Risk prediction system and method for digital water conservancy and water industry control

Abstract

A risk prediction system and method for digital water conservancy and water affairs industrial control belongs to the field of risk prevention and control technology. In the system, the process operation probe is used to obtain the dosing instructions and interference items to the dosing instructions sent by the host computer and provide them to the risk control platform, and the process parameter probe is used to obtain water quality information and then provide it to the risk control platform; the risk control platform includes a digital model and a risk prediction module, and the digital model is a model for generating water quality indicators based on the dosing instructions and the interference items to the dosing instructions; the risk prediction module infers whether the interference item is out-of-distribution data, if it is out-of-distribution data, the interference item is determined to be data generated by malware, and if it is in-distribution data, the interference item is determined to be normal noise. The present invention can automatically identify whether the interference item is out-of-distribution data or in-distribution data, filter the in-distribution data, and intercept the out-of-distribution data, so as to prevent risks related to digital water conservancy and water affairs before they occur.

Description

Technical Field

[0001] The invention relates to a risk prediction system and method for digital water conservancy and water affairs industrial control, belonging to the technical field of risk prevention and control. Background Art

[0002] Water utilities rely on system control and data acquisition (SCADA) systems to manage automated processes or the distribution and treatment of water. Many industrial control systems can be connected over the internet, making them vulnerable to attacks.

[0003] To solve the above problems, a Chinese invention patent application with publication number CN118504923A discloses a water management system and method based on digital twin and artificial intelligence, wherein the system comprises: a water data terminal and an inspection terminal, wherein the water data terminal comprises a data acquisition module, a data processing module and a data analysis module; the data acquisition module is used to obtain the water data collected by each front-end node and the working parameter information of each front-end node, and send the water data and the working parameter information to the data processing module and the data analysis module respectively, wherein the front-end node comprises at least intelligent instruments, sensors and intelligent controllers; the data processing module is used to receive the water data and the working parameter information sent by the data acquisition module, process the received water data, and send the processed water data and the working parameter information to the data analysis module; the data analysis module A block is used to perform risk assessment according to the working parameter information and the processed water service data, and upload the risk assessment result to the inspection terminal; the inspection terminal is used to obtain the inspection data uploaded by the inspection personnel, and output corresponding inspection prompts according to the risk assessment result and the inspection data; wherein the data processing module is used to set the first level sampling with the water service data collected by each front-end node as the original data, set the next level sampling every preset number based on the first sampling, set the next level sampling every preset number based on the next level sampling, so as to obtain the multi-level sampling corresponding to the water service data, obtain a number of water service data from each level of sampling according to a window of preset length, determine the cluster center of each level of sampling based on the several water service data through clustering, determine the noise water service data in each level of sampling according to each cluster center, and remove the noise water service data to obtain the processed water service data; The data processing module is further used to determine the source of noise in the water service data, determine the target reconstruction model according to the noise source, and reconstruct the denoised water service data based on the target reconstruction model, wherein the noise source includes the noise of the collected signal itself and the signal transmission noise; the data analysis module is further used to determine the abnormal indicators and abnormal values ​​of each front-end node according to the working parameter information and the processed water service data, determine the abnormal dimension based on the abnormal type of the abnormal indicator and the abnormal size of the abnormal value, and perform risk assessment on each front-end node according to the number of dimensions and the size of the abnormal dimension; the data analysis module is further used to determine a group of front-end nodes with the same data monitoring type according to the working parameter information, determine the data mean point according to the water service data collected by each front-end node in the group, determine the water service data in the group that differs the most from the data mean point, and use the water service data that differs the most from the data mean point as a suspicious value, and judge whether the suspicious value is within a preset range. If not, the suspicious value is determined to be an abnormal value, and the preset range is determined by the monitoring type corresponding to the suspicious value.

[0004] However, the invention patent application does not disclose how to use similarity functions to judge interference items. Summary of the invention

[0005] The purpose of the present invention is to provide a risk prediction system and method for digital water conservancy and water affairs industrial control, which provides a new method that can automatically identify whether the interference item is distributed data or distributed data, filter the distributed data, and intercept the distributed data, so as to prevent digital water conservancy and water affairs related risks before they occur.

