are reconstructed based on VAE, and the loss function is generally composed of reconstruction loss and KL divergence. Specifically, the reconstruction loss measures the ability of the model to reconstruct the input samples, usually measured by the distance between the reconstructed samples and the original samples. When reconstructing industrial control time series data or other continuous value data, the loss function often used is the mean square error MSE. This loss function can measure the deviation between the model's predicted value and the actual value.

[0118]

[0119] MSE is the mean of the squares of the differences between the predicted values ​​and the true values. Optimizing the MSE loss function can make the model pay more attention to large errors because the square of the error amplifies the larger error value.

[0120] KL divergence loss is another indicator used to limit the difference between the latent variable distribution and the standard normal distribution to promote the smoothness and continuity of the latent space and prevent overfitting.

[0121]

[0122] Therefore, the loss function based on VAE reconstruction is as follows:

[0123]

[0124] By introducing a memory module to store the features of normal samples, similarity matching is then performed on the latent vectors output by the encoder in the VAE network, and finally a vector is generated that is composed of multiple positive sample features according to similarity weights. However, if the number of combined vectors is too large, abnormal samples may still be reconstructed, so the weight matrix composed of similarities should be as sparse as possible to reduce the number of normal features used in the memory module.

[0125] In response to the above problems, different solutions have been proposed in the prior art. During the training process, features with less similarity are pruned, and the weight matrix is ​​sparsely made by minimizing the entropy of the weight matrix in the loss function. Alternatively, more normal behavior features can be stored by adding three memory units. However, in the industrial control intrusion detection scenario, both device resources and computing power are limited. The size of the module storing normal features should be as small as possible to avoid storing too many similar normal features and wasting storage resources. Therefore, it is necessary to balance the relationship between the size of the storage unit and the diversity of features. In order to solve this problem, this solution proposes a feature difference loss function, which minimizes the similarity between features through the loss function, so that there are as many different normal behavior features as possible in the memory module, as follows.

[0126]

[0127] During the entire training process of the variational autoencoder, the distribution of the latent variables needs to be gradually tended to a normal distribution. Therefore, in order to make the latent variables composed of normal features in the memory module and the encoded latent variables have similar distributions, this section proposes a feature synthesis loss to avoid excessive distribution differences between the latent variables and the synthesized features, and to make the two vectors as similar as possible by minimizing the Euclidean distance between the two, as follows:

[0128]

[0129] Therefore, the ME-VAE model proposed in this scheme balances the training effect by combining three loss functions and assigning weights to them respectively.

[0130]

[0131] In the formula, is the mean square error, m is the number of data, y i is the predicted value, y i ′ is the actual value, is the divergence loss, is the loss function reconstructed by VAE, is the difference loss function, is the Euclidean distance, is the total number of all features, μ is the mean, σ is the variance, m j is the jth potential feature representation vector, η is the trade-off loss function Hyperparameters of .

[0132] An exemplary embodiment of the present invention further includes adjusting the reconstruction error by the difference between the input and output characteristics of the memory module:

[0133] The input sample is reconstructed through the decoding layer of ME-VAE. In the anomaly recognition stage, the main task is to judge the intrusion of the sample by comparing the anomaly score with the threshold. The existing reconstruction-based model mainly uses the reconstruction error as the anomaly judgment criterion. However, this method has certain defects. When the intrusion sample and the normal sample are similar, the model may still reconstruct the intrusion sample. The model is difficult to effectively distinguish between normal and intrusion data, which affects the performance of the entire model. Therefore, in order to solve this problem, this section proposes an anomaly score method that adjusts the reconstruction error through feature differences.

[0134] Specifically, if only the reconstruction error is used as the basis for abnormal identification, there may be misjudgment problems, which increases the difficulty of intrusion identification. Therefore, this section uses the ability of the memory module to capture normal features and adjusts the reconstruction error by using the difference between the input and output features of the memory module.

