Abnormality detection method, device, equipment, medium and product

Abstract

The invention discloses an anomaly detection method, device, equipment, medium and product, and relates to the technical field of industrial Internet, the method comprises the following steps: obtaining target industrial control network data, the target industrial control network data comprising numerical value feature prototype points and time sequence feature prototype points; and inputting the numerical feature prototype points and the time sequence feature prototype points into a pre-constructed anomaly detection double-contour model to obtain a detection result corresponding to the target industrial control network data, and through the anomaly detection double-contour model, detecting whether the target industrial control network data is abnormal or not in real time without depending on expert experience, so that the detection efficiency is improved. And the anomaly detection efficiency and accuracy of the industrial control system are improved.

Description

Technical Field

[0001] The present application relates to the field of industrial Internet technology, and in particular to an anomaly detection method, device, equipment, medium and product. Background Art

[0002] With the development of communication networks and control, networked industrial control has received more and more attention, but traditional industrial control systems lack defense measures for network information security, which makes industrial control systems face great security challenges.

[0003] Anomaly detection of industrial control systems is an effective technical means to perform security detection on industrial control systems. However, existing anomaly detection methods usually only rely on the periodic characteristics of industrial flow data for anomaly detection, have a high false alarm rate, and often have a high dependence on expert experience, which affects the efficiency and accuracy of anomaly detection.

[0004] Therefore, it is necessary to propose a solution to improve the efficiency and accuracy of anomaly detection in industrial control systems.

[0005] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of this application is to provide an anomaly detection method, device, equipment, medium and product, aiming to improve the efficiency and accuracy of anomaly detection in industrial control systems.

[0007] To achieve the above object, the present application provides an anomaly detection method, the method comprising:

[0008] Acquire target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points;

[0009] The numerical feature prototype points and the time series feature prototype points are input into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data.

[0010] In one embodiment, the step of acquiring target industrial control network data includes:

[0011] Collecting original industrial control network data, and preprocessing the original industrial control network data to obtain processed original industrial control network data;

[0012] Performing feature extraction and prototype point calculation on the processed original industrial control network data through a preset convolutional neural network to obtain numerical feature prototype points; and performing feature extraction and prototype point calculation on the processed original industrial control network data through a preset gated cycle unit to obtain time series feature prototype points;

[0013] The numerical characteristic prototype points and the time series characteristic prototype points are used as the target industrial control network data.

[0014] In one embodiment, the preset convolutional neural network includes an input layer, a fully connected layer, an attention layer, and an output layer. The step of performing feature extraction and prototype point calculation on the processed original industrial control network data by the preset convolutional neural network to obtain the numerical feature prototype point includes:

[0015] Inputting the processed original industrial control network data into the preset convolutional neural network through the input layer, performing convolution and pooling processing, and then inputting the data into the fully connected layer;

[0016] Performing transformation through the fully connected layer to obtain a feature vector, performing weight assignment on the feature vector through the attention layer to obtain an output vector, inputting the output vector to the output layer, and outputting a numerical feature vector according to the prediction step size of the output layer;

[0017] The numerical feature vector is input into the prototype network for calculation to obtain the numerical feature prototype point.

[0018] In one embodiment, the preset gated cycle unit includes a reset gate and an update gate, and the step of extracting features and calculating prototype points on the processed original industrial control network data through the preset gated cycle unit to obtain the time series feature prototype point includes:

[0019] Calculate each candidate hidden state and each hidden state at each moment of the processed original industrial control network data through the reset gate and the update gate;

[0020] Calculating the output layer of the preset convolutional neural network according to each candidate hidden state and the hidden state at each moment to obtain a time series feature vector;

[0021] The time series feature vector is input into the prototype network for calculation to obtain the time series feature prototype point.

[0022] In one embodiment, before the step of inputting the target industrial control network data into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data, the step further includes:

[0023] Acquire original alarm data, and establish an attribute data set according to the original alarm data;

[0024] Performing normalization and attribute simplification processing on the attribute data set to obtain a simplified data set;

[0025] Optimizing the parameters of a single-class support vector machine according to the reduced data set by using a particle swarm algorithm to obtain a single-class support vector machine classifier;

[0026] Selecting test sample data from the reduced data set to obtain a test sample set, and classifying the test sample set by using the single-class support vector machine classifier to obtain a classification result;

[0027] The anomaly detection double contour model is trained according to the classification result, wherein the anomaly detection double contour model includes an abnormal single-class support vector machine model and a normal single-class support vector machine model.

