Industrial control system time sequence anomaly detection method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an industrial control system time sequence anomaly detection method and device. By analyzing the features in the time sequence, potential faults, attacks and abnormal behaviors in the system can be accurately identified. The method has real-time performance and robustness, and can adapt to complex data noise and diversified equipment in an industrial environment. The objective of the invention is to reduce false alarms and missing alarms, improve detection precision, simplify parameter setting in actual deployment, enhance safety and stability of an industrial control system, and guarantee reliable operation of key infrastructures.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and specifically relates to a method and device for detecting time series anomalies in an industrial control system. Background Art

[0002] In industrial control systems (ICS), devices such as sensors, actuators, programmable logic controllers (PLCs), and distributed control systems (DCSs) interact with each other through communication networks, generating a large amount of time series data. These time series data reflect the operating status and control instructions of the system, and are usually real-time, continuous, and relevant. Therefore, by performing anomaly detection on the time series data generated in ICS, system operation anomalies, network attacks, or equipment failures can be effectively discovered, thereby ensuring the security and stability of the system.

[0003] Traditional ICS security protection technologies mainly focus on the defense against external threats, such as firewalls and intrusion detection systems (IDS). These technologies identify potential attack behaviors by monitoring network traffic or device logs. However, ICS time series data has strong physical process constraints, and the detection method of network traffic alone cannot capture the slight anomalies of the internal operating status of the system. Therefore, anomaly detection technology for ICS time series data has gradually become a research focus. Summary of the invention

[0004] In order to overcome the problems existing in the related art, a method and device for detecting anomaly of time series in an industrial control system are provided.

[0005] According to one aspect of an embodiment of the present disclosure, a method for detecting anomalies in a time series of an industrial control system is provided, the method comprising:

[0006] Step 1, collect data from each sensor in the industrial control system according to time sequence;

[0007] Step 2: preprocess the classified data, including data normalization, data patching, and data alignment;

[0008] Step 3, classifying the preprocessed data into normal data and abnormal behavior data to form training data;

[0009] Step 4: train the deep learning model based on the formed training data, and use the marked labels to supervise the deep learning model training, and finally obtain the classification model;

[0010] Step 5: bypass the trained model to the industrial control system data channel to perform data anomaly detection and feed back the detected abnormal status to the host computer.

[0011] In a possible implementation, step 2 further includes: step 21 and step 22;

[0012] Step 21, normalize the collected data according to the following formula:

[0013]

[0014] Among them, max(τ) and min(τ) are the minimum and maximum vectors in the collected time series, and ∈ is a very small constant used to prevent division by zero overflow;

[0015] Step 22, divide the normalized data into local windows of length K, and when the data length is less than K, perform a copy and fill operation on the data.

[0016] In a possible implementation, step 4 includes steps 41 to 45;

[0017] Step 41, perform global temporal convolution and local temporal convolution on the training data to generate the same number of temporal prediction outputs as the input. The local temporal convolution formula is as follows:

[0018] x t,l =f(W l *x t-K+1:t,l-1 +b l )

[0019] Where * represents the convolution operation, f(·) is the activation function, and W l represents the convolution kernel of size k, b l is the bias term, l represents the number of convolution layers, and the global time convolution formula is as follows:

[0020]

[0021] Where d is the dilation factor, k is the convolution filter size, and sd·i is the index into the past according to d;

[0022] Step 42, the time prediction output is converted into the frequency domain using the following formula, and the frequency domain feature representation of the data is obtained by presetting the frequency domain data, wherein the formula involved is as follows:

[0023]

[0024] F integrated =W G ⊙F+W L ⊙(F⊙(P>θ))

[0025]

[0026] Where ⊙ represents element-wise multiplication, P is a binary mask, P>θ, frequencies with power higher than a threshold θ are retained, and other frequencies are filtered out, and θ is a learnable parameter;

[0027] Step 43, adding the frequency domain feature representation as a residual term to the input feature to obtain an enhanced initial feature representation;

[0028] Step 44, the enhanced initial feature representation is passed through a feedforward layer and an activation function to obtain a pseudo label, and a cross entropy loss is constructed with the existing label. The cross entropy loss function is shown in the following formula:

[0029]

[0030] In step 45, the global cross entropy loss and the local cross entropy loss are normalized by a learnable parameter λ.