[0006] To achieve the above-mentioned purpose, the present invention provides a risk prediction system for digital water conservancy and water industry control, which includes a process operation probe, a process parameter probe and a risk control platform, wherein the process operation probe is used to obtain the dosing instruction sent by the host computer. And dosing instructions Interference The process parameter probe is used to obtain water quality information, which is then provided to the risk control platform. The risk control platform includes a digital model and a risk prediction module. The digital model is based on the dosing instructions. and interference with dosing instructions Models that generate water quality indicators; risk prediction modules infer interference terms Is it out-of-distribution data? If it is out-of-distribution data, determine the interference item Data generated by malware, if it is a data interference item in the distribution For normal noise, the risk prediction module infers the interference term through the following steps Whether it is out-of-distribution data:

[0007] S1-1: Constructing interference items Similarity function for similarity to patterns in the set X of patterns within the distribution:

[0008] ,

[0009] Where X represents the set of patterns within the distribution, is the aggregation parameter, , , N is the number of pattern items in the pattern set X in the distribution, is the logarithmic exponential function;

[0010] S1-2: Similarity function is compared with the threshold, if the similarity function The value of is less than or equal to the threshold, then the interference term Belongs to the data within the distribution. If it is greater than the threshold, the interference term This is out-of-distribution data.

[0011] To achieve the above-mentioned purpose, the present invention also provides a risk prediction method for digital water conservancy and water industry control, which comprises the following steps:

[0012] Step 1: Obtain the dosing instruction sent by the host computer through the process operation probe and interference with dosing instructions And provide it to the risk control platform;

[0013] Step 2: Use process parameter probes to obtain water quality information, and then provide it to the risk control platform;

[0014] Step 3: Use the digital model of the risk control platform according to the dosing instructions and interference with dosing instructions Generate water quality indicators;

[0015] Step 4: Infer interference items through the risk prediction module of the risk control platform Is it out-of-distribution data? If it is out-of-distribution data, determine the interference item Data generated by malware, if it is a data interference item in the distribution For normal noise, the risk prediction module infers the interference term through the following steps Whether it is out-of-distribution data:

[0016] S1-1: Constructing interference items Similarity function for similarity to patterns in the set X of patterns within the distribution:

[0017] ,

[0018] Where X represents the set of patterns within the distribution, is the aggregation parameter, , , N is the number of pattern items in the pattern set X in the distribution, is the logarithmic exponential function;

[0019] S1-2: Similarity function The value of is compared with the threshold value. If the similarity function The value of is less than or equal to the threshold, then the interference term Belongs to the data within the distribution. If it is greater than the threshold, the interference term This is out-of-distribution data.

[0020] Compared with the prior art, the risk prediction system and method for digital water conservancy and water affairs industry control provided by the present invention have the following beneficial effects: the present invention constructs a similarity function of the similarity between the interference term and the pattern in the distribution pattern set, compares the value of the similarity function with the threshold, and then judges whether the interference term belongs to the data within the distribution or the data outside the distribution based on the comparison result, filters the data within the distribution, and intercepts the data outside the distribution, so as to prevent risks related to digital water conservancy and water affairs before they occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a block diagram of the composition of the risk prediction system for digital water conservancy and water affairs industry control provided by the present invention. DETAILED DESCRIPTION

[0022] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0023] In the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0024] First embodiment

[0025] In the present invention, the digital water conservancy and water affairs industrial control device includes a host computer, a PLC, an industrial control actuator, a reaction pool and a sensor, wherein the sensor is used to detect the water quality of the water in the reaction pool and provide the water quality information to the PLC; the PLC transmits the water quality information to the host computer after processing, and the host computer generates a dosing instruction according to the water quality information; the PLC transmits the dosing instruction to the industrial control mechanism; the industrial control mechanism doses the drug to the reaction pool according to the dosing instruction. The reaction pool includes a first water pump, a pressure transmitter, a water ejector, a second water pump, a third water pump and a control device, wherein the pressure transmitter is used to transform the pressure of the clean water for dissolving the drug provided by the first water pump and then mix it with the drug provided by the industrial control mechanism in the water ejector to obtain a drug aqueous solution, and then spray it into the reaction pool through a nozzle, the second water pump is used to pump the raw water to be disinfected into the reaction pool; the third water pump is used to extract water in the reaction pool and spray it into the reaction pool through a sprayer. The drug at least includes chlorine and hypochlorous acid.

