A method for attack detection for multi-sensor data in an incomplete SCADA scenario

Abstract

The application belongs to the field of industrial control network security, and discloses an attack detection method for multi-element sensor data in an incomplete SCADA scene. An interpolation network based on a neural controlled differential equation is used to repair original samples under different missing degrees; a window self-adaptive mechanism is used to solve the problem of unreasonable sample window setting in the preprocessing process without prior knowledge. An adaptive mask mechanism is proposed to guide the detection model from the input side, enhance the understanding of the dependency between time and sensor nodes, and provide a certain degree of interpretability for the model from the mechanism definition angle. In combination with adversarial training, the application defects of the original diffusion in the SCADA anomaly detection field are optimized. Compared with other filling methods, the diffusion step is greatly compressed, and the training and detection efficiency is significantly improved. Full consideration is given to the application requirements in actual production, and the multi-element sensor data anomaly detection in the heterogeneous SCADA scene can be supported without prior knowledge.

Description

Technical Field

[0001] The present invention relates to the field of industrial control network security, and in particular to an attack detection method for multi-sensor data in incomplete SCADA scenarios. Background Art

[0002] In recent years, the high frequency of attacks on industrial manufacturing enterprises has exposed the persistent problems of incomplete SCADA systems. As the situation becomes increasingly severe, a significant amount of security research has focused on detecting attacks that penetrate from the network layer to the physical layer. Traditional rule-based detection methods currently struggle to meet these requirements. However, deep learning methods based on generative models (GANs, variational autoencoders (VAEs), normalizing flows, and diffusion models (DDPMs)) have emerged as a leader in complex anomaly detection, leveraging their powerful distributed learning capabilities. However, existing deep learning methods only consider the temporal characteristics of SCADA data. While these methods achieve excellent detection results in specific, complete SCADA scenarios by leveraging their predictability and reconstruction capabilities, the limitations of specialized domain knowledge mean that when generalized prediction and reconstruction-based time series anomaly detection methods are transferred to SCADA scenarios, they still suffer from high false positives and false negatives due to the concentration of anomalies. Prediction-based methods, in particular, struggle to avoid the impact of prediction bias, while reconstruction-based methods offer greater flexibility and adaptability in learning sample distributions. At the same time, the system is unpredictable and inherent potential security threats (such as misconfiguration, latent network or application viruses, equipment switching caused by failures, etc.) can easily destroy the integrity of samples. This will directly lead to irregular or missing data collected during the system operation, making it impossible for the model to accurately establish the corresponding detection baseline from incomplete input samples.

[0003] For the aforementioned generative models, although training based on GANs is unstable, adversarial approaches can maximize the model's fit to the sample distribution. Flow-based methods focus on modeling the sample distribution by establishing a strictly reversible transformation between the sample input and the reconstructed output. However, conventional neural networks struggle to construct such a mapping, limiting their application in real-world scenarios. The trade-off between approximate posterior representations and computational cost in VAEs affects their performance in real-world scenarios. To address these limitations, DDPMs-based methods utilize forward and backward diffusion to denoise and restore sample data, enabling the model to grasp the distribution of training samples. While the step size of the diffusion process depends on the sample distribution and model structure, this research area and its downstream tasks have attracted attention due to their excellent interpretability. Furthermore, the fact that the latent variables share the same dimensionality as the input makes this a significant research direction. Despite their respective strengths, these methods still have some limitations in matching the actual target distribution. In other words, these models are not always compatible with these manageable target distributions.

[0004] The paper "Xiao C, Gou Z, Tai W, et al. Imputation-based time-series anomaly detection with conditional weight-incremental diffusion models[C] / / Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and DataMining. 2023:2742-2751." proposes an anomaly detection method, DiffAD, from the perspective of time series interpolation. This method uses part or all of the data as observation samples for model estimation or learning the target sample distribution. It utilizes a density strategy to flexibly select normal observation points, making the model more suitable for scenarios with concentrated anomalies. Furthermore, to enhance the model's sensitivity to anomaly concentration, it proposes an interpolation-based conditional weighted incremental diffusion detection method. Furthermore, it uses a multi-scale state-space model as a solver to capture long-term dependencies across different modes. This method maximizes the preservation of observation information, significantly improves sample generation quality, and achieves stable anomaly detection. Experimental results demonstrate that the method outperforms current state-of-the-art methods on real-world data. Although this method achieved good test results in the detection phase, the framework was designed and implemented from the perspective of general anomaly detection, and has significant performance limitations when applied to different SCADA scenarios. The proposed model can only grasp the temporal distribution from the perspective of learning long-term dependencies. For SCADA multi-sensor data, short-cycle detection can meet the timeliness requirements of the system. At the same time, the diffusion model's own diffusion step length is too long, which also leads to extended model training and detection time. In the data preprocessing stage before training, a fixed window size is used for all data. However, for sensor data with different control behavior complexities, unreasonable windowing operations are likely to affect the model's understanding of the original data distribution.

