Integrated anomaly prediction and detection algorithm and system based on graph neural network

Abstract

The invention belongs to the crossing field of chemical plant equipment anomaly detection and Internet network security, and particularly relates to a chemical Internet integrated anomaly prediction and detection algorithm and system based on a graph neural network. The algorithm comprises the following steps: step 1, acquiring initial network service data and chemical plant data; step 2, constructing a mapping relation based on the network service data and the chemical plant data; 3, constructing a simplified matrix sequence by using a double-time window technology; 4, constructing a simplified graph based on the simplified matrix in the step 3; 5, extracting a corresponding simplified graph vector from the simplified graph based on a graph neural network; and the like. The system can integrally solve the problems of abnormity caused by aging of chemical plant equipment and the like, network attack of the chemical plant, subsequent corresponding chemical equipment damage and the like, can also solve the safety problem of the combined part of the chemical plant and the Internet, and predicts the safety problem while detecting the safety problem.

Description

Technical Field

[0001] The present invention belongs to the intersection of chemical plant equipment anomaly detection and Internet network security, and particularly relates to a chemical Internet integrated anomaly prediction and detection algorithm and system based on graph neural network. Background Art

[0002] As the Internet and chemical production become increasingly integrated, chemical production has entered a new stage of development. The Internet has fully connected people, machines, and objects in chemical production, realizing the digitization, networking, and intelligence of chemical production, and also increasing the possibility of chemical production being attacked by the outside world. In order to ensure the security of the chemical Internet, an effective chemical Internet integrated anomaly prediction and detection algorithm and system is needed.

[0003] Traditional Internet security mainly deals with various offensive behaviors launched by cyber attackers using Internet vulnerabilities against computer information systems, infrastructure, computer networks or personal devices. Researchers usually extract network traffic and log data into traceability graphs and other forms, and use methods such as autoencoders and neural networks to identify suspicious network activities. Traditional Internet security can solve the problem of network attacks, but cannot deal with abnormal problems caused by aging chemical plant equipment.

[0004] Traditional chemical plant anomaly detection aims to deal with security threats caused by factors such as equipment aging during the production process, and to ensure safe production by identifying equipment observations that do not meet expectations. Researchers usually use statistical methods to calculate the distance between data points and distributions to identify anomalies or use technologies such as support vector machines (SVM) and neural networks to detect anomalies by learning data features. Traditional chemical plant anomaly detection can solve anomaly problems caused by aging of chemical plant equipment, but it cannot detect cyber attacks against chemical plants and subsequent damage to chemical equipment in a timely manner.

[0005] The scenarios in the field of abnormality detection of chemical plant equipment and the field of Internet network security are quite different. Currently, there is an urgent need for a method that can integrate the abnormal problems caused by aging of chemical plant equipment, network attacks against chemical plants, and subsequent corresponding damage to chemical equipment. In this way, the abnormality detection of chemical plant equipment and Internet network security can be linked together, so as to achieve the solution of the safety problems of chemical plants and Internet security, and further solve the security problems of the combination of chemical plants and the Internet, and predict security problems while detecting them. Summary of the invention

[0006] The main technical problem that the present invention solves is that the scenarios in the field of abnormality detection of chemical plant equipment and the field of Internet network security are quite different. Currently, there is no method that can comprehensively solve the abnormal problems caused by aging of chemical plant equipment, network attacks on chemical plants, and subsequent corresponding damage to chemical equipment. There is also no method that can solve the security problems of the combination of chemical plants and the Internet, and predict security problems while detecting them.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: An integrated anomaly prediction and detection algorithm based on graph neural network includes the following steps: Step 1: Get initial network service data and chemical plant data: Network service data collection, using network probes to capture data packets in real time and extract information from the data packets, including host IP, network entity type, host behavior, and network entity behavior type; Chemical plant data collection uses temperature sensors, air pressure sensors, etc. to perform real-time detection of the temperature, pressure, liquid level of the reactor and the temperature and pressure of the pipeline, while identifying the type of chemical production equipment and material behavior type.

