Attack detection method for multivariate sensor data in incomplete SCADA (Supervisory Control and Data Acquisition) scene

Abstract

The invention belongs to the field of industrial control network security, and discloses an attack detection method for multi-element sensor data in an incomplete SCADA (Supervisory Control and Data Acquisition) scene. An interpolation network based on a neural controlled differential equation is used for repairing original samples under different deletion degrees; the window self-adaptive mechanism solves the problem that sample window setting is unreasonable in the preprocessing process under the condition that priori knowledge does not exist. A self-adaptive mask mechanism is provided, and aims to guide a detection model from an input side, enhance the understanding of a dependency relationship between time and sensor nodes, and provide a certain degree of interpretability for the model from the perspective of mechanism definition. And in combination with adversarial training, application defects of native diffusion in the field of SCADA anomaly detection are optimized. Compared with other filling methods, the diffusion step length is greatly compressed, and the training and detection efficiency is remarkably improved. Application requirements in actual production are fully considered, and multi-element sensor data anomaly detection in a heterogeneous SCADA scene can be supported without priori knowledge.

Description

Technical Field

[0001] The present invention relates to the field of industrial control network security, and in particular to an attack detection method for multi-sensor data in incomplete SCADA scenarios. Background Art

[0002] In recent years, as industrial manufacturing enterprises have encountered high-frequency attacks, it has been revealed that incomplete SCADA systems have been working in a "sick" state. With the severity of the situation, a large number of security studies have focused on the detection of attacks that penetrate from the network layer to the physical layer. At present, traditional rule-based detection methods are difficult to meet the above needs, and deep learning methods based on generative models (GANs, VAEs, Normalizing flows, and DDPMs) have emerged in complex abnormal behavior detection with their powerful distributed learning capabilities. However, existing deep learning methods only consider the time series characteristics of SCADA data. Although these methods have achieved better detection results in specific complete SCADA scenarios by virtue of the predictable and reconstructive characteristics of time series data, in the face of the limitations of professional knowledge, when the generalized prediction and reconstruction time series anomaly detection methods are migrated to SCADA scenarios, there are still high false positives and false negatives in the detection link caused by abnormal concentration, especially the prediction-based methods are difficult to avoid the impact of prediction bias, while the reconstruction-based methods are more plastic and adaptable when learning sample distribution. At the same time, the system is unpredictable and inherently subject to potential security threats (such as misconfiguration, latent network or application viruses, equipment switching caused by failures, etc.), which can easily undermine sample integrity. This will directly lead to irregular or missing data collected during system operation, making it impossible for the model to accurately establish a corresponding detection baseline from incomplete input samples.

[0003] For the above-mentioned generative models, although the training based on GANs is not stable, the adversarial idea can make the model fit the sample distribution to the greatest extent; the flow-based method focuses on modeling the sample distribution by establishing a strictly reversible transformation between the sample input and the reconstructed output, while it is difficult for general neural networks to build such a mapping relationship, which is limited in field applications; the trade-off between the approximate posterior representation and computational cost based on VAEs affects its application performance in actual scenarios; in view of the above limitations, the DDPMs-based method uses the principles of forward diffusion and backward diffusion to add noise to the sample data and restore it, so that the model can grasp the distribution of the training samples. Although the step size of the diffusion process is determined by the sample distribution and the model structure, this research field and its downstream tasks have attracted attention due to their good interpretability, and the characteristics of the latent variables and the input being of the same dimension make it an important research direction. Although the above methods have their own characteristics, there are still some shortcomings in matching the actual target distribution. In other words, the above models are not always compatible with these processable target distributions.

[0004] The paper "Xiao C, Gou Z, Tai W, et al. Imputation-based time-series anomaly detection with conditional weight-incremental diffusion models [C] / / Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and DataMining. 2023: 2742-2751." proposes an anomaly detection method DiffAD from the perspective of time series interpolation, which uses part or all of the data as observation samples for model estimation or learning the distribution of target samples. It uses density strategy to flexibly select normal observation points, making the model better suitable for abnormal concentration scenarios. At the same time, in order to enhance the detection sensitivity of the model to abnormal concentration phenomena, a conditional weighted incremental diffusion detection method based on interpolation is proposed. At the same time, a multi-scale state space model is used as a solver internally to capture long-term dependencies under different modes, which can maximize the preservation of observation information, greatly improve the quality of sample generation, and achieve stable anomaly detection. Experimental results show that the test performance of real data is better than the current SOTAs method. Although this method has achieved good test results in the detection stage, the framework is designed and implemented from the perspective of general anomaly detection, and has great performance limitations when applied to different SCADA scenarios. The proposed model can only grasp the time series distribution from the perspective of learning long-term dependencies. For SCADA multi-sensor data, short-cycle detection can meet the timeliness requirements of the system. At the same time, the diffusion step length of the diffusion model itself is too long, which also leads to longer training and detection time of the model. In the data preprocessing stage before training, a fixed window size is used for all data, but for sensor data with different control behavior complexity, unreasonable windowing operations are likely to affect the model's understanding of the original data distribution.