[0028] In one embodiment, the step of inputting the target industrial control network data into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data includes:

[0029] Inputting the target industrial control network data into the abnormal single-class support vector machine model and the normal single-class support vector machine model respectively;

[0030] When the determination results of the abnormal single-class support vector machine model and the normal single-class support vector machine model are both normal, determining that the detection result corresponding to the target industrial control network data is normal;

[0031] When the determination results of the abnormal single-class support vector machine model and the normal single-class support vector machine model are both abnormal, determining that the detection result corresponding to the target industrial control network data is abnormal;

[0032] In the case that the determination results of the abnormal one-class support vector machine model and the normal one-class support vector machine model are inconsistent, the detection result corresponding to the target industrial control network data is determined through arbitration.

[0033] In addition, to achieve the above purpose, the present application also proposes an abnormality detection device, which includes:

[0034] An acquisition module, used to acquire target industrial control network data;

[0035] The detection module is used to input the target industrial control network data into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes an anomaly detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the anomaly detection method described above.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the anomaly detection method described above are implemented.

[0038] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the anomaly detection method described above are implemented.

[0039] One or more technical solutions proposed in this application have at least the following technical effects:

[0040] By acquiring target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points; inputting the numerical feature prototype points and time series feature prototype points into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data; since the numerical feature prototype points and time series feature prototype points can fully reflect the main features of the industrial control network data, by inputting the numerical feature prototype points and time series feature prototype points with different characteristics into the anomaly detection dual-contour model, it is possible to detect in real time whether the target industrial control network data has anomalies, without relying on expert experience, thereby improving the efficiency and accuracy of anomaly detection in industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 is a flow chart of an abnormality detection method according to the first embodiment;

[0044] Figure 2 is a flow chart of an abnormality detection method according to the second embodiment;

[0045] Figure 3 is a schematic diagram of a numerical feature prototype point extraction process according to the second embodiment;

[0046] Figure 4 is a schematic diagram of a maximum pooling process according to a second embodiment;

[0047] Figure 5 Schematic diagram of the internal structure principle of a GRU according to the second embodiment;

[0048] Figure 6 is a schematic flow chart of an abnormality detection method according to a third embodiment;

[0049] Figure 7 is a schematic diagram of the overall abnormality detection process according to the third embodiment;

[0050] Figure 8 This is a schematic diagram of the module structure of the abnormality detection device according to an embodiment of the present application;

[0051] Fig. 9 Schematic diagram of the device structure of the hardware operating environment involved in the anomaly detection method in the embodiment of the present application.

[0052] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] The main solution of the embodiment of the present application is: by acquiring the target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points; the numerical feature prototype points and time series feature prototype points are input into a pre-built anomaly detection dual-contour model to obtain the detection results corresponding to the target industrial control network data. Through the anomaly detection dual-contour model, it is possible to detect in real time whether there are anomalies in the target industrial control network data without relying on expert experience, thereby improving the efficiency and accuracy of anomaly detection in industrial control systems.

[0056] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an anomaly detection device, etc. The following takes the anomaly detection device as an example to illustrate this embodiment and the following embodiments.

[0057] Based on this, the present application embodiment provides an abnormality detection method, referring to Figure 1 , Figure 1 It is a flowchart of the abnormality detection method according to the first embodiment.

[0058] In this embodiment, the anomaly detection method includes steps S10 to S20:

[0059] Step S10, acquiring target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points;

[0060] Modbus is an industrial fieldbus protocol standard and an application layer message transmission protocol, including three message types: ASCI, RTU, and TCP. The protocol itself does not define the physical layer, but only defines the message structure that the controller can recognize and use. Modbus TCP communication protocol is a general communication protocol that has been widely used in today's industrial control field. Through this protocol, controllers can communicate with each other or with other devices via a network (such as Ethernet).

[0061] For the periodic characteristics of industrial traffic, CNN (Convolutional Neural Network) is selected in the embodiment of the present application to extract the numerical features of industrial traffic. However, the periodicity of industrial networks is uncertain, and only relying on the periodic characteristics of industrial traffic data for anomaly detection will result in a high false alarm rate. Therefore, in addition to considering the periodicity of industrial traffic, the timing of industrial traffic is also included in the scope of research. In view of the timing of industrial traffic, GRUGated (Recurrent Unit) is selected in the embodiment of the present application to extract the timing characteristics of industrial traffic, and the CNN and GRU methods are combined with the prototype network. For the numerical characteristics of Modbus / TCP industrial traffic data, an attention mechanism is introduced, and a method for extracting prototype points of numerical features based on the attention mechanism is proposed; for the timing characteristics of Modbus / TCP industrial traffic data, a method for extracting prototype points of timing features based on GRU is proposed.