[0026] In the first embodiment, the sensor includes at least a pH sensor, a dissolved oxygen sensor, a conductivity sensor, a turbidity sensor, a chemical oxygen demand sensor, an ammonia nitrogen sensor, a residual chlorine sensor, an ORP sensor, etc. The pH sensor is used to measure the pH value of the water body, and the pH sensor obtains the pH value by detecting the concentration of hydrogen ions; the dissolved oxygen sensor is used to monitor the content of dissolved oxygen in the water, and the dissolved oxygen sensor can monitor the changes of dissolved oxygen in the water in real time; the conductivity sensor is used to detect the concentration of total ions in the water, and the concentration of total ions reflects the purity of the water quality. The conductivity sensor can be divided into electrode type, inductive type and ultrasonic type according to different measurement principles. The turbidity sensor is used to measure the content of suspended solids in the water, and the content of suspended solids in the water directly reflects the clarity of the water. The turbidity sensor is used to measure the turbidity of water. The chemical oxygen demand sensor is used to measure the content of organic matter that can be chemically oxidized in the water body. The ammonia nitrogen sensor is used to monitor the ammonia nitrogen content in the water body, and the ammonia nitrogen content is used to assess the degree of influence of agricultural and domestic sewage on the water body. The ammonia nitrogen sensor is usually detected by electrochemical or spectroscopy. ‌Residual chlorine sensors are used to detect the content of free chlorine, monochloramine and total chlorine in water samples. ORP sensors are used to measure the oxygen reduction potential of water bodies and are often used together with pH sensors.

[0027] Figure 1 It is a block diagram of the risk prediction system of digital water conservancy and water industry control. Figure 1 As described above, the first embodiment of the present invention provides a risk prediction system for digital water conservancy and water industry control, including: a process operation probe, a process parameter probe and a risk control platform, wherein the process operation probe is used to obtain the dosing instructions sent by the host computer and provide them to the risk control platform, and the process parameter probe is used to obtain the water quality information of the water in the reaction tank, and then provide it to the risk control platform.

[0028] In the first embodiment, the risk control platform includes a digital model and a risk prediction module. The digital model is based on the dosing instruction. And dosing instructions Interference Models that generate water quality indicators. Risk prediction modules infer interference factors Is it out-of-distribution data? If it is out-of-distribution data, determine the interference item Data generated by malware, tracking and intercepting malware, if the data in the distribution is determined to be interference Normal noise is filtered through a filter.

[0029] In the first embodiment, the risk prediction module infers interference terms through the following steps: Whether it is out-of-distribution data:

[0030] S1-1: Constructing interference items Similarity function for similarity to patterns in the set X of patterns within the distribution:

[0031] ,

[0032] Where X represents the set of patterns within the distribution, is the aggregation parameter, , , N is the number of pattern items in the pattern set X in the distribution, is the logarithmic exponential function;

[0033] S1-2: Similarity function Compared with the threshold, if the similarity function is less than or equal to the threshold, then the interference term Belongs to the data within the distribution. If it is greater than the threshold, the interference term This is out-of-distribution data.

[0034] In the first embodiment of the present invention, the construction of the digital model at least includes: the digital model is based on the dosing instruction and interference with dosing instructions Generate a control strategy and simulate the dosing of the industrial control actuator according to the control strategy. The control strategy is recorded as: , The digital model simulates the water quality index obtained by adding medicine by the industrial control actuator according to the control strategy at time k, and θ is the parameter of the control strategy.