[0005] The paper "Chen Y, Zhang C, Ma M, et al. Imdiffusion: Imputed diffusion models for multivariate time series anomaly detection [J]. arXiv preprint arXiv: 2307.00754, 2023." proposes a multivariate time series data anomaly detection framework that combines time series interpolation and diffusion models. The adjacent information in the time series data enables the model to accurately grasp the time and internal dependencies, reduce the uncertainty in the data, and thus enhance the robustness of anomaly detection. At the same time, the diffusion model is further used as a time series data interpolator to enable the framework to capture complex dependencies, and the denoised output gradually generated by the model during the inference process is used as a measurement indicator for anomaly prediction, thereby improving the accuracy and robustness of the detection process. Through generalization evaluation on baseline data, experiments have proved that the framework is superior to SOTAs methods in detection accuracy and timeliness. Although this method proves the advantages of diffusion-based generative models in anomaly detection compared to GANs, Transformer and LSTM methods that only rely on reconstruction or prediction characteristics, the disadvantages of directly applying diffusion methods to SCADA multi-sensor data are still prominent. Although the mask mechanism proposed in this paper is used to guide the model to learn internal dependencies, it still focuses on long-term dependencies as a whole, and short-term dependencies cannot be well grasped. It cannot adaptively perform windowed learning according to the characteristics of heterogeneous data. At the same time, the scale setting of the diffusion step size is fixed and the value is large. The above factors greatly affect the timeliness of the overall framework during training and detection, which also leads to certain detection limitations when it is compatible with sensor data from different scenarios.

[0006] In summary, the existing methods based on generative models are directly applied to the field of anomaly detection of SCADA multi-sensor data. There are still certain challenges to be optimized, mainly including the reasonable setting of windowing for heterogeneous data, the optimization of diffusion step size, and the degree of model's mastery of short-term distribution. More importantly, the existing detection methods do not take into account the impact of potential system security issues on the integrity of input samples, that is, there is a certain degree of missing in the monitored data, which makes it difficult to effectively build the model. Summary of the invention

[0007] The purpose of the present invention is to propose an attack detection method for incomplete SCADA scenario multi-sensor data. Under the premise of ensuring the integrity of training data, the method can construct a conditional diffusion adversarial detection model with Transformer as the inverse solver, adaptively compatible with multi-sensor data in different SCADA scenarios, and realize effective detection of underlying abnormal behaviors in industrial sites.

[0008] The technical solution of the present invention is as follows: an attack detection method for multi-sensor data in incomplete SCADA scenarios, comprising the following steps:

[0009] Step 1: construct missing data with different missing degrees based on the original SCADA multivariate sensor data through random missing operation; set three missing degrees according to the control stage and the sensor attributes in the current control stage, namely mild missing Type IM, moderate missing Type II-M and severe missing Type III-M;

[0010] Step 2: Based on the neural controlled differential equations NCDEs, a neural network model is constructed as the completion network Imputer to complete the missing data generated in step 1 and obtain the completed complete data set X s ;

[0011] Step 3: Calculate the periodicity P and autocorrelation ACF, establish the window adaptive selection strategy WASS, and automatically obtain the periodicity p of multi-sensor data in the target SCADA scenario w ;

[0012] Step 4: Construct a conditional diffusion adversarial detection model TCDGM with Transformer as the inverse solver. In the training and detection process, based on the adaptive dynamic mask mechanism ADMM, further enhance TCDGM's ability to fit the target distribution and guide TCDGM to learn the dependency relationship p(X em |X ob ), where X em is the observed value represented by the mask area, X ob is a known value of the unmasked area; the core of the adaptive dynamic mask mechanism ADMM is to w The windowed training input with the scale size as the benchmark is subjected to mandatory masking operation; the TCDGM model at the end of training is used as the baseline model for detecting anomalies; the input sample to be detected X D and the mask vector To the baseline model, the final detection threshold τ is obtained according to the backward diffusion process; when the difference between the input sample of the generator and the generated sample is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

[0013] Furthermore, the mild loss Type IM is defined as the possibility of data missing due to potential safety hazards, which only occurs in the sensor detection link of any single-stage process, and the sensors will not affect each other; the moderate loss Type II-M is defined as the mutual influence between sensors at a certain stage due to potential safety factors, and has the propagation characteristics across sensors; the severe loss Type III-M is defined as the existence of cross-stage data missing in the monitoring process of multiple sensors due to relatively serious safety risks.