[0062] Step S20, inputting the numerical feature prototype points and the time series feature prototype points into a pre-built anomaly detection double contour model to obtain a detection result corresponding to the target industrial control network data.

[0063] Furthermore, after obtaining the target industrial control network data, the target industrial control network data containing numerical feature prototype points and time series feature prototype points can be input into a pre-built anomaly detection dual contour model to obtain the detection results corresponding to the target industrial control network data.

[0064] Optionally, for the abnormal and normal classification of industrial flow, a parameter-optimized one-class support vector machine (OCSVM) method is used to construct a dual-contour model of functional control in abnormal and normal modes, respectively, and detect anomalies in the network in real time through collaborative discrimination. At the same time, in order to improve the accuracy of abnormal detection of industrial control systems, reduce false alarm rates and missed alarm rates, and prevent the overfitting phenomenon of the one-class support vector machine abnormal detection model due to too many input independent variables, an autoencoder network is used to reduce the feature dimension of the input independent variables, remove redundancy, improve the accuracy of the OCSVM model, and reduce modeling time. In the embodiment of the present application, based on the dual-contour model of the optimized one-class support vector machine, collaborative discrimination of normal and abnormal behaviors is achieved.

[0065] This embodiment adopts the above scheme, specifically by acquiring target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points; the numerical feature prototype points and time series feature prototype points are input into a pre-built anomaly detection double contour model to obtain a detection result corresponding to the target industrial control network data. Through the anomaly detection double contour model, it is possible to detect in real time whether there is an anomaly in the target industrial control network data without relying on expert experience, thereby improving the efficiency and accuracy of anomaly detection in industrial control systems.

[0066] Reference Figure 2 , Figure 2 This is a flow chart of an abnormality detection method according to the second embodiment. This embodiment proposes a second embodiment of the present application on the basis of the aforementioned first embodiment. In the second embodiment of the present application, the same or similar contents as those in the above embodiment can be referred to the above introduction and will not be repeated in the following. Figure 2 , step S10 includes steps S101-S103:

[0067] Step S101: collecting original industrial control network data, and preprocessing the original industrial control network data to obtain processed original industrial control network data;

[0068] Step S102: extracting features and calculating prototype points on the processed original industrial control network data through a preset convolutional neural network to obtain numerical feature prototype points; and extracting features and calculating prototype points on the processed original industrial control network data through a preset gated recurrent unit to obtain temporal feature prototype points;

[0069] Step S103: taking the numerical characteristic prototype points and the time series characteristic prototype points as the target industrial control network data.

[0070] Specifically, in the embodiments of the present application, feature statistics are performed on performance indicators such as data throughput, latency, and jitter of industrial control network traffic, and multi-feature fusion is achieved using a tensor structure to enhance the characterization capability of the model. The correlation between industrial control network features is mined through tensor analysis.

[0071] Optionally, in order to realize the feature extraction of Modbus / TCP industrial flow data, the Modbus / TCP data field is taken as the research object. Due to its timing and periodicity, two different feature extraction methods are proposed, namely, using CNN with attention mechanism to extract its numerical feature prototype points, and using GRU to extract temporal feature prototype points.

[0072] Optionally, the preset convolutional neural network includes an input layer, a fully connected layer, an attention layer, and an output layer. The step of performing feature extraction and prototype point calculation on the processed original industrial control network data by the preset convolutional neural network to obtain numerical feature prototype points includes:

[0073] Inputting the processed original industrial control network data into the preset convolutional neural network through the input layer, performing convolution and pooling processing, and then inputting the data into the fully connected layer;

[0074] Performing transformation through the fully connected layer to obtain a feature vector, performing weight assignment on the feature vector through the attention layer to obtain an output vector, inputting the output vector to the output layer, and outputting a numerical feature vector according to the prediction step size of the output layer;

[0075] The numerical feature vector is input into the prototype network for calculation to obtain the numerical feature prototype point.