[0031] In a possible implementation, the method further includes step 6, displaying the topological structure of the industrial control system on the host computer, and visually displaying the corresponding position in the topological structure according to the position and device associated with the received abnormal state.

[0032] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies in a time series of an industrial control system is provided, the device comprising:

[0033] A collection module, used to collect data from various sensors in the industrial control system according to time sequence;

[0034] The preprocessing module is used to preprocess the classified data, including data normalization, data patching, and data alignment;

[0035] A classification module is used to classify the preprocessed data into normal data and abnormal behavior data to form training data;

[0036] A training module is used to train a deep learning model based on the formed training data and supervise the deep learning model training using the labeled labels to finally obtain a classification model;

[0037] The detection module is used to bypass the trained model into the data channel of the industrial control system to detect data anomalies and feed back the detected abnormal status to the host computer.

[0038] In a possible implementation, the preprocessing module further includes:

[0039] The normalization module is used to normalize the collected data according to the following formula:

[0040]

[0041] Among them, max(τ) and min(τ) are the minimum and maximum vectors in the collected time series, and ∈ is a very small constant used to prevent division by zero overflow;

[0042] The padding module is used to divide the normalized data into local windows of length K. When the data length is less than K, the data is copied and padded.

[0043] In a possible implementation, the training module includes:

[0044] The convolution module is used to perform global time convolution and local time convolution on the training data to generate the same number of time prediction outputs as the input. The local time convolution formula is shown below:

[0045] x t,l =f(W l *x t-K+1:t,l-1 +b l )

[0046] Where * represents the convolution operation, f(·) is the activation function, and W l represents the convolution kernel of size k, b l is the bias term, l represents the number of convolution layers, and the global time convolution formula is as follows:

[0047]

[0048] Where d is the dilation factor, k is the convolution filter size, and sd·i is the index into the past according to d;

[0049] The frequency domain extraction module is used to convert the time prediction output into the frequency domain by using the following formula, and obtain the frequency domain feature representation of the data by presetting the frequency domain data. The formula involved is as follows:

[0050]

[0051] F integrated =W G ⊙F+W L ⊙(F⊙(P>θ))

[0052]

[0053] Where ⊙ represents element-wise multiplication, P is a binary mask, P>θ, frequencies with power higher than a threshold θ are retained, and other frequencies are filtered out, and θ is a learnable parameter;

[0054] An enhancement module is used to add the frequency domain feature representation as a residual term to the input feature to obtain an enhanced initial feature representation;

[0055] The cross entropy loss establishment module is used to obtain pseudo labels by passing the enhanced initial feature representation through the feedforward layer and the activation function, and construct the cross entropy loss with the existing labels. The cross entropy loss function is shown in the following formula:

[0056]

[0057] The normalization processing module is used to normalize the global cross entropy loss and the local cross entropy loss through the learnable parameter λ.

[0058] In a possible implementation, the device further includes a display module for displaying the topological structure of the industrial control system on a host computer, and performing visual display at corresponding positions in the topological structure according to the positions and devices associated with the received abnormal states.

[0059] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies in a time series of an industrial control system is provided, the device comprising:

[0060] processor;

[0061] a memory for storing processor-executable instructions;

[0062] Wherein, the processor is configured to execute the above method.

[0063] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0064] The beneficial effect of the present disclosure is that the present disclosure provides a more accurate and efficient anomaly detection method. As ICS becomes more networked and intelligent, the security threats faced by ICS become increasingly complex, and traditional network traffic detection methods cannot fully meet the detection needs of internal anomalies.

[0065] The present invention aims to solve the shortcomings of time series anomaly detection in existing industrial control systems (ICS) and improve the accuracy of anomaly detection: by targeting time series data in industrial control systems, an anomaly detection method that can capture complex temporal dependencies and physical process characteristics is proposed. This method can not only detect common system anomalies (such as sensor failures, actuator failures, etc.), but also identify highly concealed network attacks, such as advanced persistent threats (APTs) against industrial control systems.