[0014] Furthermore, the step 2 is specifically as follows:

[0015] Step 2.1 Dataset division; the discrete missing data to be completed is Including mild deletion Type IM, moderate deletion Type II-M, severe deletion Type III-M, t represents the time point; the training set is divided according to the established ratio and validation set

[0016] Step 2.2 constructs and parameters the completion network Imputer; the completion network construction principle is shown in the following formula, where Indicated by θ f and θ h The parameterized neural network, θ f and θ h They correspond to the sub-networks constructed by different fully connected layers FC respectively. The continuous path X(t) represents the intermediate result mapped from the missing data input to the completion network Imputer. Indicates the total length of missing data;

[0017]

[0018] Accordingly, represents the derivative of the neural network at time t,

[0019]

[0020] Step 2.3 Train the completion network; combine the training set And use Huber loss to complete the parameters θ in the network f and θ h Perform training optimization and use Verify and update the above parameters until the completion model converges; the completed data set X is calculated by the completion network Imputer s .

[0021] Furthermore, the window adaptive selection strategy WASS is specifically:

[0022] Step 3.1 For Dimensional multivariate sensor samples X s , calculate the candidate cycles under each dimension

[0023]

[0024] DFT{x t} represents the Fourier transform of the time series sample corresponding to the current dimension;

[0025] Step 3.2 Use ACF to analyze the candidate cycles Perform the test and update the candidate cycle values ​​that have passed the verification to the temporary cycle list p cde ;

[0026]

[0027]

[0028] Indicates the use of Huber loss Adaptive solution of ;

[0029] Step 3.3 Select p according to the sensor attributes of the current SCADA multivariate time series data edde After being sorted in descending order, the top-k values ​​within the specified range are taken as the final p w .

[0030] Furthermore, the adaptive dynamic mask mechanism ADMM is specifically:

[0031] For all sensor data in the current window, select odd or even time dimensions for masking, and let the mask vector be The current time point t = {2n, 2n-1} and the sensor dimension d = {2m, 2m-1}, where 1≤n≤p w / 2 and The specific expression is as follows:

[0032]

[0033] Based on the mask operation of the time dimension, an odd or even sensor dimension is selected for mask operation;

[0034]

[0035] Furthermore, the step 4 is specifically as follows:

[0036] Step 4.1: Define the training sample input as The proposed TCDGM model is parameterized by combining adversarial training and diffusion principle; the TCDGM model includes a generator, a discriminator, a forward diffusion module and a backward diffusion module;

[0037] Step 4.2, X S During the TCDGM training or detection process, forward diffusion is performed through the forward diffusion module. The diffusion results after T steps of noise addition are in represents the original sample without any noise added to the original input sample;

[0038]

[0039] in,

[0040]

[0041] β t represents the degree of change of noise accompanying t, I represents the diagonal matrix, represents a normal distribution, represents the noise variable obtained from the original input sample with the step size T;

[0042] The training sample input is forward diffused to obtain the noise samples of adjacent steps. and Will Input to the generator G in the TCDGM model, and get By back sampling Will and Input to the discriminator D in the TCDGM model;

[0043] Step 4.3: Parameterize the generator G and discriminator D in the TCDGM model; Generator On the basis of the existing Transformer, new time embedding Temb and feature embedding module Demb, feature attention FTL and time attention TTL modules are added; discriminator It is composed of multiple groups of 1D-CNN and fully connected Dense network layers with a time embedding module Temb. Respectively represent the learnable model parameters of the generator G and the discriminator D, and tp represents the size p w An ordered natural number series; under the condition of adversarial training, the generator G generates noise samples by mastering the target sample distribution

[0044] Step 4.4: Backward diffusion module for the noise sample in step 4.3 Perform backward sampling, Denoising The corresponding whole denoising process is defined as:

[0045]

[0046] Will introduce X em and X ob The backward diffusion process is defined as follows:

[0047]

[0048] Among them, μ θ represents the mean of the denoising process, σ 2 represents the variance of the denoising process;

