An integrated anomaly prediction and detection method and system based on graph neural networks

Abstract

This invention belongs to the interdisciplinary field of chemical plant equipment anomaly detection and internet network security, specifically relating to an integrated anomaly prediction and detection method and system for the chemical industry internet based on graph neural networks. The method includes the following steps: Step 1, acquiring initial network service data and chemical plant data; Step 2, constructing a mapping relationship based on the network service data and chemical plant data; Step 3, constructing a simplified matrix sequence using a dual-time-window technique; Step 4, constructing a simplified graph based on the simplified matrix described in Step 3; Step 5, extracting corresponding simplified graph vectors from the simplified graph based on a graph neural network; and so on. This invention can comprehensively solve anomaly problems caused by aging chemical plant equipment, as well as network attacks targeting chemical plants and subsequent damage to chemical equipment. It also addresses security issues related to the integration of chemical plants and the internet, predicting security problems while detecting them.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of chemical plant equipment anomaly detection and Internet network security, and specifically relates to an integrated anomaly prediction and detection method and system for the chemical Internet based on graph neural networks. Background Technology

[0002] With the increasingly close integration of the internet and chemical production, chemical production has entered a new stage of development. The internet has comprehensively connected people, machines, and materials in chemical production, realizing the digitalization, networking, and intelligentization of chemical production, but also increasing the possibility of external attacks on chemical production. To ensure the security of the chemical internet, a practical and effective integrated anomaly prediction and detection method and system for the chemical internet is needed.

[0003] Traditional internet security primarily addresses various attacks launched by cyber attackers exploiting internet vulnerabilities against computer information systems, infrastructure, computer networks, or personal devices. Researchers typically extract network traffic and log data into source maps and other formats, using methods such as autoencoders and neural networks to identify suspicious network activity. While traditional internet security can solve network attack problems, it cannot handle anomalies caused by factors such as aging equipment in chemical plants.

[0004] Traditional anomaly detection in chemical plants aims to address safety threats arising from factors such as equipment aging during production. It ensures safe production by identifying unexpected equipment observations. Researchers typically use statistical methods to calculate the distance between data points and their distributions to identify anomalies, or utilize techniques such as Support Vector Machines (SVM) and neural networks to learn data features and detect anomalies. While traditional anomaly detection can address anomalies caused by equipment aging, it cannot promptly detect cyberattacks targeting chemical plants and subsequent damage to chemical equipment.

[0005] The scenarios in the field of chemical plant equipment anomaly detection differ significantly from those in the field of internet cybersecurity. Currently, there is an urgent need for a method that can comprehensively address anomalies caused by aging chemical plant equipment, as well as cyberattacks targeting chemical plants and subsequent damage to chemical equipment. This method would link chemical plant equipment anomaly detection with internet cybersecurity, enabling the resolution of both chemical plant and internet security issues, and further addressing the security challenges at the intersection of chemical plants and the internet. It would also allow for the prediction of security problems while detecting them. Summary of the Invention

[0006] The main technical problem addressed by this invention is the significant difference between the fields of chemical plant equipment anomaly detection and internet network security. Currently, there is no method that can comprehensively solve anomalies caused by aging chemical plant equipment, network attacks targeting chemical plants, and subsequent damage to chemical equipment. Nor is there a method that can solve the security issues of the connection between chemical plants and the internet, and simultaneously detect and predict security problems.

[0007] To address the aforementioned technical problems, the present invention provides the following technical solution:

[0008] An integrated anomaly prediction and detection method based on graph neural networks includes the following steps:

[0009] Step 1: Obtain initial network service data and chemical plant data:

[0010] Network service data collection involves using network probes to capture data packets in real time and extracting information from the packets, including host IP addresses, network entity types, host behaviors, and network entity behavior types.

[0011] Chemical plant data acquisition uses temperature sensors, pressure sensors, etc., to monitor the temperature, pressure, and liquid level of reactors and the temperature and pressure of pipelines in real time, while also identifying the type of chemical production equipment and the type of material behavior.

[0012] Step 2: Based on the network service data and chemical plant data, construct the mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID;

[0013] Step 3: Construct a simplified matrix sequence using the dual time window technique and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and their IDs;

[0014] Step 4: Construct a simplified diagram based on the simplified matrix described in Step 3;

[0015] The simplified diagram includes: entity type nodes, behavior type nodes, and edges.