[0008] Step 2, based on the network service data and the chemical plant data, construct a mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID; Step 3, constructing a simplified matrix sequence using dual time window technology and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and its ID; Step 4, constructing a simplified graph based on the simplified matrix described in step 3; The simplified graph includes: entity type nodes, behavior type nodes and edges. The network entity types and the chemical production equipment types in the simplified matrix constitute entity type nodes in the simplified graph; The network entity behavior type and the material behavior type connecting two entity node types in the simplified matrix constitute a behavior type node in the simplified graph; The connection between the entity type node and the behavior type node constitutes an edge in the simplified graph.

[0009] Step 5, extracting a corresponding simplified graph vector from the simplified graph based on a graph neural network; Step 6: Based on the simplified matrix sequence described in step 3 as training data, a simplified graph matrix prediction model is obtained: Step 7: Obtain an anomaly detection model based on the simplified graph as training data, and detect data anomalies in each time slice based on the anomaly detection model.

[0010] An integrated anomaly prediction and detection system based on graph neural network includes: a data acquisition and processing module, a simplified matrix prediction module and an anomaly detection module.

[0011] The data acquisition and processing module obtains initial network service data and chemical plant data, and constructs a mapping relationship between network entity type and network entity type ID, network entity behavior type and network entity behavior type ID, chemical production equipment type and chemical production equipment type ID, and material behavior type and material behavior type ID based on the network service data and chemical plant data; constructs a simplified matrix sequence using the dual time window technology and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and their IDs; and constructs a simplified graph based on the simplified matrix; A simplified matrix prediction module, which extracts a corresponding simplified graph vector from the simplified graph based on a graph neural network, and obtains a simplified graph matrix prediction model based on the simplified matrix sequence as training data; The anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model.

[0012] The data collection and processing module includes a network service data collection function module and a chemical plant data collection function module.

[0013] The network service data collection function module uses network probes to capture data packets in real time and extract information from the data packets, including host IP, network entity type, host behavior, and network entity behavior type. The chemical plant data acquisition function module uses temperature sensors, air pressure sensors, etc. to perform real-time detection of the reactor's temperature, pressure, liquid level, and the temperature and pressure of the pipeline, while identifying the type of chemical production equipment and material behavior type.

[0014] Extracting the network entity type, the network entity behavior type, the chemical production equipment type, and the material behavior type from the data of the network service and the data of the chemical plant acquired in real time or in batches based on regular expressions; Using numbers as IDs, the network entity type, the network entity behavior type, the chemical production equipment type of the chemical plant, and the material behavior type are digitally and uniquely identified, starting from the number 0 and gradually increasing, to respectively identify the network entity type, the network entity behavior type, the chemical production equipment type, and the material behavior type, and to construct a mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID.

[0015] For the initial network service data and chemical plant data within the time slice, the mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID is utilized to map the network entity type, the network entity behavior type, the chemical production equipment type, and the material behavior type to the network entity type ID, the network entity behavior type ID, the chemical production equipment type ID, and the material behavior type ID, and the network entity type ID, the network entity behavior type ID, the chemical production equipment type ID, and the material behavior type ID are counted respectively to construct a network entity type matrix, a network entity behavior type matrix, a chemical production equipment type matrix, and a material behavior type matrix.

[0016] The network entity type matrix, the network entity behavior type matrix, the chemical production equipment type matrix, and the material behavior type matrix are spliced ​​together to construct the simplified matrix.

[0017] The reduced matrix sequence is constructed using the plurality of reduced matrices of the plurality of time slices.

[0018] The dual time window technology includes two time window technologies: fixed time window technology and cumulative time window technology. The purpose of the present invention to distinguish the two sequences is that the fixed time sequence can be better used to identify anomalies evenly distributed in time, and the cumulative time sequence is better used to identify anomalies accumulated over time.

[0019] Specifically, the fixed time window technology uses the same time interval to divide the initial network service data and the chemical plant data; the cumulative time window technology uses the same time interval to cumulatively increase the time slice length to divide the initial network service data and the chemical plant data, and forgets the initial network service data and the chemical plant data in the time window according to a certain forgetting rate; At the same time, two time windows are used to separate the network service data and the chemical plant data, and two simplified matrix sequences are constructed respectively.