[0049] Step 4.5: The discriminator D identifies the similarity between the forward diffusion samples and the backward diffusion samples within the current step length, that is, and At the same time, adversarial training is used to further iterate and optimize, and its optimization goal is specifically defined as:

[0050]

[0051] The optimization loss corresponding to the generator G and the discriminator D is specifically expressed as:

[0052]

[0053] In order to ensure that the TCDGM model can improve its learning ability for the correlation between time series and sensors under mask conditions, the distance difference between masked and unmasked samples in ADMM is calculated. The specific calculation process is as follows:

[0054]

[0055] Here the command The optimization objective of the generator G is expressed as and The weighted sum Where λ is the weight coefficient, and the specific calculation form is:

[0056]

[0057] Step 4.6 The TCDGM model training process repeats steps 4.1-4.5 until the maximum number of training times is reached, or the early stopping restriction condition is met so that the training is interrupted, and the TCDGM model at the end of the training is saved as the baseline for detecting anomalies;

[0058] Step 4.7 defines the TCDGM model’s judgment mechanism for abnormal behavior; based on the baseline after training optimization, input the sample to be tested X D and the mask vector A set of candidate detection thresholds are calculated from the back diffusion process Its specific definition is:

[0059]

[0060] The final detection threshold τ is defined as When the difference between the input sample and the generated sample through G is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

[0061] The beneficial effects of the present invention are as follows: (1) Considering the impact of potential safety factors on the integrity of multi-sensor data, an interpolation network based on neural controlled differential equations (NCDEs) is proposed to repair the original samples with different degrees of missingness, laying a relatively accurate premise for subsequent model construction. (2) A window adaptive mechanism is proposed to solve the problem of unreasonable sample window setting in the preprocessing process without prior knowledge. This effectively avoids the trial and error time of window setting and is more in line with the timeliness requirements of SCADA scenarios. (3) An adaptive mask mechanism is proposed to guide the detection model from the input side, enhance the understanding of the dependency between time and sensor nodes, and provide a certain degree of interpretability for the model from the perspective of mechanism definition. (4) Based on the existing diffusion model, combined with adversarial training, the application defects of native diffusion in the field of SCADA anomaly detection are optimized. Compared with other filling methods, the diffusion step size is greatly compressed, which significantly improves the training and detection efficiency. (5) Taking into full consideration the application needs in actual production, it can support multi-sensor data anomaly detection in heterogeneous SCADA scenarios without prior knowledge. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This is the anomaly detection flow chart under the incomplete SCADA system;

[0063] Figure 2 This is a sample diagram of different degrees of sample missing in an incomplete SCADA system;

[0064] Figure 3 is the dependency graph of multivariate sensor data within a specific window under mask conditions;

[0065] Figure 4 This is a diagram of the anomaly detection framework for incomplete SCADA systems;

[0066] Figure 5 The network model structure diagram of the generator G and the discriminator D in the anomaly detection model; (a) is the generator, (b) is the discriminator;

[0067] Figure 6Figure 2 shows the attack detection effect under different SCADA data sets. DETAILED DESCRIPTION

[0068] The specific implementation of the present invention is further described in detail below in conjunction with the drawings and examples.

[0069] This embodiment uses 6 public multivariate sensor data sets in different SCADA industrial scenarios to verify the model. The data names are SWAT, BATADAL, WADI, HAI20.07, HAI21.03 and HAI22.04. The training set and test set of the above data are separate CSV files. The SWAT data set contains 7 days of normal monitoring, 4 days of 36 simulated attacks, and the abnormality rate of the test set is 11.98%; the abnormality rate of the BATADAL test set is 8.47%; WADI contains 14 days of normal data and 2 days of simulated attacks, and the abnormality rate of the test set is 5.99%; the HAI20.07, HAI21.03 and HAI22.04 test sets contain 38, 50 and 58 attack types respectively. An attack detection method for incomplete SCADA scenario multivariate sensor data, reference Figure 1 As shown, the processing flow of the attack detection method involved in the present invention includes the following steps:

[0070] Step 1: Use random missing operations to construct sample inputs with different missing degrees based on the original SCADA multivariate sensor data, such as Figure 2 As shown, three missing degrees are set according to the control stage and stage sensor attributes, where the corresponding missing proportions are 20% and 80%. The specific steps are:

[0071] Step 1.1: Due to potential safety risks, there may be data loss. This type of loss only occurs in the sensor detection link of any single-stage process, and the sensors will not affect each other, that is, a mild loss of Type IM.