[0016] The network entity types and chemical production equipment types in the simplified matrix constitute the entity type nodes in the simplified diagram.

[0017] The network entity behavior type and the material behavior type that connect two entity type nodes in the simplified matrix constitute the behavior type node in the simplified diagram.

[0018] The connections between entity type nodes and behavior type nodes constitute the edges in the simplified graph.

[0019] Step 5: Extract the corresponding simplified graph vector from the simplified graph based on the graph neural network;

[0020] Step 6: Based on the simplified matrix sequence described in Step 3 as training data, obtain the simplified graph matrix prediction model:

[0021] Step 7: Obtain an anomaly detection model based on the simplified graph as training data, and detect data anomalies in each time slice based on the anomaly detection model.

[0022] An integrated anomaly prediction and detection system based on graph neural networks includes: a data acquisition and processing module, a simplified matrix prediction module, and an anomaly detection module.

[0023] The data acquisition and processing module obtains initial network service data and chemical plant data. Based on the network service data and chemical plant data, it constructs mapping relationships between network entity types and network entity type IDs, network entity behavior types and network entity behavior type IDs, chemical production equipment types and chemical production equipment type IDs, and material behavior types and material behavior type IDs. Using dual-time window technology and the mapping relationships between the network entity types, network entity behavior types, chemical production equipment types, material behavior types, and their IDs, it constructs a simplified matrix sequence. Based on the simplified matrix, it constructs a simplified graph.

[0024] The simplified matrix prediction module extracts the corresponding simplified graph vector from the simplified graph based on the graph neural network, and obtains the simplified graph matrix prediction model based on the simplified matrix sequence as training data.

[0025] The anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model.

[0026] The data acquisition and processing module includes a network service data acquisition function module and a chemical plant data acquisition function module.

[0027] The network service data acquisition module uses a network probe to capture data packets in real time and extract information from the data packets, including host IP, network entity type, host behavior, and network entity behavior type.

[0028] The chemical plant data acquisition module uses temperature sensors, pressure sensors, etc., to monitor the temperature, pressure, and liquid level of the reactor and the temperature and pressure of the pipeline in real time, while also identifying the type of chemical production equipment and the type of material behavior.

[0029] Based on regular expressions, the network entity type, the network entity behavior type, the chemical production equipment type, and the material behavior type are extracted from the data of the network service and the chemical plant obtained in real time or in batches.

[0030] Using numbers as IDs, unique digital identifiers are created for the network entity type, the network entity behavior type, the chemical plant chemical production equipment type, and the material behavior type. Starting from 0 and gradually increasing, each identifier is used to identify the network entity type, the network entity behavior type, the chemical production equipment type, and the material behavior type. A mapping relationship is then established between the network entity type and its ID, the network entity behavior type and its ID, the chemical production equipment type and its ID, and the material behavior type and its ID.

[0031] For the initial network service data and chemical plant data within the time slice, the mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID are used to map the network entity type, network entity behavior type, chemical production equipment type, and material behavior type to the network entity type ID, network entity behavior type ID, chemical production equipment type ID, and material behavior type ID, respectively. The network entity type ID, network entity behavior type ID, chemical production equipment type ID, and material behavior type ID are then statistically analyzed to construct a network entity type matrix, a network entity behavior type matrix, a chemical production equipment type matrix, and a material behavior type matrix.

[0032] The network entity type matrix, the network entity behavior type matrix, the chemical production equipment type matrix, and the material behavior type matrix are concatenated together to construct the simplified matrix.

[0033] The simplified matrix sequence is constructed using the multiple simplified matrices of the multiple time slices.

[0034] The dual-time-window technique comprises two time-window techniques: fixed-time-window and cumulative-time-window. The purpose of distinguishing between the two types of sequences in this invention is that fixed-time series are better suited for identifying anomalies uniformly distributed over time, while cumulative-time series are better suited for identifying anomalies that accumulate over time.

[0035] Specifically, the fixed time window technique uses the same time interval to divide the initial network service data and chemical plant data; the cumulative time window technique uses the same time interval to cumulatively increase the time slice length to divide the initial network service data and chemical plant data, and forgets the initial network service data and chemical plant data within the time window according to a certain forgetting rate;

[0036] At the same time, two time windows are used to separate network service data and chemical plant data, and two simplified matrix sequences are constructed respectively.