[0020] The simplified graph includes: entity type nodes, behavior type nodes and edges, wherein: The network entity types and the chemical production equipment types in the simplified matrix constitute entity type nodes in the simplified graph; The network entity behavior type and the material behavior type connecting two entity node types in the simplified matrix constitute a behavior type node in the simplified graph; The connection between the entity type node and the behavior type node constitutes an edge in the simplified graph.

[0021] Preferably, the simplified matrix prediction module extracts the corresponding simplified graph vector from the simplified graph based on a graph neural network, and obtains a simplified graph matrix prediction model based on the simplified matrix sequence as training data, including: For each of the type nodes in the simplified graph, a linear transformation is used to convert the type node vector into a node transformation vector; an attention mechanism is used to calculate the attention coefficient between adjacent type nodes in the simplified graph; the attention coefficient is used to aggregate the node transformation vectors of all neighbors of each type node, and the aggregated vector is used as the type feature vector of the type node; a multi-head attention mechanism is used to extract the type feature vector for each attention head, and the outputs of all the attention heads are spliced ​​together; all the type feature vectors in the simplified graph are globally average pooled to obtain the simplified graph vector.

[0022] The simplified matrix sequence is divided into training set data and test set data. Use three different linear transformation matrices to linearly transform the vectors in the simplified matrix of the training set to obtain three attention vectors of the attention head; calculate the attention score, and use the attention score and the vector for weighted aggregation to obtain a weighted aggregation vector; use a multi-head attention mechanism to extract the weighted aggregation vector for each attention head, and splice the outputs of all the attention heads together to form a splicing vector; obtain the attention vector through a linear transformation of the splicing vector. Use the attention vector of each time slice to update the vector forgetting rate and memory rate, use the forgetting rate and memory rate to update the memory, and finally use the attention vector of each time slice to calculate the attention vector of the next time slice. Calculate the attention vector of the next time slice for all vectors in the simplified matrix, and all the attention vectors constitute the simplified matrix of the next time slice.

[0023] Preferably, the anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model, including: The simplified graph is divided into training set data and test set data. The simplified graph of the training set data does not include the type of nodes where anomalies occur, while the simplified graph of the test set data includes the type of nodes where anomalies occur. The simplified graph of the training set is converted into a simplified graph vector. For all the simplified graph vectors obtained, k simplified graph vectors are randomly selected as the center; the distance from all simplified graph vectors to the center is calculated, and the simplified graph vector is assigned to the cluster closest to the simplified graph vector; the mean of all simplified graph vectors in the cluster is used to update the corresponding cluster center; the cluster center is iterated until the change in the cluster center is less than the threshold o, and an anomaly detection model is obtained.

[0024] When performing data anomaly detection based on the anomaly detection model, the test set data simplified graph is converted into a test set data simplified graph vector, and the distance from the test set data simplified graph vector to each center is calculated. If the minimum value of the distance between the centers is greater than a threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph, otherwise it is a normal simplified graph.

[0025] Beneficial Effects The advantage of the present invention is that it can solve the abnormal problems caused by aging of chemical plant equipment, network attacks on chemical plants, and subsequent corresponding chemical equipment damage, and can also solve the security problems of the combination of chemical plants and the Internet, and predict the security problems while detecting the security problems. The difficulty of solving the abnormal problems caused by aging of chemical plant equipment, network attacks on chemical plants, and subsequent corresponding chemical equipment damage, and solving the security problems of the combination of chemical plants and the Internet is that it is difficult to integrate network security data with chemical production safety data. Because network anomalies can be detected by network traffic, chemical plant anomalies can be detected by material flow information and controller information. The network traffic information can be regarded as the edge of the graph with the Internet host as the vertex, and the material flow information can be regarded as the edge of the graph with the chemical plant equipment as the vertex. In this way, a simplified matrix can be used to construct a simplified graph to uniformly construct a joint network of the Internet and chemical production, and then a graph neural network and a clustering method are used to realize the integrated anomaly detection of network security and chemical production safety. In order to predict safety issues while detecting them, the simplified matrix sequence is used to predict the simplified matrix of the next time slice, and the corresponding simplified graph is constructed. The integrated anomaly detection algorithm of network security and chemical production safety is reused to detect the predicted simplified graph, thereby realizing the prediction of safety issues while detecting them.