[0005] The paper "Chen Y, Zhang C, Ma M, et al. Imdiffusion: Imputed diffusion models for multivariate time series anomaly detection[J].arXiv preprint arXiv:2307.00754,2023." proposes a framework for anomaly detection in multivariate time series data that combines time series interpolation and diffusion models. This framework leverages neighboring information in the time series data to enable the model to accurately grasp temporal and internal dependencies, reducing uncertainty in the data and thus enhancing the robustness of anomaly detection. Furthermore, the diffusion model is further utilized as a time series data interpolator, enabling the framework to capture complex dependencies. The denoised output generated by the model during inference is used as a metric for anomaly prediction, improving the accuracy and robustness of the detection process. Experimental evaluations on baseline data demonstrate that this framework outperforms state-of-the-art methods in terms of detection accuracy and timeliness. Although this method demonstrates the advantages of diffusion-based generative models in anomaly detection compared to GANs, Transformer, and LSTM-based methods that rely solely on reconstruction or prediction characteristics, the disadvantages of directly applying diffusion methods to SCADA multi-sensor data remain prominent. Although the mask mechanism proposed in this article is used to guide the model to learn internal dependencies, it still focuses on long-term dependencies as a whole and cannot grasp short-term dependencies well. It cannot adaptively perform windowed learning based on the characteristics of heterogeneous data. At the same time, the scale setting of the diffusion step size is fixed and the value is large. The above factors greatly affect the timeliness of the overall framework during training and detection, which also leads to certain detection limitations when it comes to compatibility with sensor data from different scenarios.

[0006] In summary, the direct application of existing generative model-based methods in the field of anomaly detection of SCADA multi-sensor data still faces certain challenges that need to be optimized, mainly including the reasonable setting of windowing for heterogeneous data, the optimization of diffusion step size, and the degree of grasp of short-cycle distribution by the model. More importantly, the existing detection methods do not take into account the impact of potential system security issues on the integrity of input samples, that is, there is a certain degree of missing in the monitored data, which makes it difficult to effectively build the model. Summary of the Invention

[0007] The purpose of this paper is to propose an attack detection method for incomplete multi-sensor data in SCADA scenarios. This method constructs a conditional diffusion adversarial detection model using a Transformer as an inverse solver, while ensuring the integrity of training data. The model is adaptively compatible with multi-sensor data from different SCADA scenarios, enabling effective detection of underlying abnormal behavior in industrial sites.

[0008] The technical solution of the present invention is as follows: an attack detection method for multi-sensor data in incomplete SCADA scenarios, comprising the following steps:

[0009] Step 1: Missing data with different degrees of missingness are constructed based on the original SCADA multivariate sensor data through random missing operations. Three missingness degrees are set according to the control stage and the sensor attributes in the current control stage, namely mild missingness Type IM, moderate missingness Type II-M, and severe missingness Type III-M.

[0010] Step 2: Based on the neural controlled differential equations NCDEs, a neural network model is constructed as the completion network Imputer to complete the missing data generated in step 1 and obtain the completed complete data set X s ;

[0011] Step 3: Calculate the periodicity P and autocorrelation ACF, establish the window adaptive selection strategy WASS, and automatically obtain the periodicity p of multi-sensor data in the target SCADA scenario w ;

[0012] Step 4: Construct a conditional diffusion adversarial detection model TCDGM with Transformer as the inverse solver. During the training and detection process, based on the adaptive dynamic mask mechanism ADMM, further enhance TCDGM's ability to fit the target distribution and guide TCDGM to learn the dependency relationship p(X em |X ob ), where X em is the observed value represented by the mask area, X ob is a known value of the unmasked area; the core of the adaptive dynamic mask mechanism ADMM is to w The windowed training input with the scale size as the benchmark is subjected to mandatory masking operation; the TCDGM model at the end of training is used as the baseline model for detecting anomalies; the input sample to be detected X D and the mask vector To the baseline model, the final detection threshold τ is obtained according to the backward diffusion process; when the difference between the input sample of the generator and the generated sample is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

[0013] Furthermore, the mild loss Type IM is defined as the possibility of data loss due to potential safety hazards, which only occurs in the sensor detection link of any single-stage process and does not affect each other between sensors; the moderate loss Type II-M is defined as the mutual influence between sensors in a certain stage due to potential safety factors, which has the propagation characteristic of cross-sensors; the severe loss Type III-M is defined as the existence of cross-stage data loss in the monitoring process of multiple sensors due to relatively serious safety risks.