[0076] Reference Figure 3 , Figure 3 FIG. 1 is a schematic diagram of a numerical feature prototype point extraction process according to the second embodiment. Figure 3 As shown in the figure, the CNN method of extracting numerical feature prototype points first preprocesses the industrial flow data set, inputs it into the model through the input layer, and outputs the result through the convolution layer, pooling layer, fully connected layer, and attention layer to the output layer. The result is input into the prototype network, the numerical prototype point is calculated, and finally the numerical prototype point is output.

[0077] Optionally, the industrial flow data set is preprocessed and then input into the model through the input layer. Assuming that the length of the batch input data is n, it can be used Represents the input vector.

[0078] Reference Figure 4 , Figure 4 is a schematic diagram of the maximum pooling process according to the second embodiment, as shown in Figure 4As shown in the figure, after the input vector X is calculated by the convolution layer and processed by the pooling layer, the fully connected layer converts it into a feature vector. The calculation formula of the feature vector is as follows:

[0079]

[0080] P = max(X i )+b p

[0081] E x =f(W L ·P+b L )

[0082] Among them, X i is the output of the convolutional layer; W i is the convolutional layer weight matrix; b i represents the bias; ReLU() is the activation function of the convolutional layer. P is the output of the pooling layer; max(X i ) represents the maximum pooling sampling function. The maximum pooling process is as follows Figure 4 As shown. p is the bias of the pooling layer; E X is the output of the fully connected layer; f is the activation function ReLU of the fully connected layer; W L is the weight matrix of the fully connected layer; b L is the fully connected layer bias.

[0083] Optionally, for different features in the vector, a more optimized weight parameter matrix can be obtained by using the weight allocation principle. By using the attention mechanism, the weights of various connections are generated in a dynamic way to build a model of the network output of this layer. The output function of the Attention layer is represented by S. Assuming the length of the output vector is k, S j =[s1…s t …s k ] T .

[0084] Optionally, the output vector of the attention layer is input to the output layer. Assuming the step size of the output layer prediction is e, The calculation formula is:

[0085] R j =f(W Y ·S j +b Y )

[0086] Among them, W Y is the output layer weight matrix; b Y is the output layer bias; f is the fully connected layer activation function ReLU.

[0087] Optionally, the N-dimensional data in the network traffic is mapped to an M-dimensional embedding space through CNN to obtain the feature vector R j , calculate and output the prototype point Ycnn in the embedding space:

[0088]

[0089] Among them, G v is a set of v consecutive input vectors and labels, x j is the jth input vector, y j is the label corresponding to the jth input vector, R j is the feature vector corresponding to the jth input vector.

[0090] Optionally, the preset gated cycle unit includes a reset gate and an update gate, and the step of performing feature extraction and prototype point calculation on the processed original industrial control network data through the preset gated cycle unit to obtain the time series feature prototype point includes:

[0091] Calculate each candidate hidden state and each hidden state at each moment of the processed original industrial control network data through the reset gate and the update gate;

[0092] Calculating the output layer of the preset convolutional neural network according to each candidate hidden state and the hidden state at each moment to obtain a time series feature vector;

[0093] The time series feature vector is input into the prototype network for calculation to obtain the time series feature prototype point.

[0094] Optionally, the periodicity and continuity of the industrial production process make the industrial flow data have the characteristics of periodicity and time series, so a GRU-based time series feature prototype point extraction method is selected to extract features from the flow data.

[0095] Optionally, CNN can extract local features of sample data, but the convolutional layer in CNN does not consider the temporal dependency between frames. Time series activity data has temporal dependencies beyond frame boundaries. In order to capture the temporal context contained in the activity data, RNN is required. However, traditional RNN has the problem of gradient disappearance, so there is no way to capture long-term dependencies. Therefore, GRU is used in the embodiment of the present application to capture the time series relationship of data.

[0096] Alternatively, as an improved long short-term memory network structure, GRU can overcome the gradient explosion and gradient vanishing problems of traditional RNN units. GRU has the function of extracting time series features; at the same time, it has small parameters, reduces the harm caused by overfitting, integrates LSTM units, and reduces the amount of calculation.

[0097] Optionally, select GRU to extract features from the data in the Modbus / TCP network traffic, calculate the prototype points of the extracted features, and then input them into the anomaly detection engine to better realize anomaly detection of industrial network traffic data and ensure the safe operation of the industrial production system.