[0037] The simplified diagram includes: entity type nodes, behavior type nodes, and edges, wherein:

[0038] The network entity types and chemical production equipment types in the simplified matrix constitute the entity type nodes in the simplified diagram.

[0039] The network entity behavior type and the material behavior type that connect two entity type nodes in the simplified matrix constitute the behavior type node in the simplified diagram.

[0040] The connections between entity type nodes and behavior type nodes constitute the edges in the simplified graph.

[0041] Preferably, the simplified matrix prediction module extracts corresponding simplified graph vectors from the simplified graph based on a graph neural network, and obtains a simplified graph matrix prediction model based on the simplified matrix sequence as training data, including:

[0042] For each type node in the simplified graph, a linear transformation is used to convert the type node vector into a node transformation vector; an attention mechanism is used to calculate the attention coefficients between adjacent type nodes in the simplified graph; the attention coefficients are used to aggregate the node transformation vectors of all neighbors of each type node, and the aggregated vector is used as the type feature vector of the type node; a multi-head attention mechanism is used to extract the type feature vector for each attention head, and the outputs of all attention heads are concatenated together; global average pooling is performed on all type feature vectors in the simplified graph to obtain the simplified graph vector.

[0043] The simplified matrix sequence is divided into training set data and test set data. Three different linear transformation matrices are used to perform linear transformations on the vectors in the simplified training set matrix to obtain three attention vectors for each attention head. Attention scores are calculated, and the attention scores are weighted and aggregated with the vectors to obtain a weighted aggregated vector. A multi-head attention mechanism is used to extract the weighted aggregated vector for each attention head, and the outputs of all attention heads are concatenated to form a concatenated vector. The concatenated vector is then subjected to a linear transformation to obtain the attention vector. The forgetting rate and memory rate are updated using the attention vectors from each time slice, and memory updates are performed using these rates. Finally, the attention vector for the next time slice is calculated using the attention vectors from each time slice. The attention vector for the next time slice is calculated for all vectors in the simplified matrix, and all these attention vectors constitute the simplified matrix for the next time slice.

[0044] Preferably, the anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model, including:

[0045] The simplified graph is divided into training and test sets. The training set simplified graph does not include nodes of the type that have anomalies, while the test set simplified graph does. The training set simplified graph is converted into simplified graph vectors. For all the obtained simplified graph vectors, k simplified graph vectors are randomly selected as centers; the distance from each simplified graph vector to the center is calculated, and the simplified graph vectors are assigned to the clusters closest to the centers; the cluster centers are updated using the mean of all simplified graph vectors within the cluster; the cluster centers are iterated until the change in the cluster centers is less than a threshold 0, thus obtaining the anomaly detection model.

[0046] When performing data anomaly detection based on the anomaly detection model, the simplified test set data graph is converted into a simplified test set data graph vector. The distance from the simplified test set data graph vector to each center is calculated. If the minimum distance of each center is greater than the threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph; otherwise, it is a normal simplified graph.

[0047] Beneficial effects

[0048] The advantages of this invention lie in its ability to comprehensively address anomalies caused by aging equipment in chemical plants, as well as network attacks targeting chemical plants and subsequent damage to chemical equipment. It also solves security issues related to the integration of chemical plants and the internet, predicting and detecting security problems simultaneously. The challenge in comprehensively addressing anomalies caused by aging equipment in chemical plants, network attacks targeting chemical plants, and subsequent damage to chemical equipment, while simultaneously addressing security issues related to the integration of chemical plants and the internet, lies in the difficulty of integrating network security data with chemical production safety data. Network anomalies can be detected through network traffic, while chemical plant anomalies can be detected through material flow information and controller information. Network traffic information can be viewed as edges in a graph with internet hosts as vertices, while material flow information can be viewed as edges in a graph with chemical plant equipment as vertices. This allows for the construction of a simplified graph using a simplified matrix to unify the construction of the internet and chemical production joint network. Then, graph neural networks and clustering methods are used to achieve integrated anomaly detection for both network security and chemical production safety. To detect and predict security issues simultaneously, a simplified matrix sequence is used to predict the simplified matrix for the next time slice, and a corresponding simplified graph is constructed. The integrated anomaly detection method for network security and chemical production safety is then reused to detect the predicted simplified graph, thereby achieving the goal of predicting security issues while detecting them.