[0014] Furthermore, the step 2 is specifically as follows:

[0015] Step 2.1 Dataset division; the discrete missing data to be completed is Including mild deletion Type IM, moderate deletion Type II-M, severe deletion Type III-M, t represents the time point; the training set is divided according to the established ratio and validation set

[0016] Step 2.2: Construct and parameterize the completion network Imputer. The construction principle of the completion network is shown in the following formula: Indicated by θ f and θ h The parameterized neural network, θ f and θ h They correspond to the sub-networks constructed by different fully connected layers FC, and the continuous path X(t) represents the intermediate result mapped from the missing data input to the completion network Imputer. Indicates the entire length of missing data;

[0017]

[0018] Accordingly, represents the derivative of the neural network at time t,

[0019]

[0020] Step 2.3: Train the completion network; combine the training set And use Huber loss to complete the parameters θ in the network f and θ h Perform training optimization and use Verify and update the above parameters until the completion model converges; the completed data set X is calculated by the completion network Imputer s .

[0021] Furthermore, the window adaptive selection strategy WASS is specifically as follows:

[0022] Step 3.1 For Dimensional multivariate sensor samples X s , calculate the candidate cycles under each dimension

[0023]

[0024] DFT{x t} represents the Fourier transform of the time series sample corresponding to the current dimension;

[0025] Step 3.2 Use ACF to analyze the candidate cycles Perform the test and update the candidate cycle values ​​that have passed the verification to the temporary cycle list p cde ;

[0026]

[0027]

[0028] Indicates the use of Huber loss to Adaptive solution of ;

[0029] Step 3.3 Select p according to the sensor attributes of the current SCADA multivariate time series data edde After sorting in descending order, the top-k values ​​within the specified range are used as the final p w .

[0030] Furthermore, the adaptive dynamic mask mechanism ADMM is specifically as follows:

[0031] For all sensor data in the current window, select odd or even time dimensions for mask operation, and let the mask vector be The current time point t = {2n, 2n-1} and the sensor dimension d = {2m, 2m-1}, where 1≤n≤p w / 2 and The specific expression is as follows:

[0032]

[0033] Based on the mask operation of the time dimension, the odd or even sensor dimensions are selected for mask operation;

[0034]

[0035] Furthermore, the step 4 is specifically as follows:

[0036] Step 4.1, define the training sample input as The proposed TCDGM model is parameterized by combining adversarial training and diffusion principle; the TCDGM model includes a generator, a discriminator, a forward diffusion module and a backward diffusion module;

[0037] Step 4.2, X S During the TCDGM training or detection process, forward diffusion is performed through the forward diffusion module. The diffusion results after T steps of noise addition are in represents the original input sample without any noise added;

[0038]

[0039] in,

[0040]

[0041] β t represents the degree of change of noise with t, I represents the diagonal matrix, represents a normal distribution, represents the noise variable obtained from the original input sample with the step size T;

[0042] The training sample input is forward diffused to obtain the noise samples of adjacent steps. and Will Input to the generator G in the TCDGM model, and get Obtained by backward sampling Will and Input to the discriminator D in the TCDGM model;

[0043] Step 4.3, parameterize the generator G and discriminator D in the TCDGM model; Generator On the basis of the existing Transformer, new time embedding Temb and feature embedding module Demb, feature attention FTL and time attention TTL modules are added; discriminator It is composed of multiple groups of 1D-CNN and fully connected Dense network layers with a time embedding module Temb, θ and Represent the learnable model parameters of the generator G and the discriminator D respectively, and tp represents the size p w An ordered natural number series; under the condition of adversarial training, the generator G generates noise samples by mastering the target sample distribution

[0044] Step 4.4: Backward diffusion module processes the noise sample in step 4.3. Perform backward sampling, Denoising The corresponding entire denoising process is defined as:

[0045]

[0046] Will introduce X em and X ob The backward diffusion process is defined as follows:

[0047]

[0048] Among them, μ θ represents the mean of the denoising process, σ 2 represents the variance of the denoising process;