[0098] Optionally, due to the small amount of industrial data, the GRU feature extraction method is integrated with the prototype network in small sample learning. GRU and small sample The pre-processed industrial flow data is input into the GRU to extract its time series features, and the extracted features are input into the prototype network to calculate the prototype points of the time series features.

[0099] Reference Figure 5 , Figure 5 FIG. 4 is a schematic diagram of the internal structure principle of a GRU according to the second embodiment, as shown in FIG. Figure 5 As shown, the GRU input has the hidden state h passed from the previous node t-1 and the current input x t , the hidden state contains the information about the previous node. t and h t-1 After a series of operations, GRU will output the hidden state h passed to the next node t .

[0100] Optionally, in the GRU, the inputs of the reset gate and the update gate are both the input x at the current time. t , and the hidden state h at the previous moment t-1 , the output is calculated by the activation function o' of the fully connected layer.

[0101] r t =σ(x t w r +h t-1 w v +b r )

[0102] z t =σ(x t w z +h t-1 w a +b z )

[0103] Among them, w r 、w v 、w z 、w α is the weight parameter, b r , b z is the bias parameter. The Σ function transforms the value of the element to between 0 and 1, so the update gate z t, reset gate t The value range of the elements in is [0,1].

[0104] Optionally, the GRU will compute candidate hidden states to assist in later hidden state computations. Perform element-wise multiplication (symbolized by ⊙) of the output of the reset gate at time t with the hidden state at the previous time step t-1. Combine the result of the element-wise multiplication with the input of the current time step and compute it using a fully connected layer with the activation function tanh to determine the candidate hidden states, where each element has a value range of [-1,1]. Compute the candidate hidden state at time t process.

[0105]

[0106] Among them, w x 、w q is the weight parameter, b h is the bias parameter. The reset gate controls how the hidden state of the previous moment flows into the candidate hidden state of the current moment, and the hidden state of the previous moment may contain all the historical information of the time series up to the previous moment.

[0107] Optionally, the hidden state h at time t t The calculation uses the current time to update the gate z t The hidden state h of the previous moment t-1 and the candidate hidden state at the current moment Make combinations.

[0108]

[0109] Optionally, output h t , and then calculated through the neural network output layer, and finally the output feature vector U is obtained j , the formula is as follows:

[0110] U j =σ(w y ·h t )

[0111] o' is the activation function, w y is the weight parameter.

[0112] Alternatively, GRU has similar performance to LSTM, but with fewer parameters and easier calculation. In order to solve the gradient problem encountered by RNN, both LSTM and GRU use gated structural units, which enable the recurrent unit to retain and forget information, thereby enhancing the prediction accuracy. GRU optimizes the structure of LSTM, thereby reducing the training computational overhead, increasing the training speed, and improving the training efficiency. Based on this feature, it can be found that GRU is more suitable for time series feature extraction for industrial flow anomaly detection.

[0113] Optionally, the temporal features obtained after GRU extraction are input into the prototype network to calculate and output the temporal feature prototype point Y gru , the calculation formula is as follows.

[0114]

[0115] Among them, G v is a set of v consecutive input vectors and labels, x j is the jth input vector, y j is the label corresponding to the jth input vector, U j is the feature vector corresponding to the jth input vector.

[0116] Optionally, the sample data is converted into vector data that can be input into the CNN and GRU networks. At the same time, combined with the periodic and sequential characteristics of industrial communications, two methods are selected for feature extraction, namely, a CNN numerical feature prototype point extraction method based on the attention mechanism, and a GRU-based temporal feature prototype point extraction method. In the first feature extraction method, an attention mechanism is introduced into a conventional CNN to facilitate efficient extraction of feature information useful for detection. The second method, utilizing the characteristic of GRU that can extract temporal information, combines GRU with the prototype network, and uses the feature information extracted using GRU for calculation to obtain the temporal feature prototype point. Through the above two methods, two types of prototype points with different characteristics are obtained, which are used as input features of the subsequent anomaly detection engine for model training and anomaly detection.

[0117] This embodiment adopts the above scheme, specifically by collecting original industrial control network data and preprocessing the original industrial control network data to obtain processed original industrial control network data; performing feature extraction and prototype point calculation on the processed original industrial control network data through a preset convolutional neural network to obtain numerical feature prototype points; and performing feature extraction and prototype point calculation on the processed original industrial control network data through a preset gated loop unit to obtain time series feature prototype points; using the numerical feature prototype points and time series feature prototype points as the target industrial control network data, two types of prototype points with different characteristics can be obtained, which are used as input features of the subsequent anomaly detection engine for model training and anomaly detection, thereby improving the accuracy of the detection results.