[0049] In summary, this invention can comprehensively solve abnormal problems caused by aging equipment in chemical plants, as well as network attacks targeting chemical plants and subsequent damage to chemical equipment. It can also solve security problems in the connection between chemical plants and the Internet, and predict security problems while detecting them. Attached Figure Description

[0050] Figure 1 This diagram illustrates the process of implementing the integrated anomaly prediction and detection method and system based on graph neural networks according to the present invention.

[0051] Figure 2 This diagram illustrates a model of the integrated anomaly prediction and detection method and system based on graph neural networks according to the present invention.

[0052] Figure 3 The diagram illustrates the data transformation of the integrated anomaly prediction and detection method and system based on graph neural networks according to the present invention.

[0053] Figure 4 This diagram illustrates a simplified matrix of the integrated anomaly prediction and detection method and system based on graph neural networks according to the present invention.

[0054] Figure 5The diagram shows a simplified representation of the integrated anomaly prediction and detection method and system based on graph neural networks according to the present invention. Detailed Implementation

[0055] refer to Figure 1 and Figure 2 An integrated anomaly prediction and detection method based on graph neural networks includes the following steps:

[0056] Step S101: Obtain initial network service data and chemical plant data:

[0057] Network service data collection involves using network probes to capture data packets in real time and extracting information from the packets, including host IP addresses, network entity types, host behaviors, and network entity behavior types.

[0058] For example, the network entity type can be a process, a file, etc.

[0059] For example, the network entity behavior type can be read, write, etc.

[0060] Chemical plant data acquisition uses temperature sensors, pressure sensors, etc., to monitor the temperature, pressure, and liquid level of reactors and the temperature and pressure of pipelines in real time, while also identifying the type of chemical production equipment and the type of material behavior.

[0061] For example, the type of chemical production equipment can be a reactor, pipeline, etc.

[0062] For example, the material behavior type can be low temperature, medium temperature, high temperature, low pressure, medium pressure, high pressure, etc.

[0063] Step S102: Based on the network service data and chemical plant data, construct the mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID:

[0064] Based on regular expressions, network entity types, network entity behavior types, chemical production equipment types, and material behavior types are extracted from real-time or batch-acquired network service data and chemical plant data. Numerical IDs are used to uniquely identify each of these network entity types, network entity behavior types, chemical plant chemical production equipment types, and material behavior types, starting from 0 and gradually increasing to identify each of these types respectively.

[0065] Construct mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID.

[0066] Step S103: Construct a simplified matrix sequence using the dual-time window technique and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type, and their IDs.

[0067] For the initial network service data and chemical plant data within the time slice, the mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID are used to map the network entity type, network entity behavior type, chemical production equipment type, and material behavior type to the network entity type ID, network entity behavior type ID, chemical production equipment type ID, and material behavior type ID, respectively.

[0068] And respectively count the number of network entity type IDs, network entity behavior type IDs, chemical production equipment type IDs, and material behavior type IDs;

[0069] Construct a network entity type matrix, a network entity behavior type matrix, a chemical production equipment type matrix, and a material behavior type matrix;

[0070] The network entity type matrix, the network entity behavior type matrix, the chemical production equipment type matrix, and the material behavior type matrix are concatenated together in ID order to construct the simplified matrix (e.g., Figure 4 Example).

[0071] The simplified matrix sequence is constructed using the multiple simplified matrices of the multiple time slices. The dual-time-window technique includes two time-window techniques: fixed-time-window and cumulative-time-window. The fixed-time-window technique uses the same time interval to segment the initial network service data and chemical plant data; the cumulative-time-window technique uses the same time interval to cumulatively increase the time slice length to segment the initial network service data and chemical plant data, and forgets the initial network service data and chemical plant data within the time window according to a certain forgetting rate. Simultaneously, the network service data and chemical plant data are separated using both time windows, and two simplified matrix sequences are constructed respectively.

[0072] Distinguishing between two types of simplified matrix sequences can be better used to identify anomalies that are uniformly distributed over time (fixed time window) and anomalies that accumulate over time (cumulative time window technique).