[0072] Step 1.2: Due to potential safety factors, sensors are affected by each other at a certain stage, which has the propagation characteristics across sensors, that is, moderate loss Type II-M.

[0073] The relatively serious safety risks in step 1.3 result in data missing across stages during the monitoring process of the multi-sensor system, i.e., severe missing Type III-M.

[0074] Step 2: Combine the neural network model based on neural controlled differential equations NCDEs as the completion network Imputer to complete the missing data generated in step 1. The specific steps are:

[0075] Step 2.1 Dataset division. Let the discrete missing sample data to be completed be That is, Type I, II, and III-M, where t represents the time point. Divide the training set according to the established ratio and validation set

[0076] Step 2.2 Parameterize the Imputer completion network. As shown in the following formula, It means that due to the parameter θ f and θ h The constructed neural network has two parameters corresponding to different fully connected layers FC, and the continuous path X(t) represents the intermediate result mapped after the missing samples are input into Imputer. Indicates the time length of the entire input. The specific calculation formula is as follows:

[0077]

[0078] Accordingly,

[0079]

[0080] Step 2.3: Train the Imputer network. Combined with the training input And use Huber loss to adjust the parameters θ in the Imputer network f and θ h Perform training optimization and use Verify and update the above parameters until the completion model converges.

[0081] Step 2.3 The completed dataset X is calculated by the Imputer network s , thus ensuring the integrity of the multi-sensor sample.

[0082] Step 3: Establish the window adaptive selection strategy WASS, through periodic The autocorrelation ACF formula automatically obtains the period size p of multi-sensor data in the target SCADA scenario w ,The specific calculation formula is as follows, where k, t∈[0, N-1], which provides a reasonable sample preprocessing basis for the subsequent training of anomaly detection models.

[0083]

[0084] in,

[0085]

[0086] The specific steps include:

[0087] Step 3.1 For Dimensional multivariate sensor samples X s , calculate the candidate cycles under each dimension

[0088] Step 3.2 Use ACF to analyze the candidate cycles Verify and update the verified values ​​to the temporary period list p cde .

[0089] Step 3.3 Select p based on the prior information of the current SCADA sensor data cde After sorting in descending order, the value of Top-k∈[10,50] in the specified range is taken as the final p w .

[0090] In step 3.4, for the six data sets, the corresponding window sizes are calculated in steps 3.1-3.4 as {26, 15, 24, 12, 46, 17} respectively.

[0091] Step 4: Construct a conditional diffusion adversarial detection model TCDGM with Transformer as the inverse solver. In the training and detection process, based on the adaptive dynamic mask mechanism ADMM, further enhance TCDGM's ability to fit the target distribution and guide TCDGM to learn the dependency relationship p(X em |X ob ), where X em is the observed value represented by the mask area, X ob is the known value of the unmasked area, that is The entire detection model framework is as follows Figure 4 shown.

[0092] The core of the adaptive dynamic mask mechanism ADMM is to w The windowed training input with the scale size as the benchmark is subjected to mandatory masking operation; the TCDGM model at the end of training is used as the baseline model for detecting anomalies; the input sample to be detected X D and the mask vector To the baseline model, the final detection threshold τ is obtained according to the backward diffusion process; when the difference between the input sample of the generator and the generated sample is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

[0093] The adaptive dynamic mask mechanism ADMM enhances the model's understanding of the potential dependencies between sensor distributions during training and detection from the outside. w The mask vector is set to be The current time point t = {2n, 2n-1}} and the sensor dimension d = {2m, 2m-1}, where 1≤n≤p w / 2 and

[0094] For all sensor data in the current window, select odd or even time dimensions for masking, corresponding to Figure 3 Patte r n I and II, the specific expressions are as follows.

[0095]

[0096] Based on the above mask, select odd or even sensor dimensions for mask operation, corresponding to Figure 3 Sub-p1 and Sub-p2 in.

[0097]

[0098] Step 4.1 defines the training sample input as The proposed detection model is parameterized by combining adversarial training and diffusion principle.

[0099] Step 4.2 Input sample X s During the model operation, forward diffusion is performed, and the diffusion results after T steps of noise addition are in Represents the original sample without any noise added to the original input sample X s The specific process is as follows:

[0100]

[0101] in,

[0102]

[0103] Here β t Indicates the degree of change of noise with t, the noise samples of adjacent steps and Used for Figure 5 The input of the generator G and the discriminator D.