[0026] In summary, the present invention can integrately solve the abnormal problems caused by aging of chemical plant equipment, network attacks on chemical plants and subsequent corresponding damage to chemical equipment, etc., and at the same time solve the security problems of the combination of chemical plants and the Internet, and predict security problems while detecting them. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram showing the process flow of the integrated anomaly prediction and detection algorithm and system based on graph neural network implemented in the present invention; Figure 2 A schematic diagram of a model showing an integrated anomaly prediction and detection algorithm and system based on a graph neural network implemented in the present invention; Figure 3 A schematic diagram showing the implementation of an integrated anomaly prediction and detection algorithm based on a graph neural network and system data transformation in the present invention; Figure 4 A schematic diagram showing an integrated anomaly prediction and detection algorithm based on a graph neural network and a system simplified matrix according to the present invention; Figure 5 A simplified schematic diagram of an integrated anomaly prediction and detection algorithm and system based on a graph neural network implemented in the present invention is shown. DETAILED DESCRIPTION

[0028] refer to Figure 1 and Figure 2 , an integrated anomaly prediction and detection algorithm based on graph neural network, including the following steps: Step S101, obtaining initial network service data and chemical plant data: Network service data collection, using network probes to capture data packets in real time and extract information from the data packets, including host IP, network entity type, host behavior, and network entity behavior type; For example, the network entity type may be a process, a file, etc.

[0029] For example, the network entity behavior type may be read, write, and the like.

[0030] Chemical plant data collection uses temperature sensors, air pressure sensors, etc. to perform real-time detection of the temperature, pressure, liquid level of the reactor and the temperature and pressure of the pipeline, while identifying the type of chemical production equipment and material behavior type.

[0031] For example, the chemical production equipment may be a reactor, a pipeline, etc.

[0032] For example, the material behavior type may be low temperature, medium temperature, high temperature, low pressure, medium pressure, high pressure, etc.

[0033] Step S102, based on the network service data and the chemical plant data, construct a mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID: Extract network entity types, network entity behavior types, chemical production equipment types, and material behavior types from real-time or batch acquired network service data and chemical plant data based on regular expressions; use numbers as IDs to digitize and uniquely identify the network entity types, the network entity behavior types, the chemical production equipment types of the chemical plant, and the material behavior types, starting from the number 0 and gradually increasing, to identify the network entity types, the network entity behavior types, the chemical production equipment types, and the material behavior types, respectively; Construct a mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID.

[0034] Step S103, using the dual time window technology and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and its ID to construct a simplified matrix sequence: For the initial network service data and chemical plant data within the time slice, the network entity type, the network entity behavior type, the chemical production equipment type, and the material behavior type are mapped to the network entity type ID, the network entity behavior type ID, the chemical production equipment type ID, and the material behavior type ID, respectively, by using the mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type ID, and the material behavior type ID; and respectively counting the number of the network entity type ID, the network entity behavior type ID, the chemical production equipment type ID, and the material behavior type ID; Construct network entity type matrix, network entity behavior type matrix, chemical production equipment type matrix, and material behavior type matrix; The network entity type matrix, the network entity behavior type matrix, the chemical production equipment type matrix, and the material behavior type matrix are spliced ​​together in ID order to construct the simplified matrix (such as Figure 4 example).

[0035] The simplified matrix sequence is constructed using the multiple simplified matrices of the multiple time slices. The dual time window technology includes two time window technologies: a fixed time window technology and a cumulative time window technology. The fixed time window technology uses the same time interval to divide the initial network service data and the chemical plant data; the cumulative time window technology uses the same time interval to cumulatively increase the time slice length to divide the initial network service data and the chemical plant data, and forgets the initial network service data and the chemical plant data in the time window according to a certain forgetting rate, and uses two time windows to separate the network service data and the chemical plant data, and constructs two simplified matrix sequences respectively.