[0073] Step S104: Construct a simplified diagram based on the simplified matrix described in step S103:

[0074] The simplified diagram includes: entity type nodes, behavior type nodes, and edges.

[0075] The network entity types and chemical production equipment types in the simplified matrix constitute the entity type nodes in the simplified diagram.

[0076] The network entity behavior type and the material behavior type that connect two entity type nodes in the simplified matrix constitute the behavior type node in the simplified diagram.

[0077] The connections between entity type nodes and behavior type nodes constitute the edges in the simplified graph.

[0078] Figure 5 This is an example of a simplified diagram of this embodiment.

[0079] Step S105: Extract the corresponding simplified graph vector from the simplified graph based on the graph neural network:

[0080] For each type of node (including entity type nodes and behavior type nodes) in the simplified diagram, use a linear transformation: Convert the node vector of the aforementioned type into a node transformation vector, where It is a type node vector. It is a weight matrix. It is the node transformation vector;

[0081] The attention coefficient between adjacent types of nodes in the simplified graph is calculated using an attention mechanism: Where a is the attention weight vector, It is the activation function, || represents the concatenation operation, and N(i) represents the set of neighbors of node i;

[0082] The attention coefficients are used to aggregate the transformation vectors of all neighboring nodes for each type of node, and the aggregated vectors are used as the type feature vectors of the type of node. ,in It is a non-linear activation function. It is a type feature vector;

[0083] Using a multi-head attention mechanism, the type feature vector is extracted for each attention head, and the outputs of all attention heads are concatenated together: , where k is the index of the attention head;

[0084] Global average pooling is performed on all feature vectors of the aforementioned types in the simplified graph to obtain the simplified graph vector.

[0085] Step S106: Obtain a simplified graph matrix prediction model based on the simplified matrix sequence as training data.

[0086] The simplified matrix sequence described in step S103 is divided into training set data and test set data.

[0087] Using three different linear transformation matrices ( , , The training set simplified matrix Perform linear transformations on vectors in the vector representation: , , ,in , , These are the three attention vectors of attention head i. , , It is the weight matrix of the three attention vectors corresponding to attention head i;

[0088] Calculate attention score: ,in It is a scaling factor. It is an attention score;

[0089] The attention score and the vector are weighted and aggregated to obtain a weighted aggregated vector: ,in It is a weighted aggregate vector;

[0090] Using a multi-head attention mechanism, the weighted aggregation vector is extracted for each attention head, and the outputs of all attention heads are concatenated together to form a concatenated vector: ,in It is a concatenation of vectors;

[0091] The attention vector is obtained by performing a linear transformation on the concatenated vector: ,in It is an attention vector. It is the linear transformation matrix of the concatenated vectors.

[0092] Update the vector forgetting rate and memory rate using the attention vectors described in each time slice:

[0093] , ,

[0094] in It is the vector memory rate. It is the vector forgetting rate. It is the attention vector at time t. It is the hidden state at time t-1. and These are the weight matrices for the vector forgetting rate and the vector remembering rate, respectively. and These are the bias terms for the vector forgetting rate and the vector remembering rate, respectively;

[0095] Memory is updated using the forgetting rate and the memory rate: , ,in It's about changing the vector. Cumulative vector, It changes the weight matrix of the vector. It changes the bias term of the vector;

[0096] Finally, the attention vector for the next time slice is calculated using the attention vectors obtained from each time slice: , = , ,in It updates the vector. It is the weight matrix of the update vector. It is the bias term for updating the vector, and FC is a fully connected layer.

[0097] For all vectors in the reduced matrix, calculate the attention vector for the next time slice, and all the attention vectors constitute the reduced matrix for the next time slice.

[0098] Step S107: Obtain an anomaly detection model based on the simplified graph as training data, and detect data anomalies in each time slice based on the anomaly detection model:

[0099] The simplified graph obtained in step S104 is divided into training set data and test set data. The simplified graph of the training set data does not include the type nodes that have anomalies, while the simplified graph of the test set data does include the type nodes that have anomalies.

[0100] The simplified training set graph is converted into simplified graph vectors. For all the obtained simplified graph vectors, k simplified graph vectors are randomly selected as centers; the distances from all simplified graph vectors to the centers are calculated: d ,in It is a simplified graph vector. It is a simplified graph vector with the center as its center;

[0101] The simplified graph vector is then assigned to the cluster closest to it; the cluster center is updated using the mean of all simplified graph vectors within the cluster. ,in It is the j-th cluster. It is a cluster The number of simplified graph vectors contained; iterating through the cluster centers until the change in the cluster centers is less than the threshold o, to obtain the anomaly detection model.