[0118] Reference Figure 6 , Figure 6 This is a flow chart of an abnormality detection method according to the third embodiment. This embodiment proposes the third embodiment of the present application on the basis of any of the above embodiments. In the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction and will not be repeated in the following. Figure 6 , before step S20, it also includes:

[0119] Step S01: obtaining original alarm data, and establishing an attribute data set according to the original alarm data;

[0120] Optionally, the original alarm data is parsed and expressed in the format of D = <number, attack name, source IP address, destination IP address, ..., alarm category, protocol type>, and the alarm data is initially filtered, that is, obviously wrong values ​​are removed, such as an invalid timestamp; some false alarms are first filtered according to the host vulnerability information in the protection domain. The alarm data in the format composed of the filtered data is counted to obtain a preset number (for example, 20) of basic alarm attributes for each alarm, forming an attribute data set D rs_OCSVM .

[0121] Step S02: performing normalization processing and attribute simplification processing on the attribute data set to obtain a simplified data set;

[0122] Optionally, the attributes are normalized according to the formed attribute set, and the normalization formula is:

[0123]

[0124] In the formula, x′ i represents the normalized attribute value, x i Represents the attribute value before normalization, max(x i ) represents the maximum value of the i-th attribute, min(x t) represents the minimum value of the i-th attribute. Form a new data set D rs .

[0125] Optionally, 10% of the data set is randomly selected to form the dataset D rs-1 , using the attribute dimensionality reduction method of the autoencoder network to simplify D rs-1 Simplify to form a series of simplified data sets.

[0126] Step S03: optimizing the parameters of a single-class support vector machine according to the reduced data set by using a particle swarm algorithm to obtain a single-class support vector machine classifier;

[0127] Optionally, from D OCSVM Randomly select 50% of the data to form the training sample set D OCSVm_TR The particle swarm algorithm is used to optimize the parameters of the single-class support vector machine and establish the single-class support vector machine OCSVM classifier.

[0128] Step S04: selecting test sample data from the reduced data set to obtain a test sample set, and classifying the test sample set by the single-class support vector machine classifier to obtain a classification result;

[0129] Optionally, use the obtained OCSVM classifier to classify D OCSVM The remaining data is selected to form a test sample set D of 40% of the data OCSVM_TE Perform classification and output the classification results.

[0130] Step S05: training the anomaly detection double-contour model according to the classification result, wherein the anomaly detection double-contour model includes an abnormal single-class support vector machine model and a normal single-class support vector machine model.

[0131] Optionally, in the embodiment of the present application, a dual-contour model is used for discrimination, and then performance indicators are calculated, including calculation of false alarm rate, missed alarm rate and detection accuracy.

[0132] Optionally, the step of inputting the numerical feature prototype points and the time series feature prototype points into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data includes:

[0133] Inputting the target industrial control network data including the numerical feature prototype points and the time series feature prototype points into the abnormal single-class support vector machine model and the normal single-class support vector machine model;

[0134] When the determination results of the abnormal single-class support vector machine model and the normal single-class support vector machine model are both normal, determining that the detection result corresponding to the target industrial control network data is normal;

[0135] When the determination results of the abnormal single-class support vector machine model and the normal single-class support vector machine model are both abnormal, determining that the detection result corresponding to the target industrial control network data is abnormal;

[0136] In the case that the determination results of the abnormal one-class support vector machine model and the normal one-class support vector machine model are inconsistent, the detection result corresponding to the target industrial control network data is determined through arbitration.

[0137] Reference Figure 7 , Figure 7 FIG. 1 is a schematic diagram of the overall abnormality detection process according to the third embodiment. Figure 7 As shown in the figure, OCSVM is used to build abnormal OCSVM models and normal OCSVM models of functional control behaviors, simulate abnormal modes and normal modes of system communication, and discover anomalies in the network in real time through collaborative discrimination. The real-time collaborative discrimination process of the dual-contour model is shown in Figure 7 shown.