[0036] Distinguishing between two types of reduced matrix sequences, which can be better used to identify anomalies that are uniformly distributed in time (fixed time window) and anomalies that accumulate over time (cumulative time window technique).

[0037] Step S104, constructing a simplified graph based on the simplified matrix in step S103: The simplified graph includes: entity type nodes, behavior type nodes and edges. The network entity types and the chemical production equipment types in the simplified matrix constitute entity type nodes in the simplified graph; The network entity behavior type and the material behavior type connecting two entity node types in the simplified matrix constitute a behavior type node in the simplified graph; The connection between the entity type node and the behavior type node constitutes an edge in the simplified graph.

[0038] Figure 5 This is an example of a simplified diagram of this embodiment.

[0039] Step S105, extracting a corresponding simplified graph vector from the simplified graph based on a graph neural network: For each type node (including entity type nodes and behavior type nodes) in the simplified graph, a linear transformation is used: The type node vector is converted to a node transformation vector, where is the type node vector, is the weight matrix, is the node transformation vector; The attention mechanism is used to calculate the attention coefficient between adjacent type nodes in the simplified graph: , where a is the attention weight vector, is the activation function, || represents the concatenation operation, and N(i) represents the neighbor set of node i; Use the attention coefficient to aggregate all neighbor node transformation vectors of each node of the type, and use the aggregated vector as the type feature vector of the node of the type: ,in is a nonlinear activation function, is the type feature vector; Using a multi-head attention mechanism, extract the type feature vector for each attention head, and concatenate the outputs of all the attention heads together: , where k is the index of the attention head; Global average pooling is performed on all feature vectors of the type in the simplified graph to obtain the simplified graph vector.

[0040] Step S106, obtaining a simplified graph matrix prediction model based on the simplified matrix sequence as training data: The simplified matrix sequence in step S103 is divided into training set data and test set data.

[0041] Using three different linear transformation matrices ( , , ) simplifies the matrix of the training set Linear transformation of vectors in: , , ,in , , They are the three attention vectors of attention head i, , , is the weight matrix of the three attention vectors corresponding to attention head i; Calculate the attention score: ,in is the scaling factor, is the attention score; The attention score is weightedly aggregated with the vector to obtain a weighted aggregate vector: ,in is the weighted aggregation vector; Using a multi-head attention mechanism, the weighted aggregation vector is extracted for each attention head, and the outputs of all the attention heads are concatenated together to form a concatenated vector: ,in is the concatenation vector; The concatenated vector is transformed into the attention vector through a linear transformation: ,in is the attention vector, is the linear transformation matrix of the splicing vector.

[0042] The forgetting rate and memory rate of the vector are updated using the attention vector of each time slice: , , in is the vector memory rate, is the vector forgetting rate, is the attention vector at time t, is the hidden state at time t-1, and are the weight matrices of the vector forgetting rate and vector memory rate, respectively. and are the bias terms of vector forgetting rate and vector memory rate respectively; The memory is updated using the forgetting rate and the memory rate: , ,in is the change vector, Cumulative vector, is the weight matrix of the change vector, is the bias term that changes the vector; Finally, the attention vector of each time slice is used to calculate the attention vector of the next time slice: , = , ,in is the update vector, is the weight matrix of the update vector, is the bias term of the update vector, and FC is the fully connected layer.

[0043] The attention vector of the next time slice is calculated for all vectors in the simplified matrix, and all the attention vectors constitute the simplified matrix of the next time slice.

[0044] Step S107, obtaining an anomaly detection model based on the simplified graph as training data, and detecting data anomalies in each time slice based on the anomaly detection model: The simplified graph obtained in step S104 is divided into training set data and test set data. The simplified graph of the training set data does not include the type nodes where abnormalities occur, while the simplified graph of the test set data includes the type nodes where abnormalities occur.

[0045] The simplified graph of the training set is converted into a simplified graph vector. For all the simplified graph vectors obtained, k simplified graph vectors are randomly selected as the center; the distance from all simplified graph vectors to the center is calculated: d ,in is the simplified graph vector, is the simplified graph vector as the center; The simplified graph vector is assigned to the cluster closest to the simplified graph vector; and the corresponding cluster center is updated using the mean of all the simplified graph vectors in the cluster: ,in is the jth cluster, It is a cluster The number of simplified graph vectors contained; iterating the cluster center until the change of the cluster center is less than the threshold o, and obtaining the anomaly detection model.