[0102] When performing data anomaly detection based on the anomaly detection model, the simplified test set data graph is converted into a simplified test set data graph vector. The distance from the simplified test set data graph vector to each center is calculated. If the minimum distance of each center is greater than a certain threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph; otherwise, it is a normal simplified graph.

[0103] This invention can solve problems such as aging equipment in chemical plants, network attacks targeting chemical plants and subsequent damage to chemical equipment in an integrated manner. At the same time, it can also solve security problems in the part of chemical plants that are connected to the Internet, and can predict security problems while detecting them.

[0104] The above description is merely a description of preferred embodiments of this application and is not intended to limit the scope of this application in any way. Any changes or modifications made by those skilled in the art based on the above-disclosed technical content should be considered as equivalent and valid embodiments and fall within the scope of protection of the technical solution of this application.

Claims

1. An integrated anomaly prediction and detection method based on graph neural networks, characterized in that, Includes the following steps: Step 1: Obtain initial network service data and chemical plant data: Network service data collection involves using network probes to capture data packets in real time and extracting information from the packets, including host IP addresses, network entity types, host behaviors, and network entity behavior types. Chemical plant data acquisition uses temperature and pressure sensors to monitor the temperature, pressure, and liquid level of reactors and the temperature and pressure of pipelines in real time, while also identifying the type of chemical production equipment and the type of material behavior. Step 2: Based on the network service data and chemical plant data, construct the mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID; Step 3: Construct a simplified matrix sequence using the dual time window technique and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and their IDs; Step 4: Construct a simplified diagram based on the simplified matrix described in Step 3; The simplified diagram includes: entity type nodes, behavior type nodes, and edges; wherein... The network entity types and chemical production equipment types in the simplified matrix constitute the entity type nodes in the simplified diagram. The network entity behavior type and the material behavior type that connect two entity type nodes in the simplified matrix constitute the behavior type node in the simplified diagram. The connections between the entity type nodes and the behavior type nodes constitute the edges in the simplified graph; Step 5: Extract the corresponding simplified graph vector from the simplified graph based on the graph neural network; Step 6: Based on the simplified matrix sequence described in Step 3 as training data, obtain the simplified graph matrix prediction model: Step 7: Obtain an anomaly detection model based on the simplified graph as training data, and detect data anomalies in each time slice based on the anomaly detection model.

2. The integrated anomaly prediction and detection method based on graph neural networks according to claim 1, characterized in that, Step 2 is as follows: Based on regular expressions, network entity types, network entity behavior types, chemical production equipment types, and material behavior types are extracted from real-time or batch-acquired network service data and chemical plant data. Numerical IDs are used to uniquely identify each of these network entity types, network entity behavior types, chemical plant chemical production equipment types, and material behavior types, starting from 0 and gradually increasing to identify each of these types respectively. Construct mapping relationships between the network entity type and network entity type ID, the network entity behavior type and network entity behavior type ID, the chemical production equipment type and chemical production equipment type ID, and the material behavior type and material behavior type ID.

3. The integrated anomaly prediction and detection method based on graph neural networks according to claim 1, characterized in that, Step 3 specifically involves: For the initial network service data and chemical plant data within the time slice, the mapping relationships between network entity type and network entity type ID, network entity behavior type and network entity behavior type ID, chemical production equipment type and chemical production equipment type ID, and material behavior type and material behavior type ID are used to map the network entity type, network entity behavior type, chemical production equipment type and material behavior type to network entity type ID, network entity behavior type ID, chemical production equipment type ID and material behavior type ID, respectively. And respectively count the number of network entity type IDs, network entity behavior type IDs, chemical production equipment type IDs, and material behavior type IDs; Construct a network entity type matrix, a network entity behavior type matrix, a chemical production equipment type matrix, and a material behavior type matrix; The network entity type matrix, the network entity behavior type matrix, the chemical production equipment type matrix, and the material behavior type matrix are concatenated together in ID order to construct the simplified matrix; Construct a sequence of simplified matrices using multiple simplified matrices across multiple time slices; The dual time window technology includes two time window techniques: fixed time window technology and cumulative time window technology; The fixed time window technique uses the same time interval to divide the initial network service data and chemical plant data; the cumulative time window technique uses the same time interval to cumulatively increase the time slice length to divide the initial network service data and chemical plant data, and forgets the initial network service data and chemical plant data within the time window according to a certain forgetting rate. At the same time, the two time windows are used to separate the network service data and chemical plant data, and two simplified matrix sequences are constructed respectively.