[0104] Step 4.3 parameterizes the generator G and discriminator D in the model. Figure 5 As shown in It is composed of a Transformer with time and feature attention. It consists of multiple sets of 1D-CNN networks with temporal embedding, θ and Represent the learnable model parameters of networks G and D respectively, and tp represents the size p wThe ordered natural number series, correspondingly, under the condition of adversarial training, the samples generated by G by mastering the target sample distribution are expressed as

[0105] Step 4.4 uses TCDGM to perform backward sampling on the noise samples in step 4.3, that is, Denoising The corresponding whole denoising process is defined as:

[0106]

[0107] Introducing X em and X ob The back diffusion process is defined as:

[0108]

[0109] Among them, μ θ and σ 2 They represent the mean and variance of the denoising process respectively.

[0110] Step 4.5 uses the discriminator D to identify the similarity between the forward diffusion and backward diffusion samples within the current step, that is, and At the same time, adversarial training is used to further iterate and optimize, and its optimization goal is specifically defined as:

[0111]

[0112] In order to facilitate the understanding of the model adversarial training method, the optimization loss of the corresponding generator G and discriminator D can be specifically expressed as:

[0113]

[0114] The optimization loss is redefined to calculate the distance difference between masked and unmasked samples under ADMM. The main purpose is to improve the model's ability to learn the correlation between timing and sensors under mask conditions. The specific process is defined as:

[0115]

[0116] Correspondingly, the loss of the generator G is also updated as It is expressed as and The weighted sum of , where λ is the weight coefficient, is expressed as:

[0117]

[0118] Here, for the six data sets, the weight coefficients are set as follows:

[0119] {λ SWAT,BATADAL : 0.5, λ WADI : 0.2, λ HAI20.07 : 0.4, λ HAI21.03 : 1.0, λ HAI22.04 :0.9}

[0120] {T SWAT :4,T BATADAL,HAI20.07 , HAI22.04 :8,T WADI,HAI21.03 :10}

[0121] Step 4.6: The model training process repeats steps 4.1-4.5 until the maximum number of training times is reached, or the early stopping constraint is met so that the training is interrupted, and the baseline model is saved.

[0122] Step 4.7 defines the model's judgment mechanism for abnormal behavior. Based on the trained and optimized baseline model, input the sample to be detected X D and the mask vector From the back diffusion process, a set of candidate detection thresholds can be calculated Its specific definition is:

[0123]

[0124] The final detection threshold τ is defined as If the difference between the input sample and the generated sample through G is greater than τ, it is considered abnormal behavior; otherwise, it is considered normal behavior.

[0125] Aiming at the shortcomings of existing deep learning models based on generation that are directly used in the field of SCADA anomaly detection, and the fact that existing methods do not consider the impact of training sample integrity on the accurate construction of detection models, this paper proposes an attack detection method for incomplete SCADA scenario multi-sensor data. The key points mainly include the following five points:

[0126] (1) Based on NCDEs, a fully connected completion network is established to heuristically repair incomplete training samples. While ensuring the integrity of the samples, it also provides relatively accurate benchmark data for the construction of subsequent anomaly detection models.

[0127] (2) For the sample windowing process at the time series level, in order to avoid the windowing behavior deviation caused by insufficient prior knowledge, WASS is used for heterogeneous SCADA data to automatically determine the learnable period, indirectly improving the model's ability to fit the control behavior distribution;

[0128] (3) Considering the lack of interpretability of internal learning of data in existing detection models, ADMM is used to guide the model to deeply understand the internal dependencies of multivariate sensor data in time and feature dimensions;

[0129] (4) The introduction of adversarial training optimizes the shortcomings of the diffusion model in the field of SCADA anomaly detection, shortens the limit of the diffusion step size in the training and detection stages, and enhances the model's ability to reconstruct sample distribution during the diffusion process.

[0130] (5) In terms of anomaly detection of SCADA multi-sensors, compared with the current large-scale research methods based on deep learning models, this detection model has the same or better detection accuracy and performance.

[0131] In order to verify the effectiveness of the proposed method, a set of experiments were conducted to compare the proposed method framework with 10 relatively advanced anomaly detection algorithms that support SCADA multi-sensor data, including the generation-based DiffAD and ImDiffusion detection methods mentioned in the background technology, in terms of detecting unknown abnormal behaviors and scenario versatility. Figure 5 The performance difference between the proposed system method and 10 comparison algorithms is demonstrated. The comparison method only uses complete training samples to build the model, while on this basis, the proposed method adds the use of completed training samples as model input for performance comparison. Obviously, this method is significantly better than other comparison algorithms in various evaluation indicators.