[0138] Optionally, in the embodiment of the present application, a normal OCSVM model and an abnormal OCSVM model are established respectively using a single-class support vector machine, and an abnormality detection method based on a dual-contour model is proposed to achieve collaborative discrimination of normal and abnormal behaviors, thereby achieving the purpose of suppressing the missed alarm rate and the false alarm rate, and realizing abnormality detection of industrial control networks. The real-time collaborative discrimination engine captures and extracts functional control behavior information in real time, and uses this as the input data of the model for abnormality judgment. The collaborative discrimination mechanism of the dual-contour model is briefly described as follows:

[0139] (1) If the abnormal OCSVM model is judged as "normal" and the normal OCSVM model is also judged as "normal", the final result is "normal";

[0140] (2) If the abnormal OCSVM model determines that the result is “abnormal” and the normal OCSVM model also determines that the result is “abnormal”, the final result is “abnormal”;

[0141] (3) If the judgment results of the abnormal OCSVM model are inconsistent with those of the normal OCSVM model, further arbitration is required. The arbitration decision is intended to consider two factors: false alarm rate and false negative rate to complete the final abnormality judgment.

[0142] Optionally, the OCSVM algorithm is used to establish a normal OCSVM model and an abnormal OCSVM model, which respectively simulate the normal mode and abnormal mode of industrial control system communication, form an abnormality detection dual-contour model, and realize abnormality detection of the industrial control system network through a collaborative discrimination mechanism.

[0143] Optionally, intrusion activities of industrial control systems do not always correspond to abnormal activities, including four possibilities: intrusive but not abnormal (missed alarm), non-intrusive but abnormal (false alarm), non-intrusive and not abnormal (correct judgment), and intrusive and abnormal (intrusion).

[0144] (1) Intrusive but not abnormal. The activity is invasive but cannot be detected because it is not abnormal, resulting in missed reports. As a result, the IDS does not report the intrusion.

[0145] (2) Non-invasive but abnormal. The activity is not invasive, but because it is abnormal, the IDS reports an intrusion, which results in a false alarm.

[0146] (3) Non-intrusive and non-abnormal. The activity is not invasive and the IDS does not report the activity as an intrusion, which is a correct judgment;

[0147] (4) Intrusion and abnormal. The activity is invasive and because the activity is abnormal, the IDS reports it as an intrusion. The basis of anomaly detection is the misuse of the abnormal behavior pattern system. Missed reports and false positives are very dangerous for important industrial control systems. Therefore, the completion of anomaly detection in industrial control systems must be verified.

[0148] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the anomaly detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0149] This application also provides an abnormality detection device, please refer to Figure 8 , the abnormality detection device comprises:

[0150] An acquisition module, used for acquiring target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time sequence feature prototype points;

[0151] The detection module is used to input the numerical feature prototype points and the time series feature prototype points into a pre-built abnormality detection double contour model to obtain the detection results corresponding to the target industrial control network data.

[0152] The anomaly detection device provided by the present application adopts the anomaly detection method in the above embodiment to solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the anomaly detection device provided by the present application are the same as the beneficial effects of the anomaly detection method provided by the above embodiment, and other technical features in the anomaly detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0153] The present application provides an anomaly detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the anomaly detection method in the above-mentioned embodiment 1.

[0154] Reference below Fig. 9 , which shows a schematic diagram of the structure of an abnormality detection device suitable for implementing the embodiment of the present application. The abnormality detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The abnormality detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0155] like Fig. 9 As shown, the abnormality detection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the abnormality detection device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the anomaly detection device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows an anomaly detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0156] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0157] The anomaly detection device provided by the present application adopts the anomaly detection method in the above embodiment to solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the anomaly detection device provided by the present application are the same as the beneficial effects of the anomaly detection method provided by the above embodiment, and the other technical features in the anomaly detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0158] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0159] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0160] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the anomaly detection method in the above-mentioned embodiment.

[0161] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0162] The computer-readable storage medium may be included in the abnormality detection device; or may exist independently without being assembled into the abnormality detection device.

[0163] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the anomaly detection device, the anomaly detection device: obtains target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points; inputs the numerical feature prototype points and time series feature prototype points into a pre-constructed anomaly detection double contour model to obtain the detection results corresponding to the target industrial control network data. Through the anomaly detection double contour model, it is possible to detect in real time whether there are anomalies in the target industrial control network data without relying on expert experience, thereby improving the efficiency and accuracy of anomaly detection in industrial control systems.

[0164] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0165] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0166] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0167] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned anomaly detection method, and can solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the anomaly detection method provided in the above-mentioned embodiment, and will not be repeated here.

[0168] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned anomaly detection method when executed by a processor.