4. The integrated anomaly prediction and detection method based on graph neural networks according to claim 1, characterized in that, Step 5 specifically involves: For each type of node in the simplified graph, a linear transformation is applied: Convert the node vector of the aforementioned type into a node transformation vector, where It is a type node vector. It is a weight matrix. It is the node transformation vector; The attention coefficient between adjacent types of nodes in the simplified graph is calculated using an attention mechanism: Where a is the attention weight vector, It is the activation function, || represents the concatenation operation, and N(i) represents the set of neighbors of node i; The attention coefficients are used to aggregate the transformation vectors of all neighboring nodes for each type of node, and the aggregated vectors are used as the type feature vectors of the type of node. ,in It is a non-linear activation function. It is a type feature vector; Using a multi-head attention mechanism, extract the type feature vector for each attention head, and concatenate the outputs of all attention heads together: , where k is the index of the attention head; Global average pooling is performed on all feature vectors of the aforementioned types in the simplified graph to obtain the simplified graph vector.

5. The integrated anomaly prediction and detection method based on graph neural networks according to claim 1, characterized in that, Step 6 specifically involves: Divide the simplified matrix sequence described in step 3 into training set data and test set data; Using three different linear transformation matrices ( , , The training set simplified matrix Perform linear transformations on vectors in the vector representation: , , ,in , , These are the three attention vectors of attention head i. , , It is the weight matrix of the three attention vectors corresponding to attention head i; Calculate attention score: ,in It is a scaling factor. It is an attention score; The attention score and the vector are weighted and aggregated to obtain a weighted aggregated vector: ,in It is a weighted aggregate vector; Using a multi-head attention mechanism, the weighted aggregation vector is extracted for each attention head, and the outputs of all attention heads are concatenated together to form a concatenated vector: ,in It is a concatenation of vectors; The attention vector is obtained by performing a linear transformation on the concatenated vector: ,in It is an attention vector. It is a linear transformation matrix for concatenating vectors; Update the vector forgetting rate and memory rate using the attention vectors described in each time slice: ， ， in It is the vector memory rate. It is the vector forgetting rate. It is the attention vector at time t. It is the hidden state at time t-1. and These are the weight matrices for the vector forgetting rate and the vector remembering rate, respectively. and These are the bias terms for the vector forgetting rate and the vector remembering rate, respectively; Memory is updated using the forgetting rate and the memory rate: , ,in It's about changing the vector. Cumulative vector, It changes the weight matrix of the vector. It changes the bias term of the vector; Finally, the attention vector for the next time slice is calculated using the attention vectors obtained from each time slice: , = , ,in It updates the vector. It is the weight matrix of the update vector. It is the bias term for updating the vector; FC stands for fully connected layer. For all vectors in the reduced matrix, calculate the attention vector for the next time slice, and all the attention vectors constitute the reduced matrix for the next time slice.

6. The integrated anomaly prediction and detection method based on graph neural networks according to claim 1, characterized in that, Step 7 specifically includes: The simplified graph obtained in step 4 is divided into training set data and test set data. The simplified graph of the training set data does not include the type nodes that have anomalies, while the simplified graph of the test set data does include the type nodes that have anomalies. The simplified training set graph is converted into simplified graph vectors; for all the obtained simplified graph vectors, k simplified graph vectors are randomly selected as centers; the distances from all simplified graph vectors to the centers are calculated: d ,in It is a simplified graph vector. It is a simplified graph vector with the center as its center; The simplified graph vector is then assigned to the cluster closest to it; the cluster center is updated using the mean of all simplified graph vectors within that cluster. ,in It is the j-th cluster. It is a cluster The number of simplified graph vectors contained; iterating through the cluster centers until the change in the cluster centers is less than the threshold o, to obtain the anomaly detection model; When performing data anomaly detection based on the anomaly detection model, the simplified test set data graph is converted into a simplified test set data graph vector. The distance from the simplified test set data graph vector to each center is calculated. If the minimum distance of each center is greater than the threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph; otherwise, it is a normal simplified graph.