[0049] Step 4.5: The discriminator D identifies the similarity between the forward diffusion samples and the backward diffusion samples within the current step, i.e. and At the same time, adversarial training is used to further iterate and optimize, and its optimization goal is specifically defined as:

[0050]

[0051] The optimization loss corresponding to the generator G and the discriminator D is specifically expressed as:

[0052]

[0053] In order to improve the TCDGM model's ability to learn the correlation between time series and sensors under mask conditions, a method is defined to calculate the distance difference between masked and unmasked samples under ADMM. The specific calculation process is as follows:

[0054]

[0055] Here the command The optimization objective of the generator G is expressed as and The weighted sum of Where λ is the weight coefficient, and the specific calculation form is:

[0056]

[0057] Step 4.6: Repeat steps 4.1-4.5 until the maximum number of training runs is reached, or the early stopping condition is met, resulting in training interruption. The TCDGM model at the end of training is saved as the baseline for anomaly detection.

[0058] Step 4.7 defines the TCDGM model’s mechanism for determining abnormal behavior; based on the baseline after training optimization, input the sample to be tested X D and the mask vector Compute a set of candidate detection thresholds from the backward diffusion process Its specific definition is:

[0059]

[0060] The final detection threshold τ is defined as When the difference between the input sample and the generated sample of G is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

[0061] The beneficial effects of the present invention are as follows: (1) Considering the impact of potential security factors on the integrity of multi-sensor data, an interpolation network based on neural controlled differential equations (NCDEs) is proposed to repair the original samples with different degrees of missingness, laying a relatively accurate premise for subsequent model construction. (2) A window adaptive mechanism is proposed to solve the problem of unreasonable sample window setting in the preprocessing process without prior knowledge. This effectively avoids the trial and error time of window setting and is more in line with the timeliness requirements of SCADA scenarios. (3) An adaptive mask mechanism is proposed to guide the detection model from the input side, enhance the understanding of the dependency between time and sensor nodes, and provide a certain degree of interpretability for the model from the perspective of mechanism definition. (4) Based on the existing diffusion model, combined with adversarial training, the application defects of native diffusion in the field of SCADA anomaly detection are optimized. Compared with other filling methods, the diffusion step size is greatly compressed, which significantly improves the training and detection efficiency. (5) Taking full consideration of the application needs in actual production, it can support multi-sensor data anomaly detection in heterogeneous SCADA scenarios without prior knowledge. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This is the anomaly detection flow chart under the incomplete SCADA system;

[0063] Figure 2 This is a sample diagram of different degrees of sample missing in an incomplete SCADA system;

[0064] Figure 3 is the dependency graph of multivariate sensory data within a specific window under mask conditions;

[0065] Figure 4 This is a diagram of the anomaly detection framework for incomplete SCADA systems;

[0066] Figure 5 Figure 2 is the network model structure diagram of the generator G and discriminator D in the anomaly detection model; (a) is the generator, (b) is the discriminator;

[0067] Figure 6Figure 2 shows the attack detection effect under different SCADA data sets. DETAILED DESCRIPTION

[0068] The specific implementation of the present invention is further described in detail below with reference to the accompanying drawings and examples.

[0069] This embodiment uses 6 public multivariate sensor data sets in different SCADA industrial scenarios to verify the model. The data names are SWAT, BATADAL, WADI, HAI20.07, HAI21.03 and HAI22.04. The training set and test set of the above data are separate CSV files. The SWAT data set contains 7 days of normal monitoring, 4 days of 36 simulated attacks, and the abnormality rate of the test set is 11.98%; the abnormality rate of the BATADAL test set is 8.47%; WADI contains 14 days of normal data and 2 days of simulated attacks, and the abnormality rate of the test set is 5.99%; the HAI20.07, HAI21.03 and HAI22.04 test sets contain 38, 50 and 58 attack types respectively. An attack detection method for incomplete SCADA scenario multivariate sensor data, reference Figure 1 As shown, the processing flow of the attack detection method involved in the present invention includes the following steps:

[0070] Step 1: Use random missing operation to construct sample inputs with different missing degrees based on the original SCADA multivariate sensor data, such as Figure 2 As shown in the figure, three missing degrees are set according to the control stage and stage sensor attributes, where the corresponding missing proportions are 20% and 80%. The specific steps are:

[0071] Step 1.1: Due to potential safety hazards, data loss may occur. This type of loss only occurs in the sensor detection link of any single-stage process, and the sensors do not affect each other, that is, mild loss Type IM.

[0072] In step 1.2, due to potential safety factors, sensors are affected by each other at a certain stage, which has the propagation characteristics across sensors, that is, moderate loss Type II-M.