[0169] The computer program product provided by the present application can solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the anomaly detection method provided by the above embodiment, which will not be repeated here.

[0170] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Acquire target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time series feature prototype points; The numerical feature prototype points and the temporal feature prototype points are input into a pre-built anomaly detection dual-contour model to obtain a detection result corresponding to the target industrial control network data.

2. The method according to claim 1, characterized in that The step of acquiring target industrial control network data includes: Collecting original industrial control network data, and preprocessing the original industrial control network data to obtain processed original industrial control network data; Performing feature extraction and prototype point calculation on the processed original industrial control network data through a preset convolutional neural network to obtain the numerical feature prototype point; and performing feature extraction and prototype point calculation on the processed original industrial control network data through a preset gated cycle unit to obtain the temporal feature prototype point; The numerical feature prototype point and the time series feature prototype point are used as the target industrial control network data.

3. The method according to claim 2, characterized in that The preset convolutional neural network includes an input layer, a fully connected layer, an attention layer, and an output layer. The step of performing feature extraction and prototype point calculation on the processed original industrial control network data by the preset convolutional neural network to obtain the numerical feature prototype point includes: Inputting the processed original industrial control network data into the preset convolutional neural network through the input layer, performing convolution and pooling processing, and then inputting the data into the fully connected layer; Performing transformation through the fully connected layer to obtain a feature vector, performing weight assignment on the feature vector through the attention layer to obtain an output vector, inputting the output vector to the output layer, and outputting a numerical feature vector according to the prediction step size of the output layer; The numerical feature vector is input into the prototype network for calculation to obtain the numerical feature prototype point.

4. The method according to claim 2, characterized in that The preset gated cycle unit includes a reset gate and an update gate. The steps of extracting features and calculating prototype points on the processed original industrial control network data through the preset gated cycle unit to obtain the time series feature prototype point include: Calculate each candidate hidden state and each hidden state at each moment of the processed original industrial control network data through the reset gate and the update gate; Calculating the output layer of the preset convolutional neural network according to each candidate hidden state and the hidden state at each moment to obtain a time series feature vector; The time series feature vector is input into the prototype network for calculation to obtain the time series feature prototype point.

5. The method according to claim 1, characterized in that Before the step of inputting the numerical feature prototype point and the temporal feature prototype point into a pre-built anomaly detection dual-contour model to obtain the detection result corresponding to the target industrial control network data, the step further includes: Acquire original alarm data, and establish an attribute data set according to the original alarm data; Performing normalization and attribute simplification processing on the attribute data set to obtain a simplified data set; Optimizing the parameters of a single-class support vector machine according to the reduced data set by using a particle swarm algorithm to obtain a single-class support vector machine classifier; Selecting test sample data from the reduced data set to obtain a test sample set, and classifying the test sample set by the single-class support vector machine classifier to obtain a classification result; The anomaly detection double contour model is obtained by training according to the classification result, wherein the anomaly detection double contour model includes an abnormal single-class support vector machine model and a normal single-class support vector machine model.

6. The method according to claim 5, characterized in that The step of inputting the numerical feature prototype point and the temporal feature prototype point into a pre-built anomaly detection dual-contour model to obtain the detection result corresponding to the target industrial control network data includes: Inputting the target industrial control network data including the numerical feature prototype points and the temporal feature prototype points into the abnormal single-class support vector machine model and the normal single-class support vector machine model; When the determination results of the abnormal single-class support vector machine model and the normal single-class support vector machine model are both normal, determining that the detection result corresponding to the target industrial control network data is normal; When the determination results of the abnormal single-class support vector machine model and the normal single-class support vector machine model are both abnormal, determining that the detection result corresponding to the target industrial control network data is abnormal; In the case that the determination results of the abnormal one-class support vector machine model and the normal one-class support vector machine model are inconsistent, the detection result corresponding to the target industrial control network data is determined through arbitration.

7. An abnormality detection device, characterized in that: The device comprises: An acquisition module, used for acquiring target industrial control network data, wherein the target industrial control network data includes numerical feature prototype points and time sequence feature prototype points; The detection module is used to input the numerical feature prototype points and the time series feature prototype points into a pre-built anomaly detection double contour model to obtain the detection results corresponding to the target industrial control network data.

8. An abnormality detection device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the anomaly detection method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the abnormality detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the anomaly detection method according to any one of claims 1 to 6 are implemented.

Images