[0046] When performing data anomaly detection based on the anomaly detection model, the test set data simplified graph is converted into a test set data simplified graph vector, and the distance from the test set data simplified graph vector to each center is calculated. If the minimum value of the distance between each center is greater than a certain threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph, otherwise it is a normal simplified graph.

[0047] The present invention can solve the abnormal problems caused by aging of chemical plant equipment, network attacks on chemical plants and subsequent corresponding damage to chemical equipment in an integrated manner. It can also solve the security problems of the combination of chemical plants and the Internet, and predict security problems while detecting them.

[0048] The above description is only a description of the preferred embodiments of the present application, and is not intended to limit the scope of the present application. Any changes or modifications made by any person skilled in the art based on the above disclosed technical contents shall be deemed as equivalent effective embodiments and shall fall within the scope of protection of the technical solution of the present application.

Claims

1. An integrated anomaly prediction and detection algorithm based on graph neural network, characterized in that: The following steps are involved: Step 1: Get initial network service data and chemical plant data: Network service data collection, using network probes to capture data packets in real time and extract information from the data packets, including host IP, network entity type, host behavior, and network entity behavior type; Data collection in chemical plants, using temperature sensors, air pressure sensors, etc. to detect the temperature, pressure, liquid level of the reactor and the temperature and pressure of the pipeline in real time, and to identify the type of chemical production equipment and material behavior type; Step 2, based on the network service data and the chemical plant data, construct a mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID; Step 3, constructing a simplified matrix sequence using dual time window technology and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and its ID; Step 4, constructing a simplified graph based on the simplified matrix described in step 3; The simplified graph includes: entity type nodes, behavior type nodes and edges; wherein, The network entity types and the chemical production equipment types in the simplified matrix constitute entity type nodes in the simplified graph; The network entity behavior type and the material behavior type connecting two entity node types in the simplified matrix constitute a behavior type node in the simplified graph; The connection between the entity type node and the behavior type node constitutes an edge in the simplified graph; Step 5, extracting a corresponding simplified graph vector from the simplified graph based on a graph neural network; Step 6: Based on the simplified matrix sequence described in step 3 as training data, a simplified graph matrix prediction model is obtained: Step 7: Obtain an anomaly detection model based on the simplified graph as training data, and detect data anomalies in each time slice based on the anomaly detection model.

2. According to claim 1, an integrated anomaly prediction and detection algorithm based on graph neural network is characterized in that: Step S102 is specifically as follows: Extract network entity types, network entity behavior types, chemical production equipment types, and material behavior types from real-time or batch acquired network service data and chemical plant data based on regular expressions; use numbers as IDs to digitize and uniquely identify the network entity types, the network entity behavior types, the chemical production equipment types of the chemical plant, and the material behavior types, starting from the number 0 and gradually increasing, to identify the network entity types, the network entity behavior types, the chemical production equipment types, and the material behavior types, respectively; Construct a mapping relationship between the network entity type and the network entity type ID, the network entity behavior type and the network entity behavior type ID, the chemical production equipment type and the chemical production equipment type ID, and the material behavior type and the material behavior type ID.

3. According to claim 1, an integrated anomaly prediction and detection algorithm based on graph neural network is characterized in that: Step S103 is specifically as follows: For the initial network service data and chemical plant data within the time slice, the mapping relationship between network entity type and network entity type ID, network entity behavior type and network entity behavior type ID, chemical production equipment type and chemical production equipment type ID, material behavior type and material behavior type ID is used to map the network entity type, network entity behavior type, chemical production equipment type, and material behavior type to network entity type ID, network entity behavior type ID, chemical production equipment type ID, and material behavior type ID, respectively; and respectively counting the number of the network entity type ID, the network entity behavior type ID, the chemical production equipment type ID, and the material behavior type ID; Construct network entity type matrix, network entity behavior type matrix, chemical production equipment type matrix, and material behavior type matrix; The network entity type matrix, the network entity behavior type matrix, the chemical production equipment type matrix, and the material behavior type matrix are spliced ​​together in ID order to construct the simplified matrix; constructing a reduced matrix sequence using the plurality of reduced matrices of the plurality of time slices; The dual time window technology includes two time window technologies: fixed time window technology and cumulative time window technology; The fixed time window technology uses the same time interval to divide the initial network service data and chemical plant data; the cumulative time window technology uses the same time interval to cumulatively increase the time slice length to divide the initial network service data and chemical plant data, and forgets the initial network service data and chemical plant data in the time window according to a certain forgetting rate. At the same time, two time windows are used to separate the network service data and the chemical plant data, and two simplified matrix sequences are constructed respectively.