[0073] The relatively serious safety risks in step 1.3 result in data loss across stages during the monitoring process of the multi-sensor system, which is severe loss Type III-M.

[0074] Step 2: Combine the neural network model based on neural controlled differential equations (NCDEs) as the completion network Imputer to complete the missing data generated in step 1. The specific steps are as follows:

[0075] Step 2.1 Dataset division. Let the discrete missing sample data to be completed be That is, Type I, II, III-M, where t represents the time point. The training set is divided according to the established ratio and validation set

[0076] Step 2.2 Parameterize the Imputer completion network. As shown in the following formula, Indicates that due to the parameter θ f and θ h The constructed neural network has two parameters corresponding to different fully connected layers FC, and the continuous path X(t) represents the intermediate result mapped after the missing sample is input into Imputer. Indicates the length of the entire input time. The specific calculation formula is as follows:

[0077]

[0078] Accordingly,

[0079]

[0080] Step 2.3: Train the Imputer network. Combined with the training input And use Huber loss to adjust the parameters θ in the Imputer network f and θ h Perform training optimization and use Verify and update the above parameters until the completion model converges.

[0081] Step 2.3 The complete dataset X is obtained by Imputer network calculation s , thus ensuring the integrity of the multi-sensor sample.

[0082] Step 3: Establish window adaptive selection strategy WASS, through periodic The autocorrelation ACF formula is used to automatically obtain the period size p of multi-sensor data in the target SCADA scenario. w ,The specific calculation formula is as follows, where k, t∈[0, N-1], which provides a reasonable sample preprocessing basis for subsequent training of anomaly detection models.

[0083]

[0084] in,

[0085]

[0086] The specific steps include:

[0087] Step 3.1 For Dimensional multivariate sensor samples X s , calculate the candidate cycles under each dimension

[0088] Step 3.2 Use ACF to analyze the candidate cycles Verify and update the verified values ​​to the temporary period list p cde .

[0089] Step 3.3 Select p based on the prior information of the current SCADA sensor data cde After sorting in descending order, the value of Top-k∈[10,50] in the specified range is taken as the final p w .

[0090] In step 3.4, for the six data sets, the corresponding window sizes are calculated in steps 3.1-3.4 as {26, 15, 24, 12, 46, 17} respectively.

[0091] Step 4: Construct a conditional diffusion adversarial detection model TCDGM with Transformer as the inverse solver. During the training and detection process, based on the adaptive dynamic mask mechanism ADMM, further enhance TCDGM's ability to fit the target distribution and guide TCDGM to learn the dependency relationship p(X em |X ob ), where X em is the observed value represented by the mask area, X ob is the known value of the unmasked area, that is The entire detection model framework is as follows Figure 4 shown.

[0092] The core of the adaptive dynamic mask mechanism ADMM is to w The windowed training input with the scale size as the benchmark is subjected to mandatory masking operation; the TCDGM model at the end of training is used as the baseline model for detecting anomalies; the input sample to be detected X D and the mask vector To the baseline model, the final detection threshold τ is obtained according to the backward diffusion process; when the difference between the input sample of the generator and the generated sample is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

[0093] The adaptive dynamic mask mechanism ADMM is used to enhance the model’s understanding of the potential dependencies between sensor distributions during training and detection. w The scale-based windowed training input is forced to perform masking. Let the mask vector be The current time point t = {2n, 2n-1}} and the sensor dimension d = {2m, 2m-1}, where 1≤n≤p w / 2 and

[0094] For all sensor data in the current window, select odd or even time dimensions for masking, corresponding to Figure 3 Patte r n I and II, the specific expressions are as follows.

[0095]

[0096] Based on the above mask, select odd or even sensor dimensions for mask operation, corresponding to Figure 3 Sub-p1 and Sub-p2 in.

[0097]

[0098] Step 4.1 defines the training sample input as The proposed detection model is parameterized by combining adversarial training and diffusion principle.

[0099] Step 4.2 Input sample X s Forward diffusion is performed during the model operation, and the diffusion results after T steps of noise addition are in Represents the original sample without any noise. s The specific process is as follows:

[0100]

[0101] in,

[0102]

[0103] Here β t Indicates the degree of change of noise with t, the noise samples of adjacent steps and Used for Figure 5 The input of the generator G and the discriminator D.