[0135]

[0136] Where S(t) is the adjusted reconstruction error, ε ′ is the correction parameter, x t is the input data feature, is the reconstructed data feature, z t is the initial feature, The features generated by recombining the memory module can be combined with the reconstruction error and the feature error of the latent space. The model's sensitivity to small changes can be enhanced by adjusting the feature difference. When the input sample is abnormal, the features generated by recombining the memory module Compared with the original z t The difference between them is large. Even if the decoder can reconstruct data similar to the input, the final anomaly score can be amplified due to the consideration of the error in the feature space. Finally, by comparing the overall anomaly score in the sliding window with the pre-set threshold, when the anomaly score exceeds the threshold, it means that an intrusion behavior has been detected. The setting of the threshold is determined by the maximum anomaly score calculated in the training phase.

[0137] like Figure 5 As shown, a comparison chart of the effects of the ME-VAE model of the present invention and other models is provided.

[0138] An exemplary embodiment of the present invention also includes an interpretable industrial control intrusion detection method based on a graph attention network, specifically,

[0139] A prediction model is established based on graph attention network and gated recurrent unit. The prediction model predicts the data of the industrial control system and filters and removes noise from the predicted data.

[0140] Similarly, data preprocessing is required before this. Since there are large differences between the data value ranges of different feature attributes in the intrusion detection dataset, in order to construct data that is convenient for subsequent intrusion detection model processing, the original data is normalized. At the same time, in order to construct a dataset suitable for spatiotemporal series prediction, a sliding window is used for data sampling, and the training dataset and the test dataset are processed into multivariate time series data.

[0141] About data prediction based on graph attention network and gated recurrent unit. In industrial control environment, there is often correlation between devices. Graph neural network is a method commonly used to obtain correlation between devices. However, existing research based on graph neural network still has room for optimization. Therefore, in this stage, the limitations of graph attention network are first explained; then how to improve it is described in detail; at the same time, a prediction network based on the improved GAT combined with gated recurrent unit is proposed to realize the spatiotemporal feature extraction of sensor data and the prediction of sensor values.

[0142] Composite anomaly judgment based on threshold and entropy. Since there is noise in the industrial control environment, noise will also cause anomalies in the equipment data, resulting in a higher false alarm rate of the algorithm. Therefore, in this stage, the necessity of solving the noise problem is first explained; secondly, a composite discriminator based on threshold and approximate entropy is proposed. Its discrimination strategy is to first filter out sequences that may be abnormal through the threshold, and then calculate the approximate entropy of these sequences to filter out anomalies caused by noise; finally, the anomaly is explained by aggregating neighbor anomaly scores.

[0143] like Figure 6 As shown in the figure, in order to monitor the operating status of industrial control systems, a large number of sensor devices are often deployed. These devices will generate a large amount of high-dimensional and complex data when working, and the devices interact with each other, making the data potentially correlated. This requires the intrusion detection model to effectively extract the spatiotemporal features of sensor data to accurately model the operating status of such industrial control systems. However, most current intrusion detection models only focus on one type of feature and lack the ability to extract two features at the same time. Therefore, how to achieve the comprehensive extraction of the time dependency of high-dimensional and complex sensor data and the hidden correlation between sensors is an important challenge at present. In order to further improve the detection efficiency of the model, this section proposes an intrusion detection model of SC-GRN, which extracts the spatiotemporal features of sensor data by combining the improved GAT network and GRU. Specifically, a continuous graph structure learning method based on similarity constraints is proposed to improve the GAT network, learn more continuous and stable spatial features between sensor data, and thus reduce the introduction of noise nodes. Each round of graph structure update is performed under the constraints of the previous round of graph structure, maintaining the continuity of graph structure learning. And by setting a threshold to filter out neighbor nodes with higher correlation, the introduction of redundant neighbor nodes is reduced, while the structure of the graph is simplified and the complexity of calculation is reduced.

[0144] like Figure 7 As shown in the figure, M represents the global correlation matrix, which is used to retain the graph structure information learned in the previous round. M is generated by random initialization. S represents the similarity relationship between nodes in the current round.