[0132] The present invention considers the impact of potential unsafe factors of SCADA system on the integrity of training samples, and proposes a novel method from the perspectives of sample completion and anomaly detection. Figure 4 The multi-task detection framework shown in the figure, where Task 1 corresponds to the completion network structure. Its core is to combine NCDEs with the fully connected layer to build an interpolator to achieve sample completion under different degrees of missingness and ensure the integrity of the sample input; for Task 2, WASS solves the problem of insufficient prior knowledge in the preprocessing process, and defines the window size by automatically determining the learnable period, which indirectly improves the performance of the model itself. The variant Transformer is used as the inverse solver of the conditional diffusion adversarial model, and ADDM is used to guide the model to deeply understand the dependencies between adjacent samples, so that it overcomes the shortcomings of using only the diffusion model as a detector. At the same time, adversarial training further accelerates the diffusion effect, so that the model can learn the complete sample distribution in a shorter diffusion step. For the verification effect link, from Figure 6 It can be seen that, combined with the overall analysis of the four evaluation indicators of accuracy, precision, recall rate and F1 value, the detection model proposed in the present invention can achieve better or suboptimal performance on the six data sets, while the applicability of other methods is very low, especially under the timeliness constraint of the SCADA system, it is difficult to be compatible with attack data sets containing heterogeneous and complex industrial behaviors, which proves that the present invention has great advantages and universality in detection performance.

[0133] In view of the above observations, the conditional diffusion adversarial detection model with ADMM as the training guide proposed in the present invention has higher detection performance and scenario applicability under the optimization of the designed mechanism. At the same time, relying on the above adversarial training, the model fits the normal sample behavior distribution with a shorter diffusion step size, and adapts to the target SCADA network system to establish a more accurate control behavior baseline, thereby realizing the correct identification of abnormal attack behaviors in different SCADA networks.

[0134] The above preferred implementation modes are only for illustrating the technical concept and features of the present invention, and the purpose is to enable technicians in this field to understand the content of the present invention and implement it. It cannot be used to limit the protection scope of the present invention. All equivalent changes or modifications made according to the essence of the present invention belong to the protection scope of the present invention.

Claims

1. An attack detection method for multi-sensor data in incomplete SCADA scenarios, characterized in that: The following steps are involved: Step 1: construct missing data with different missing degrees based on the original SCADA multivariate sensor data through random missing operation; set three missing degrees according to the control stage and the sensor attributes in the current control stage, namely mild missing Type IM, moderate missing Type II-M and severe missing Type III-M; Step 2: Based on the neural controlled differential equations NCDEs, a neural network model is constructed as the completion network Imputer to complete the missing data generated in step 1 and obtain the completed complete data set X s ; Step 3: Calculate the periodicity and autocorrelation ACF, establish the window adaptive selection strategy WASS, and automatically obtain the period p of multi-sensor data in the target SCADA scenario w ; Step 4: Construct a conditional diffusion adversarial detection model TCDGM with Transformer as the inverse solver. In the training and detection process, based on the adaptive dynamic mask mechanism ADMM, further enhance TCDGM's ability to fit the target distribution and guide TCDGM to learn the dependency relationship p(X em |X ob ), where X em is the observed value represented by the mask area, X ob is a known value of the unmasked area; the core of the adaptive dynamic mask mechanism ADMM is to w The windowed training input with the scale size as the benchmark is subjected to mandatory masking operation; the TCDGM model at the end of training is used as the baseline model for detecting anomalies; the input sample to be detected X D and the mask vector To the baseline model, the final detection threshold τ is obtained according to the backward diffusion process; When the difference between the input sample and the generated sample of the generator is greater than τ, it is judged as abnormal behavior; Otherwise it is normal behavior.

2. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 1, characterized in that: The mild loss Type IM is defined as the possibility of data missing due to potential safety hazards, which only occurs in the sensor detection link of any single-stage process, and the sensors will not affect each other; the moderate loss Type II-M is defined as the mutual influence between sensors at a certain stage due to potential safety factors, and has the propagation characteristics across sensors; the severe loss Type III-M is defined as the existence of cross-stage data missing in the monitoring process of multiple sensors due to relatively serious safety risks.

3. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 1 or 2, characterized in that: The step 2 is specifically as follows: Step 2.1 Dataset division; the discrete missing data to be completed is Including mild deletion Type IM, moderate deletion Type II-M, severe deletion Type III-M, t represents the time point; the training set is divided according to the established ratio and validation set Step 2.2 constructs and parameters the completion network Imputer; the completion network construction principle is shown in the following formula, where Indicated by θ f and θ h The parameterized neural network, θ f and θ h They correspond to the sub-networks constructed by different fully connected layers FC respectively. The continuous path X(t) represents the intermediate result mapped from the missing data input to the completion network Imputer. Indicates the total length of missing data; Accordingly, represents the derivative of the neural network at time t, Step 2.3 Train the completion network; combine the training set And use Huber loss to complete the parameters θ in the network f and θ h Perform training optimization and use Verify and update the above parameters until the completion model converges; the completed data set X is calculated by the completion network Imputer s .

4. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 3, characterized in that: The window adaptive selection strategy WASS is specifically as follows: Step 3.1 For Dimensional multivariate sensor samples X s , calculate the candidate cycles under each dimension DFT{x t } represents the Fourier transform of the time series sample corresponding to the current dimension; Step 3.2 Use ACF to analyze the candidate cycles Perform the test and update the candidate cycle values ​​that have passed the verification to the temporary cycle list p cde ; Indicates the use of Huber loss Adaptive solution of ; Step 3.3 Select p according to the sensor attributes of the current SCADA multivariate time series data cde After being sorted in descending order, the top-k values ​​within the specified range are taken as the final p w .

5. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 4, characterized in that: The adaptive dynamic mask mechanism ADMM is specifically: For all sensor data in the current window, select odd or even time dimensions for masking, and let the mask vector be The current time point t = {2n, 2n-1} and the sensor dimension d = {2m, 2m-1}, where 1≤n≤p w / 2 and The specific expression is as follows: Based on the mask operation of the time dimension, an odd or even sensor dimension is selected for mask operation; 6. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 5, characterized in that: The step 4 is specifically as follows: Step 4.1: Define the training sample input as The proposed TCDGM model is parameterized by combining adversarial training and diffusion principle; the TCDGM model includes a generator, a discriminator, a forward diffusion module and a backward diffusion module; Step 4.2, X s During the TCDGM training or detection process, forward diffusion is performed through the forward diffusion module. The diffusion results after T steps of noise addition are in represents the original sample without any noise added to the original input sample; in, β t represents the degree of change of noise accompanying t, I represents the diagonal matrix, represents a normal distribution, represents the noise variable obtained from the original input sample with the step size T; The training sample input is forward diffused to obtain the noise samples of adjacent steps. and Will Input to the generator G in the TCDGM model, and get By back sampling Will and Input to the discriminator D in the TCDGM model; Step 4.3: Parameterize the generator G and discriminator D in the TCDGM model; Generator On the basis of the existing Transformer, new time embedding Temb and feature embedding module Demb, feature attention FTL and time attention TTL modules are added; discriminator It is composed of multiple groups of 1D-CNN and fully connected Dense network layers with a time embedding module Temb. Respectively represent the learnable model parameters of the generator G and the discriminator D, and tp represents the size p w An ordered natural number series; under the condition of adversarial training, the generator G generates noise samples by mastering the target sample distribution Step 4.4: Backward diffusion module for the noise sample in step 4.3 Perform backward sampling, Denoising The corresponding whole denoising process is defined as: Will introduce X em and X ob The back diffusion process is defined as follows Among them, μ θ represents the mean of the denoising process, σ 2 represents the variance of the denoising process; Step 4.5 The discriminator D distinguishes the similarity between the forward diffusion samples and the backward diffusion samples within the current step, that is, and At the same time, adversarial training is used to further iterate and optimize, and its optimization goal is specifically defined as: The optimization loss corresponding to the generator G and the discriminator D is specifically expressed as: In order to ensure that the TCDGM model can improve its learning ability for the correlation between time series and sensors under mask conditions, the distance difference between masked and unmasked samples in ADMM is calculated. The specific calculation process is as follows: Here the command The optimization objective of the generator G is expressed as and The weighted sum Where λ is the weight coefficient, and the specific calculation form is: Step 4.6 The TCDGM model training process repeats steps 4.1-4.5 until the maximum number of training times is reached, or the early stopping restriction condition is met so that the training is interrupted, and the TCDGM model at the end of the training is saved as the baseline for detecting anomalies; Step 4.7 defines the TCDGM model’s judgment mechanism for abnormal behavior; based on the baseline after training optimization, input the sample to be tested X D and the mask vector A set of candidate detection thresholds are calculated from the back-diffusion process Its specific definition is: The final detection threshold τ is defined as When the difference between the input sample and the generated sample through G is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

Images