[0104] Step 4.3 parameterizes the generator G and discriminator D in the model. Figure 5 As shown in It is composed of a Transformer with time and feature attention. It consists of multiple sets of 1D-CNN networks with temporal embedding, θ and Represent the learnable model parameters of networks G and D respectively, and tp represents the size p wThe ordered natural number series, correspondingly, under the condition of adversarial training, the samples generated by G by mastering the target sample distribution are expressed as

[0105] Step 4.4 uses TCDGM to perform backward sampling on the noise samples in step 4.3, that is, Denoising The corresponding entire denoising process is defined as:

[0106]

[0107] Introducing X em and X ob The backward diffusion process is defined as:

[0108]

[0109] Among them, μ θ and σ 2 denote the mean and variance of the denoising process respectively.

[0110] Step 4.5 uses the discriminator D to identify the similarity between the forward diffusion and backward diffusion samples within the current step, that is, and At the same time, adversarial training is used to further iterate and optimize, and its optimization goal is specifically defined as:

[0111]

[0112] To facilitate understanding of the model adversarial training method, the optimization loss of the corresponding generator G and discriminator D can be specifically expressed as:

[0113]

[0114] The optimization loss is redefined to calculate the distance difference between masked and unmasked samples under ADMM. This is mainly to improve the model's ability to learn the correlation between time series and sensors under mask conditions. The specific process is defined as:

[0115]

[0116] Correspondingly, the loss of the generator G is also updated as It is expressed as and The weighted sum of , where λ is the weight coefficient, is expressed as:

[0117]

[0118] Here, for the six data sets, the weight coefficients are set as follows:

[0119] {λ SWAT,BATADAL : 0.5, λ WADI : 0.2, λ HAI20.07 : 0.4, λ HAI21.03 : 1.0, λ HAI22.04 :0.9}

[0120] {T SWAT :4,T BATADAL,HAI20.07 , HAI22.04 :8,T WADI,HAI21.03 :10}

[0121] Step 4.6: The model training process repeats steps 4.1-4.5 until the maximum number of training times is reached, or the early stopping constraint is met so that training is interrupted, and the baseline model is saved.

[0122] Step 4.7 defines the model’s judgment mechanism for abnormal behavior. Based on the trained and optimized baseline model, input the sample to be tested X D and the mask vector From the backward diffusion process, a set of candidate detection thresholds can be calculated Its specific definition is:

[0123]

[0124] The final detection threshold τ is defined as If the difference between the input sample and the generated sample through G is greater than τ, it is considered abnormal behavior; otherwise, it is considered normal behavior.

[0125] In response to the shortcomings of existing generation-based deep learning models in directly applying them to SCADA anomaly detection, as well as the fact that existing methods do not consider the impact of training sample integrity on the accurate construction of detection models, this paper proposes an attack detection method for incomplete multi-sensor data in SCADA scenarios. The key points include the following five points:

[0126] (1) Based on NCDEs, a fully connected completion network is established to heuristically repair incomplete training samples. While ensuring the integrity of the samples, it provides relatively accurate benchmark data for the construction of subsequent anomaly detection models.

[0127] (2) For the sample windowing processing at the time series level, in order to avoid the windowing behavior deviation caused by insufficient prior knowledge, WASS is used to automatically determine the learnable period for heterogeneous SCADA data, indirectly improving the model's ability to fit the control behavior distribution;

[0128] (3) Considering the lack of interpretability of existing detection models for internal data learning, ADMM is used to guide the model to deeply understand the internal dependencies of multivariate sensor data in time and feature dimensions;

[0129] (4) The introduction of adversarial training optimizes the shortcomings of the diffusion model in the field of SCADA anomaly detection, shortens the limit of the diffusion step size in the training and detection stages, and enhances the model's ability to reconstruct the sample distribution during the diffusion process.

[0130] (5) In terms of anomaly detection of SCADA multi-sensor systems, compared with the current large-scale research methods based on deep learning models, this detection model has the same or better detection accuracy and performance.

[0131] In order to verify the effectiveness of the proposed method, a set of experiments were conducted to compare the proposed method framework with 10 relatively advanced anomaly detection algorithms that support SCADA multi-sensor data, including the generation-based DiffAD and ImDiffusion detection methods mentioned in the background technology, in terms of detecting unknown abnormal behaviors and scenario versatility. Figure 5 The performance differences between the proposed system method and 10 comparison algorithms are demonstrated. The comparison method only uses complete training samples to build the model, while the proposed method adds the completed training samples as model input for performance comparison. Obviously, this method is significantly better than other comparison algorithms in various evaluation indicators.