[0145] The vectors are randomly initialized and continuously updated during the model training process. The similarity constraint is used to minimize the gap between the two matrices. During the training process, M is dynamically adjusted by minimizing this loss function so that the final generated graph structure is optimal.

[0146]

[0147] Always, is a similarity constraint.

[0148] Next, neighbor nodes are selected through the threshold strategy to generate the adjacency matrix A representing the graph structure. Specifically, a threshold is set, and only when the similarity between two nodes is greater than or equal to this threshold, there will be a connection between the adjacency matrices.

[0149] By combining local similarity constraints and threshold-based node neighbor selection, the noise nodes introduced by the discontinuity of graph structure learning can be reduced. This method can more accurately reflect the interactions and dependencies between sensors in time series data, thereby improving the performance of intrusion detection.

[0150] like Figure 8 As shown in Figure 1, after obtaining the graph structure of sensor nodes, the spatial dependencies between sensors are captured by the improved GAT, and then the temporal features of sensor data are obtained by the GRU element. The final prediction layer consists of two stacked fully connected layers, and prediction is made based on the last layer of the GRU output.

[0151] The prediction model in this embodiment adopts the SC-GRN model, and the specific prediction model includes:

[0152] The input of the GAT layer is the sensor embedding vector and the adjacency matrix A representing the graph structure. The weights between nodes are learned through the self-attention mechanism to capture the spatial dependencies between sensors. The current sensor node i is updated by aggregating the information of adjacent nodes.

[0153]

[0154]

[0155] GAT can capture the relationship between sensors and convert these relationships into node feature representations, finally obtaining n sensor nodes, and then extracting the temporal features of the sensor data. GRU can effectively capture the temporal information of sequence data and learn the dependencies between sequence data by performing temporal feature extraction.

[0156]

[0157] In the formula, is the feature of node i after aggregating neighbor nodes, α ij is the attention coefficient of node j to node i in the GAT network, W is the learnable weight matrix, Ψ(i) is the neighbor of node i obtained from the adjacency matrix, is the sliding window input for node i, is the sliding window input for node j, is the concatenation of the sensor embedding and its corresponding sliding window input, v i′ is the feature embedding vector of the i-th sensor, e ij The attention coefficient after activation using the nonlinear activation function LeakyReLU, e ik is the unnormalized value of the attention coefficient between node i and its neighbor node k, a is a learnable parameter vector, z ′(t) is the feature vector of n sensors containing spatiotemporal features in the sliding window, x (t) is the industrial control system data, z (t) is the output of the GAT network.

[0158] After the feature vector is learned by the GRU unit, it can help the intrusion detection model identify and propose the time dependency in the data sequence, thus improving the accuracy of intrusion detection. The prediction layer is composed of a fully connected network, which calculates the prediction value of the current time t according to the historical input vector representation.

[0159] In an exemplary embodiment of the present invention, filtering and denoising the predicted data includes:

[0160] Preliminary determination of thresholds,The prediction-based intrusion detection method is to detect anomalies by training the normal state of the system, using the model to predict the next value of the sensor, and monitoring the prediction error. When the system is in normal mode, the prediction error is usually low, but when the system is in an abnormal state, the prediction error may increase significantly. Therefore, the deviation between the predicted value and the true value can be used as a measure of anomaly.

[0161] First, a threshold is set to determine whether it is higher than the threshold. When the error exceeds the threshold, it means that an abnormality that may be caused by intrusion is detected. This discriminator can quickly and effectively identify anomalies that are obviously deviated from the normal range. It is suitable for scenes with obvious abnormalities. It determines whether there is an abnormality based on the comparison between the anomaly score and the preset threshold.

[0162] By setting a parameter as the threshold in the intrusion detection algorithm, if the anomaly score exceeds the threshold, the time t is placed in the filter window, and then further judgment is made based on the approximate entropy of the sequence in the filter window.