4. According to claim 1, an integrated anomaly prediction and detection algorithm based on graph neural network is characterized in that: Step S105 is specifically as follows: For each type node (including entity type nodes and behavior type nodes) in the simplified graph, a linear transformation is used: The type node vector is converted to a node transformation vector, where is the type node vector, is the weight matrix, is the node transformation vector; The attention mechanism is used to calculate the attention coefficient between adjacent type nodes in the simplified graph: , where a is the attention weight vector, is the activation function, || represents the concatenation operation, and N(i) represents the neighbor set of node i; Use the attention coefficient to aggregate all neighbor node transformation vectors of each node of the type, and use the aggregated vector as the type feature vector of the node of the type: ,in is a nonlinear activation function, is the type feature vector; Using a multi-head attention mechanism, extract the type feature vector for each attention head, and concatenate the outputs of all the attention heads together: , where k is the index of the attention head; Global average pooling is performed on all feature vectors of the type in the simplified graph to obtain the simplified graph vector.

5. According to claim 1, an integrated anomaly prediction and detection algorithm based on graph neural network is characterized in that: Step S106 is specifically as follows: Divide the simplified matrix sequence in step S103 into training set data and test set data; Using three different linear transformation matrices ( , , ) simplifies the matrix of the training set Linear transformation of vectors in: , , ,in , , They are the three attention vectors of attention head i, , , is the weight matrix of the three attention vectors corresponding to attention head i; Calculate the attention score: ,in is the scaling factor, is the attention score; The attention score is weightedly aggregated with the vector to obtain a weighted aggregate vector: ,in is the weighted aggregation vector; Using a multi-head attention mechanism, the weighted aggregation vector is extracted for each attention head, and the outputs of all the attention heads are concatenated together to form a concatenated vector: ,in is the concatenation vector; The concatenated vector is transformed into the attention vector through a linear transformation: ,in is the attention vector, is the linear transformation matrix of the splicing vector; The forgetting rate and memory rate of the vector are updated using the attention vector of each time slice: ， ， in is the vector memory rate, is the vector forgetting rate, is the attention vector at time t, is the hidden state at time t-1, and are the weight matrices of the vector forgetting rate and vector memory rate, respectively. and are the bias terms of vector forgetting rate and vector memory rate respectively; The memory is updated using the forgetting rate and the memory rate: , ,in is the change vector, Cumulative vector, is the weight matrix of the change vector, is the bias term that changes the vector; Finally, the attention vector of each time slice is used to calculate the attention vector of the next time slice: , = , ,in is the update vector, is the weight matrix of the update vector, is the bias term of the update vector, FC is the fully connected layer; The attention vector of the next time slice is calculated for all vectors in the simplified matrix, and all the attention vectors constitute the simplified matrix of the next time slice.