[0035] In the first embodiment, the training of the digital model includes the following process:

[0036] S2-1: Digital model executes series of dosing instructions , obtain a series of water quality indicators , get a series of rewards ; K is a positive integer greater than or equal to 2;

[0037] S2-2: Calculate the regression parameters by the following formula:

[0038] ,

[0039] In the formula, is the discount factor; is the value function, is the parameter of the value function;

[0040] S2-3: Update the parameters of the control strategy through the following formula:

[0041] ,

[0042] In the formula, is the learning coefficient, Yes gradient.

[0043] In the first embodiment, the reward Obtain it by following the steps below:

[0044] Calculate water quality indicators under the control of digital models and control strategies And the water quality indicators obtained by the industrial control execution agency after adding drugs in the dosing instruction If the absolute value of the deviation is less than the set value, then Take positive value, otherwise take 0.

[0045] The first embodiment constructs a similarity function between the interference term and the pattern in the pattern set within the distribution, compares the value of the similarity function with a threshold, and then determines whether the interference term belongs to the data within the distribution or the data outside the distribution based on the comparison result, filters the data within the distribution, and intercepts the data outside the distribution, so as to prevent risks related to digital water conservancy and water services before they occur.

[0046] In the first embodiment of the present invention, the interference term Malware that is intercepted and tracked includes:

[0047] S3-1: An undirected knowledge graph is constructed with multiple existing malware that send interference items as entities and the relationships between existing malware as edges. Malware refers to computer software that can perform malicious behaviors. Each node in the undirected knowledge graph stores two attributes, one is its most similar node, recorded as the MSTo attribute, and the other is the set of nodes with it as the most similar node, recorded as the MSFrom attribute;

[0048] S3-2: Cluster the existing malware according to the undirected knowledge graph and divide it into multiple clusters to obtain the malware cluster set CL = [CL1, ..., CL u , …, CL U ],A malware cluster is a malware family, and malware in the same family has some commonalities in terms of code structure, functional implementation, etc.;

[0049] S3-3: Calculate the newly discovered malware S NEW With each cluster CL in the existing cluster set CL u If the repulsion of u If they are mutually exclusive, execute S3-5; if there are non-exclusive clusters, the non-exclusive cluster set is recorded as CL ~ =[CL1,…, CL q , …, CL Q ], then calculate the newly discovered malware S NEWThe similarity Sim(S NEW ,CL q );

[0050] S3-4: If Sim(S NEW ,CL q ) is less than the threshold, execute S05; if Sim(S NEW ,CL q ) is greater than or equal to the threshold, the newly discovered malware S NEW Place in Sim(S NEW ,CL q ) in the largest cluster;

[0051] S3-5: Based on the newly discovered malware S NEW Create a new cluster CL NEW , and cluster CL NEW Join the cluster set CL;

[0052] S3-6: Repeat S3-3, S3-4, and S3-5 until all newly discovered malware S NEW Clustering is complete.

[0053] In the first embodiment, the newly discovered malware S is calculated. NEW With each cluster CL in the existing cluster set CL u The repulsion includes the following steps: making the newly discovered malware S NEW With malwareS qw Generate their subsequences respectively. If the two subsequences are different, then the malware S NEW With malwareS qw Repel each other.

[0054] In the first embodiment, the newly discovered malware S NEW The similarity Sim(S NEW ,CL q ) is obtained by the following steps:

[0055] S4-1: Newly discovered malware S NEW Decompile to obtain an assembly file, extract strings and reference addresses of strings from the assembly file, for example, by using binary analysis tools such as ida and Ghidra to decompile malware to obtain an assembly file, extract strings and reference addresses of strings from the assembly file, such as " / proc / cpuinfo" and "0040a45c";

[0056] S4-2: composing a sequence of the extracted character strings and the reference addresses of the character strings; and sorting the sequence according to the reference addresses of the character strings to generate an ascending sequence of character strings;

[0057] S4-3: Calculate the newly discovered malware S by the following formula NEW With each non-exclusive cluster CL in the set of non-exclusive clusters q Malware in S qw SimilaritySim(S NEW ,S qw ):

[0058] ,

[0059] In the formula, S NEW Represents an increasing sequence of strings extracted from newly discovered malware; S qw Indicates CL q Incremental sequence of strings extracted from the wth malware in the cluster; LCS(S NEW ,S qw ) indicates S NEW With S qw The longest common subsequence length; Sim(S NEW ,S qw ) ranges from [0,1]. The larger the value, the higher the similarity between the ascending sequences.