[0132] This paper considers the impact of potential unsafe factors of SCADA system on the integrity of training samples, and proposes a method based on the two practical needs of sample completion and anomaly detection. Figure 4 The multi-task detection framework shown in the figure, where Task 1 corresponds to the completion network structure, the core of which is to combine NCDEs with fully connected layers to build an interpolator to achieve sample completion under different degrees of missingness and ensure the integrity of the sample input; for Task 2, WASS solves the problem of insufficient prior knowledge in the preprocessing process, and indirectly improves the performance of the model itself by automatically determining the learnable period to define the window size. The variant Transformer is used as the inverse solver of the conditional diffusion adversarial model, and ADDM is used to guide the model to deeply understand the dependencies between adjacent samples, so that it overcomes the shortcomings of using only the diffusion model as a detector. At the same time, adversarial training further accelerates the diffusion effect, so that the model can learn the complete sample distribution in a shorter diffusion step. As for the verification effect link, from Figure 6 It can be seen from the results that, based on the overall analysis of the four evaluation indicators of accuracy, precision, recall rate, and F1 value, the detection model proposed in the present invention can achieve better or suboptimal performance on the six data sets, while the applicability of other methods is very low. In particular, under the timeliness constraints of the SCADA system, it is difficult to be compatible with attack data sets containing heterogeneous and complex industrial behaviors, which proves that the present invention has great advantages and universality in detection performance.

[0133] In view of the above observations, the conditional diffusion adversarial detection model with ADMM as the training guide proposed in the present invention has high detection performance and scenario applicability under the optimization of the designed mechanism. At the same time, relying on the above adversarial training, the model fits the normal sample behavior distribution with a shorter diffusion step size, and adapts to the target SCADA network system to establish a more accurate control behavior baseline, thereby realizing the correct identification of abnormal attack behaviors in different SCADA networks.

[0134] The above preferred embodiments are only for illustrating the technical concept and features of the present invention, and the purpose is to enable technicians in this field to understand the content of the present invention and implement it. It cannot be used to limit the scope of protection of the present invention. Any equivalent changes or modifications made according to the essence of the present invention fall within the scope of protection of the present invention.

Claims

1. An attack detection method for incomplete SCADA scenario multi-sensor data, characterized by: The following steps are involved: Step 1: Missing data with different degrees of missingness are constructed based on the original SCADA multivariate sensor data through random missing operations. Three missingness degrees are set according to the control stage and the sensor attributes in the current control stage, namely mild missingness Type IM, moderate missingness Type II-M, and severe missingness Type III-M. Step 2: Based on the neural controlled differential equations NCDEs, a neural network model is constructed as the completion network Imputer to complete the missing data generated in step 1 and obtain the completed complete data set X s ; Step 3: Calculate the periodicity and autocorrelation ACF, establish the window adaptive selection strategy WASS, and automatically obtain the period p of multi-sensor data in the target SCADA scenario w ; Step 4: Construct a conditional diffusion adversarial detection model TCDGM with Transformer as the inverse solver. During the training and detection process, based on the adaptive dynamic mask mechanism ADMM, further enhance TCDGM's ability to fit the target distribution and guide TCDGM to learn the dependency relationship p(X em |X ob ), where X em is the observed value represented by the mask area, X ob is a known value of the unmasked area; the core of the adaptive dynamic mask mechanism ADMM is to w The windowed training input with the scale size as the benchmark is subjected to mandatory masking operation; the TCDGM model at the end of training is used as the baseline model for detecting anomalies; the input sample to be detected X D and the mask vector To the baseline model, the final detection threshold τ is obtained according to the backward diffusion process; When the difference between the generator’s input sample and the generated sample is greater than τ, it is considered abnormal behavior; Otherwise it is normal behavior.

2. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 1, characterized in that: The mild loss type IM is defined as the possibility of data loss due to potential safety hazards, which only occurs in the sensor detection link of any single-stage process and does not affect each other between sensors; the moderate loss type II-M is defined as the mutual influence between sensors in a certain stage due to potential safety factors, which has the characteristic of cross-sensor propagation; the severe loss type III-M is defined as the existence of cross-stage data loss in the monitoring process of multiple sensors due to relatively serious safety risks.

3. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 1 or 2, characterized in that: The step 2 is specifically as follows: Step 2.1 Dataset division; the discrete missing data to be completed is Including mild deletion Type IM, moderate deletion Type II-M, severe deletion Type III-M, t represents the time point; the training set is divided according to the established ratio and validation set Step 2.2: Construct and parameterize the completion network Imputer. The construction principle of the completion network is shown in the following formula: Indicated by θ f and θ h The parameterized neural network, θ f and θ h They correspond to the sub-networks constructed by different fully connected layers FC, and the continuous path X(t) represents the intermediate result mapped from the missing data input to the completion network Imputer. Indicates the entire length of missing data; Accordingly, represents the derivative of the neural network at time t, Step 2.3: Train the completion network; combine the training set And use Huber loss to complete the parameters θ in the network f and θ h Perform training optimization and use Verify and update the above parameters until the completion model converges; the completed data set X is calculated by the completion network Imputer s .

4. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 3, characterized in that: The window adaptive selection strategy WASS is specifically as follows: Step 3.1 For Dimensional multivariate sensor samples X s , calculate the candidate cycles under each dimension DFT{x t } represents the Fourier transform of the time series sample corresponding to the current dimension; Step 3.2 Use ACF to analyze the candidate cycles Perform the test and update the candidate cycle values ​​that have passed the verification to the temporary cycle list p cde ; Indicates the use of Huber loss to Adaptive solution of ; Step 3.3 Select p according to the sensor attributes of the current SCADA multivariate time series data cde After sorting in descending order, the top-k values ​​within the specified range are used as the final p w .

5. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 4, characterized in that: The adaptive dynamic mask mechanism ADMM is specifically as follows: For all sensor data in the current window, select odd or even time dimensions for mask operation, and let the mask vector be The current time point t = {2n, 2n-1} and the sensor dimension d = {2m, 2m-1}, where 1≤n≤p w / 2 and The specific expression is as follows: Based on the mask operation of the time dimension, the odd or even sensor dimensions are selected for mask operation; 6. The attack detection method for incomplete SCADA scenario multi-sensor data according to claim 5, characterized in that: The step 4 is specifically as follows: Step 4.1, define the training sample input as The proposed TCDGM model is parameterized by combining adversarial training and diffusion principle; the TCDGM model includes a generator, a discriminator, a forward diffusion module and a backward diffusion module; Step 4.2, X s During the TCDGM training or detection process, forward diffusion is performed through the forward diffusion module. The diffusion results after T steps of noise addition are in represents the original input sample without any noise added; in, β t represents the degree of change of noise with t, I represents the diagonal matrix, represents a normal distribution, represents the noise variable obtained from the original input sample with the step size T; The training sample input is forward diffused to obtain the noise samples of adjacent steps. and Will Input to the generator G in the TCDGM model, and get Obtained by backward sampling Will and Input to the discriminator D in the TCDGM model; Step 4.3, parameterize the generator G and discriminator D in the TCDGM model; Generator On the basis of the existing Transformer, new time embedding Temb and feature embedding module Demb, feature attention FTL and time attention TTL modules are added; discriminator It is composed of multiple groups of 1D-CNN and fully connected Dense network layers with a time embedding module Temb, θ and Represent the learnable model parameters of the generator G and the discriminator D respectively, and tp represents the size p w An ordered natural number series; under the condition of adversarial training, the generator G generates noise samples by mastering the target sample distribution Step 4.4: Backward diffusion module processes the noise sample in step 4.

3. Perform backward sampling, Denoising The corresponding entire denoising process is defined as: Will introduce X em and X ob The backward diffusion process is defined as follows Among them, μ θ represents the mean of the denoising process, σ 2 represents the variance of the denoising process; Step 4.5 The discriminator D identifies the similarity between the forward diffusion samples and the backward diffusion samples within the current step, that is, and At the same time, adversarial training is used to further iterate and optimize, and its optimization goal is specifically defined as: The optimization loss corresponding to the generator G and the discriminator D is specifically expressed as: In order to improve the TCDGM model's ability to learn the correlation between time series and sensors under mask conditions, a method is defined to calculate the distance difference between masked and unmasked samples under ADMM. The specific calculation process is as follows: Here the command The optimization objective of the generator G is expressed as and The weighted sum of Where λ is the weight coefficient, and the specific calculation form is: Step 4.6: Repeat steps 4.1-4.5 until the maximum number of training runs is reached, or the early stopping condition is met, resulting in training interruption. The TCDGM model at the end of training is saved as the baseline for anomaly detection. Step 4.7 defines the TCDGM model’s mechanism for determining abnormal behavior; based on the baseline after training optimization, input the sample to be tested X D and the mask vector Compute a set of candidate detection thresholds from the backward diffusion process Its specific definition is: The final detection threshold τ is defined as When the difference between the input sample and the generated sample of G is greater than τ, it is judged as abnormal behavior; otherwise, it is normal behavior.

Images