6. According to claim 1, an integrated anomaly prediction and detection algorithm based on graph neural network is characterized in that: Step S107 is specifically as follows: Divide the simplified graph obtained in step S104 into training set data and test set data, wherein the simplified graph of the training set data does not include the type nodes where the exception occurs, and the simplified graph of the test set data includes the type nodes where the exception occurs; The simplified graph of the training set is converted into a simplified graph vector; for all the simplified graph vectors obtained, k simplified graph vectors are randomly selected as the center; and the distance from all simplified graph vectors to the center is calculated: d ,in is the simplified graph vector, is the simplified graph vector as the center; The simplified graph vector is assigned to the cluster closest to the simplified graph vector; and the corresponding cluster center is updated using the mean of all the simplified graph vectors in the cluster: ,in is the jth cluster, It is a cluster The number of simplified graph vectors contained; iterating the cluster center until the change of the cluster center is less than a threshold value o, and obtaining the anomaly detection model; When performing data anomaly detection based on the anomaly detection model, the test set data simplified graph is converted into a test set data simplified graph vector, and the distance from the test set data simplified graph vector to each center is calculated. If the minimum value of the distance between each center is greater than a certain threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph, otherwise it is a normal simplified graph.

7. An integrated anomaly prediction and detection system based on graph neural network, characterized in that: include: Data acquisition and processing module, simplified matrix prediction module and anomaly detection module; The data acquisition and processing module obtains initial network service data and chemical plant data, and constructs a mapping relationship between network entity type and network entity type ID, network entity behavior type and network entity behavior type ID, chemical production equipment type and chemical production equipment type ID, and material behavior type and material behavior type ID based on the network service data and chemical plant data; Constructing a simplified matrix sequence by using dual time window technology and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and its ID; Constructing a simplified graph based on the simplified matrix; A simplified matrix prediction module, which extracts a corresponding simplified graph vector from the simplified graph based on a graph neural network, and obtains a simplified graph matrix prediction model based on the simplified matrix sequence as training data; The anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model.

8. The integrated anomaly prediction and detection system based on graph neural network according to claim 7 is characterized in that: The simplified matrix prediction module extracts the corresponding simplified graph vector from the simplified graph based on the graph neural network, and obtains a simplified graph matrix prediction model based on the simplified matrix sequence as training data, including: For each type node in the simplified graph, a linear transformation is used to convert the type node vector into a node transformation vector; an attention mechanism is used to calculate the attention coefficient between adjacent type nodes in the simplified graph; the attention coefficient is used to aggregate the node transformation vectors of all neighbors of each type node, and the aggregated vector is used as the type feature vector of the type node; a multi-head attention mechanism is used to extract the type feature vector for each attention head, and the outputs of all the attention heads are spliced ​​together; all the type feature vectors in the simplified graph are globally averaged pooled to obtain the simplified graph vector; The simplified matrix sequence is divided into training set data and test set data; three different linear transformation matrices are used to linearly transform the vectors in the training set simplified matrix to obtain three attention vectors of the attention head; the attention score is calculated, and the attention score and the vector are weightedly aggregated to obtain a weighted aggregation vector; a multi-head attention mechanism is used to extract a weighted aggregation vector for each attention head, and the outputs of all attention heads are spliced ​​together to form a spliced ​​vector; the spliced ​​vector is subjected to a linear transformation to obtain an attention vector; the forgetting rate and the memory rate of the vector are updated using the attention vector of each time slice, the memory is updated using the forgetting rate and the memory rate, and finally the attention vector of the next time slice is calculated using the attention vector of each time slice; the attention vector of the next time slice is calculated for all vectors in the simplified matrix, and all attention vectors constitute the simplified matrix of the next time slice.

9. The integrated anomaly prediction and detection system based on graph neural network according to claim 7 is characterized in that: The anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model, including: The simplified graph is divided into training set data and test set data; the simplified graph of the training set data does not include the type node where the exception occurs, while the simplified graph of the test set data does include; The simplified graph of the training set is converted into a simplified graph vector; for all the simplified graph vectors obtained, k simplified graph vectors are randomly selected as the center; the distances from all simplified graph vectors to the center are calculated, and the simplified graph vectors are assigned to the cluster closest to the simplified graph vector; the corresponding cluster center is updated using the mean of all simplified graph vectors in the cluster; the cluster center is iterated until the change of the cluster center is less than the threshold value o, and an anomaly detection model is obtained; When performing data anomaly detection based on the anomaly detection model, the test set data simplified graph is converted into a test set data simplified graph vector, and the distance from the test set data simplified graph vector to each center is calculated. If the minimum value of the distance between the centers is greater than a threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph, otherwise it is a normal simplified graph.

Images