[0060] S4-4: Take the newly discovered malware S NEW With each non-exclusive cluster CL in the set of non-exclusive clusters k S qw The malware with the greatest similarity is taken as malware S NEW The similarity Sim(SNEW,CL) with each non-exclusive cluster in the non-exclusive cluster set q );Length of S qw Length of S is the longest subsequence length of the incremental sequence of the newly discovered malware SNEW; qw For malware S qw The longest subsequence length of an increasing sequence.

[0061] The present invention can track malware that publishes abnormal interference items through the above technical solution with very little computing power overhead.

[0062] Second embodiment

[0063] The second embodiment of the present invention only describes the contents that are different from the first embodiment, and the same contents will not be described repeatedly.

[0064] A risk prediction method for digital water conservancy and water industry control provided by the second embodiment of the present invention comprises the following steps:

[0065] Step 1: Obtain the dosing instruction sent by the host computer through the process operation probe And dosing instructions Interference And provide it to the risk control platform;

[0066] Step 2: Use process parameter probes to obtain water quality information, and then provide it to the risk control platform;

[0067] Step 3: Use the digital model of the risk control platform according to the dosing instructions and interference with dosing instructions Generate water quality indicators;

[0068] Step 4: Infer interference items through the risk prediction module of the risk control platform Is it out-of-distribution data? If it is out-of-distribution data, determine the interference item Data generated by malware, if it is a data interference item in the distribution For normal noise, the risk prediction module infers the interference term through the following steps Whether it is out-of-distribution data:

[0069] S1-1: Constructing interference items Similarity function for similarity to patterns in the set X of patterns within the distribution:

[0070] ,

[0071] Where X represents the set of patterns within the distribution, is the aggregation parameter, , , N is the number of pattern items in the pattern set X in the distribution, is the logarithmic exponential function;

[0072] S1-2: Similarity function The value of is compared with the threshold value. If the similarity function The value of is less than or equal to the threshold, then the interference term Belongs to the data within the distribution. If it is greater than the threshold, the interference item This is out-of-distribution data.

[0073] The beneficial effects of the second embodiment of the present invention are the same as those of the first embodiment, and will not be described again here.

[0074] The present invention also provides a system, which includes a storage medium and one or more processors, wherein the storage medium stores a computer program, and the computer program is called by the one or more processors to implement the above method.

[0075] The present invention also provides a computer program product, which utilizes a computer language to compile the above method into a computer program that is called and executed by one or more processors.

[0076] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A risk prediction system for digital water conservancy and water industry control, which includes a process operation probe, a process parameter probe and a risk control platform, wherein: The process operation probe is used to obtain the dosing instructions sent by the host computer and interference with dosing instructions The process parameter probe is used to obtain water quality information, which is then provided to the risk control platform. The risk control platform includes a digital model and a risk prediction module. The digital model is based on the dosing instructions. And dosing instructions Interference Models that generate water quality indicators; risk prediction modules infer interference terms Is it out-of-distribution data? If it is out-of-distribution data, determine the interference item Data generated by malware, if it is a data interference item in the distribution is normal noise; the risk prediction module infers the interference term through the following steps Whether it is out-of-distribution data: S1-1: Constructing interference items Similarity function for similarity to patterns in the set X of patterns within the distribution: , Where X represents the set of patterns within the distribution, is the aggregation parameter, , , N is the set of patterns within the distribution The number of pattern items in , is the logarithmic exponential function; S1-2: Similarity function The value of is compared with the threshold value. If the similarity function The value of is less than or equal to the threshold, then the interference term Belongs to the data within the distribution. If it is greater than the threshold, the interference term This is out-of-distribution data.