[0163] S401: Obtain an error sequence, perform phase space reconstruction on the error sequence within a given embedding dimension elimination filter window of the error sequence, and divide the error sequence into a plurality of subsequences;

[0164] S402: Calculate the similarity between any two reconstructed vectors, where the distance between the two reconstructed vectors is defined as the maximum absolute value of the difference between the corresponding elements of the two sequences;

[0165] Specifically, find all similar subsequences. First, set a similarity tolerance threshold and find all sequences whose distance is lower than this threshold. If the distance between the two furthest subsequences is less than the similarity tolerance threshold, then the two sequences are considered similar under the similarity tolerance threshold.

[0166] Select all situations that meet the condition and record the quantity, and record the ratio of the approximate quantity to the total quantity as the approximate ratio.

[0167]

[0168] In the formula, is the approximate ratio, is the distance between the two farthest subsequences, r is the similarity tolerance threshold, and k is the number of subsequences.

[0169] S403: Calculate the logarithmic probability of all sequences and obtain the average value, and calculate the approximate entropy of the error sequence in the filtering window through the average value;

[0170] S404: Compare the approximate entropy with the entropy threshold, judge and output the abnormal data.

[0171] like Fig. 9 As shown, an exemplary embodiment of the present invention further includes anomaly interpretation based on aggregated neighbor anomaly scores.

[0172] In order to enable engineers to quickly locate and maintain specific abnormal devices when the model detects an anomaly, this section uses the graph structure information learned by GAT to locate devices that may be invaded.

[0173] In the anomaly identification stage, the final system anomaly score is provided by the sensor with the largest anomaly score in the current system. However, in complex systems, sensors often interact with each other, and the anomaly of a sensor may be caused by other sensors. In this case, although the anomaly scores of some sensors are very high, they may not be the root cause of the anomaly, but only a reflection of the anomaly symptoms. In order to further identify the root cause, this section proposes an anomaly interpretation method based on aggregated neighbor anomaly scores, which locates abnormal devices through the graph structure learned by GAT and the correlation between neighbor nodes. The specific process is as follows:

[0174] Calculate the anomaly score. First, in the anomaly identification stage, calculate the anomaly score of each sensor and find the sensor with the largest anomaly score.

[0175] Preliminary diagnosis. Perform a preliminary diagnosis on sensor i with the largest current anomaly score. If the sensor is not the root cause of the anomaly, further analysis is required.

[0176] Calculate the aggregated neighbor anomaly score. Calculate the aggregated neighbor anomaly score of all sensors. Specifically, find the neighbor sensors of a sensor through the adjacency matrix A learned by GAT, and further weight the anomaly scores of the direct neighbors of sensor i according to the correlation.

[0177]

[0178] In the formula, R i (t) is the anomaly score after aggregating the one-hop neighbors of sensor i, err j (t) is the anomaly score of a single sensor.

[0179] Anomaly score sorting. Sort all sensors according to their anomaly scores to get an anomaly sorting table. The sensors in the sorting table are arranged according to the size of the anomaly score, that is, the sensors with high anomaly scores are at the front. This is because if the anomaly score of a sensor's neighbor node is higher, then the probability of an anomaly in this sensor is greater.

[0180] Anomaly location. Provide the sorted list to the system operator for anomaly location. The sensors at the top of the list are more likely to be the root cause of the anomaly.

[0181] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0182] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0183] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An industrial control intrusion detection method based on graph attention network and variational autoencoder, characterized in that: include: Acquire data from the industrial control system and preprocess the data, wherein the preprocessing includes data cleaning and normalizing the cleaned data; Use sliding windows to partition the data; Establishing a ME-VAE model, the ME-VAE model includes an encoder, a memory module, and a decoder, enhancing latent features through the memory module, amplifying the reconstruction error of the intrusion sample, and incrementally updating the memory in the ME-VAE model; Determine whether the current data is used to update the memory. If so, update several memory items. If not, do nothing. The difference between the latent features and the features enhanced by the memory module is obtained, the reconstruction error of the data is weighted, the intrusion is judged by the weighted reconstruction error, and the judgment result is output.

2. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 1 is characterized in that: The ME-VAE model is established including: Given a time input sequence, it is encoded and sampled by an encoder consisting of a GRU module and a fully connected layer, and the potential representation of the intermediate layer is output; Using the latent representation as the query vector, the similarity with each memory item is calculated in the memory module, and the query vector and the memory item are combined into a new latent feature vector according to the similarity; The latent feature vector is passed to the decoder for reconstruction, restoring the temporal input sequence.

3. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 2 is characterized in that: The enhancement of potential features comprises: Calculate the distance between the query vector and each unit in the memory module to obtain a weight vector; w i =Softmax(d cos (z,m i )) And the weight vector is modified by vector sparsification; In the formula, w i is the first weight vector, d cos (z,m i ) is the cosine similarity between the latent feature vector and the memory item, z is the latent feature vector, m i is a unit in the memory module, is the corrected weight vector, λ is the sparse threshold, ε is a positive scalar, and max(.,0) is the ReLU activation function.

4. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 3 is characterized in that: The incremental updating of the memory comprises: In the formula, v′ i is the second weight vector, v i is the matching probability, is the new potential feature vector, v j is the j-th probability among all possible values ​​after softmax calculation, is the cosine similarity between the new potential feature vector and the memory item, i, j, and L are natural numbers.

5. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 4 is characterized in that: The memory item is updated including: Calculate the distance score between the current input data and the memory item, and update the memory module when the distance score is less than an update threshold; The calculation of the distance score between the current input data and the memory item includes: In the formula, D(z,m i ) is the distance between the latent feature vector and the memory item, γ is the exponential weighting factor, k and i are natural numbers, and Score(z) is the distance score; Get the potential feature vector and the k items whose first weight vector is not 0 after the memory module query, and arrange them in order from small to large.

6. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 5 is characterized in that: It also includes establishing a loss function to balance the training effect of the ME-VAE model through the loss function. The loss function includes: In the formula, is the mean square error, m is the number of data, y i is the predicted value, y′ i is the actual value, is the divergence loss, is the loss function reconstructed by VAE, is the difference loss function, is the Euclidean distance, is the total number of all features, μ is the mean, σ is the variance, m j is the jth potential feature representation vector, η is the trade-off loss function Hyperparameters of .

7. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 6 is characterized in that: It also includes adjusting the reconstruction error by the difference between the input and output features of the memory module: Where S(t) is the adjusted reconstruction error, ε′ is the correction parameter, and x t is the input data feature, is the reconstructed data feature, z t is the initial feature, Reassemble the generated features for the memory module.

8. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 1 is characterized in that: Also includes: A prediction model is established based on graph attention network and gated recurrent unit. The prediction model predicts the data of the industrial control system and filters and removes noise from the predicted data.

9. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 8 is characterized in that: The prediction model includes: In the formula, is the feature of node i after aggregating neighbor nodes, α ij is the attention coefficient of node j to node i in the GAT network, W is the learnable weight matrix, Ψ(i) is the neighbor of node i obtained from the adjacency matrix, is the sliding window input for node i, is the sliding window input for node j, is the concatenation of the sensor embedding and its corresponding sliding window input, v′ i is the feature embedding vector of node i, e ij The attention coefficient after activation using the nonlinear activation function LeakyReLU, e ik is the unnormalized value of the attention coefficient between node i and its neighbor node k, a is a learnable parameter vector, z′ (t) is the feature vector of n sensors containing spatiotemporal features in the sliding window, x (t) is the industrial control system data, z (t) is the output of the GAT network.

10. The industrial control intrusion detection method based on graph attention network and variational autoencoder according to claim 9 is characterized in that: The filtering and denoising of the predicted data comprises: Obtain an error sequence, reconstruct the error sequence in a phase space within a given embedding dimension elimination filter window of the error sequence, and divide the error sequence into a number of subsequences; Calculate the similarity between any two reconstructed vectors. The distance between two reconstructed vectors is defined as the maximum absolute value of the difference between the corresponding elements of the two sequences. Calculate the logarithmic probability of all sequences and find the average value, and use the average value to calculate the approximate entropy of the error sequence in the filter window; Compare the approximate entropy with the entropy threshold, judge the abnormal data and output it.

Images