7. An integrated anomaly prediction and detection system based on graph neural networks, implementing any one of the integrated anomaly prediction and detection methods based on graph neural networks according to claims 1 to 6, characterized in that, include: Data acquisition and processing module, simplified matrix prediction module, and anomaly detection module; The data acquisition and processing module acquires initial network service data and chemical plant data. Based on the network service data and chemical plant data, it constructs mapping relationships between network entity types and network entity type IDs, network entity behavior types and network entity behavior type IDs, chemical production equipment types and chemical production equipment type IDs, and material behavior types and material behavior type IDs. A simplified matrix sequence is constructed using the dual time window technique and the mapping relationship between the network entity type, the network entity behavior type, the chemical production equipment type, the material behavior type and their IDs; Construct a simplified diagram based on the simplified matrix; The simplified matrix prediction module extracts the corresponding simplified graph vector from the simplified graph based on the graph neural network, and obtains the simplified graph matrix prediction model based on the simplified matrix sequence as training data. The anomaly detection module obtains an anomaly detection model based on the simplified graph as training data, and detects data anomalies in each time slice based on the anomaly detection model.

8. The integrated anomaly prediction and detection system based on graph neural networks according to claim 7, characterized in that, The simplified matrix prediction module extracts corresponding simplified graph vectors from the simplified graph based on a graph neural network, and obtains a simplified graph matrix prediction model based on the simplified matrix sequence as training data, including: For each type node in the simplified graph, a linear transformation is used to convert the type node vector into a node transformation vector; an attention mechanism is used to calculate the attention coefficients between adjacent type nodes in the simplified graph; the node transformation vectors of all neighbors of each type node are aggregated using the attention coefficients, and the aggregated vector is used as the type feature vector of the type node; a multi-head attention mechanism is used to extract the type feature vector for each attention head, and the outputs of all attention heads are concatenated together; global average pooling is performed on all type feature vectors in the simplified graph to obtain the simplified graph vector. The simplified matrix sequence is divided into training set data and test set data. Three different linear transformation matrices are used to perform linear transformations on the vectors in the simplified training set matrix to obtain three attention vectors for each attention head. Attention scores are calculated, and the attention scores are weighted and aggregated with the vectors to obtain a weighted aggregated vector. A multi-head attention mechanism is used to extract the weighted aggregated vector for each attention head, and the outputs of all attention heads are concatenated to form a concatenated vector. The concatenated vector is then subjected to a linear transformation to obtain the attention vector. The forgetting rate and memory rate of the vectors are updated using the attention vectors in each time slice, and memory updates are performed using the forgetting rate and memory rate. Finally, the attention vector for the next time slice is calculated using the attention vectors in each time slice. The attention vector for the next time slice is calculated for all vectors in the simplified matrix, and all attention vectors constitute the simplified matrix for the next time slice.

9. The integrated anomaly prediction and detection system based on graph neural networks according to claim 7, characterized in that, The anomaly detection module uses the simplified graph as training data to obtain an anomaly detection model, and uses the anomaly detection model to detect data anomalies in each time slice, including: The simplified graph is divided into training set data and test set data; the simplified graph of the training set data does not include the type nodes that have anomalies, while the simplified graph of the test set data does; The training set simplified graph is converted into simplified graph vectors; for all the obtained simplified graph vectors, k simplified graph vectors are randomly selected as centers; the distance from all simplified graph vectors to the centers is calculated, and the simplified graph vectors are assigned to the clusters closest to the simplified graph vectors; the corresponding cluster centers are updated using the mean of all simplified graph vectors in the cluster; the cluster centers are iterated until the change in the cluster centers is less than the threshold o, and the anomaly detection model is obtained. When performing data anomaly detection based on the anomaly detection model, the simplified test set data graph is converted into a simplified test set data graph vector. The distance from the simplified test set data graph vector to each center is calculated. If the minimum distance of each center is greater than the threshold ab, the corresponding simplified graph is marked as an abnormal simplified graph; otherwise, it is a normal simplified graph.

Images