2. The risk prediction system for digital water conservancy and water industry control according to claim 1 is characterized in that: The construction of the digital model at least includes: the digital model is based on the dosing instruction And dosing instructions Interference Generate a control strategy and simulate the dosing of the industrial control actuator according to the control strategy. The control strategy is recorded as: , The digital model simulates the water quality index obtained by adding medicine by the industrial control actuator according to the control strategy at time k, and θ is the parameter of the control strategy.

3. The risk prediction system for digital water conservancy and water industry control according to claim 2 is characterized in that: The training of the digital model includes the following process: S2-1: Digital model executes series of dosing instructions , obtain a series of water quality indicators , get a series of rewards ; K is a positive integer greater than or equal to 2; S2-2: Calculate the regression parameters by the following formula: ， In the formula, is the discount factor; is the value function, is the parameter of the value function; S2-3: Update the parameters of the control strategy through the following formula: , In the formula, is the learning coefficient, Yes gradient.

4. The risk prediction system for digital water conservancy and water industry control according to claim 3 is characterized in that: award Obtain it by following the steps below: Calculate water quality indicators under the control of digital models and control strategies The water quality index obtained by the industrial control executive agency after adding drugs according to the dosing instructions If the absolute value of the deviation is less than the set value, then Take positive value, otherwise take 0.

5. A risk prediction method for digital water conservancy and water industry control, characterized in that The steps include: Step 1: Obtain the dosing instruction sent by the host computer through the process operation probe And dosing instructions Interference And provide it to the risk control platform; Step 2: Use process parameter probes to obtain water quality information, and then provide it to the risk control platform; Step 3: Use the digital model of the risk control platform according to the dosing instructions And dosing instructions Interference Generate water quality indicators; Step 4: Infer interference items through the risk prediction module of the risk control platform Is it out-of-distribution data? If it is out-of-distribution data, determine the interference item Data generated by malware, if it is a data interference item in the distribution is normal noise; the risk prediction module infers the interference term through the following steps Whether it is out-of-distribution data: S1-1: Constructing interference items Similarity function for similarity to patterns in the set X of patterns within the distribution: , Where X represents the set of patterns within the distribution, is the aggregation parameter, , , N is the set of patterns within the distribution The number of pattern items in , is the logarithmic exponential function; S1-2: Similarity function The value of is compared with the threshold value. If the similarity function The value of is less than or equal to the threshold, then the interference term Belongs to the data within the distribution. If it is greater than the threshold, the interference term This is out-of-distribution data.

6. The risk prediction method for digital water conservancy and water industry control according to claim 5 is characterized in that: The construction of the digital model at least includes: the digital model is based on the dosing instruction And dosing instructions Interference Generate a control strategy and simulate the dosing of the industrial control actuator according to the control strategy. The control strategy is recorded as: , The digital model simulates the water quality index obtained by adding medicine by the industrial control actuator according to the control strategy at time k, and θ is the parameter of the control strategy.

7. The risk prediction method for digital water conservancy and water industry control according to claim 6 is characterized in that: The training of the digital model includes the following process: S2-1: Digital model executes dosing instructions , obtain a series of water quality indicators , get a series of rewards , K is a positive integer greater than or equal to 2; S2-2: Calculate the regression parameters by the following formula: In the formula, is the discount factor; is the value function, is the parameter of the value function; S2-3: Update the parameters of the control strategy through the following formula: , In the formula, is the learning coefficient, Yes gradient.

8. The risk prediction method for digital water conservancy and water industry control according to claim 7 is characterized in that: award Obtain it by following the steps below: Calculate water quality indicators under the control of digital models and control strategies The water quality index obtained by the industrial control executive agency after adding drugs according to the dosing instructions If the absolute value of the deviation is less than the set value, then Take positive value, otherwise take 0.

Images