[0066] Dealing with diverse and noisy data: Time series data in industrial environments often have noise and random fluctuations, and time series data generated by different types of industrial equipment have significant differences. This paper introduces a robust feature extraction and anomaly detection mechanism to effectively deal with data noise and improve the adaptability of the algorithm in diverse devices and scenarios.

[0067] Reduce false positives and false negatives: Existing anomaly detection systems often have high false positive and false negative rates, especially when facing complex or unknown attacks, showing weak robustness. The present invention uses an innovative detection mechanism to more accurately identify true anomalies, reduce false positives and false negatives, and improve the detection reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a flow chart of a method for detecting time series anomalies in an industrial control system shown in an embodiment of the present disclosure.

[0069] Figure 2 It is a block diagram of a time series anomaly detection device for an industrial control system shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0070] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0071] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0072] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0073] Figure 1 is a flow chart of a method for detecting anomalies in a time series of an industrial control system shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, a laptop computer, etc. The embodiment of the present disclosure does not limit the type of the terminal device. Figure 1 As shown, the method includes:

[0074] Step 1: Collect data from each sensor in the industrial control system according to time sequence.

[0075] In step 1, sensor data in industrial control equipment can be collected from multiple data sources. These data should contain real and representative normal behavior and abnormal behavior data so as to be used for data labeling.

[0076] Step 2: preprocess the classified data, including data normalization, data patching, and data alignment.

[0077] For example, step 2 also includes: step 21 and step 22.

[0078] Step 21, normalize the collected data according to the following formula:

[0079]

[0080] Among them, max(τ) and min(τ) are the minimum and maximum vectors in the collected time series, and ∈ is a very small constant used to prevent division by zero overflow.

[0081] Step 22, divide the normalized data into local windows of length K, and when the data length is less than K, perform a copy and fill operation on the data.

[0082] Step 3: classify the preprocessed data into normal data and abnormal behavior data to form training data.

[0083] Step 4: Train the deep learning model based on the formed training data, and use the labeled labels to supervise the deep learning model training, and finally obtain the classification model.

[0084] As an example of this embodiment, step 4 includes steps 41 to 45 .

[0085] Step 41, perform global temporal convolution and local temporal convolution on the training data to generate the same number of temporal prediction outputs as the input. The local temporal convolution formula is as follows:

[0086] x t,l =f(W l *x t-K+1:t,l-1 +b l )

[0087] Where * represents the convolution operation, f(·) is the activation function, and W l represents the convolution kernel of size k, b l is the bias term, l represents the number of convolution layers, and the global temporal convolution formula is as follows:

[0088]

[0089] Where d is the dilation factor, k is the convolution filter size, and sd·i is the index into the past according to d.

[0090] Step 42, the time prediction output is converted into the frequency domain using the following formula, and the frequency domain feature representation of the data is obtained by presetting the frequency domain data, wherein the formula involved is as follows:

[0091]

[0092] F integrated =W G ⊙F+W L ⊙(F⊙(P>θ))

[0093]

[0094] Where ⊙ represents element-wise multiplication, P is a binary mask, P>θ, frequencies with power higher than a threshold θ are retained, and other frequencies are filtered out, and θ is a learnable parameter.

[0095] Step 43, adding the frequency domain feature representation as a residual term to the input feature to obtain an enhanced initial feature representation;

[0096] Step 44, the enhanced initial feature representation is passed through a feedforward layer and an activation function to obtain a pseudo label, and a cross entropy loss is constructed with the existing label. The cross entropy loss function is shown in the following formula:

[0097]

[0098] In step 45, the global cross entropy loss and the local cross entropy loss are normalized by a learnable parameter λ.

[0099] Step 5: bypass the trained model to the industrial control system data channel to perform data anomaly detection and feed back the detected abnormal status to the host computer.

[0100] The present invention can accurately identify potential faults, attacks and abnormal behaviors in the system by analyzing the features in the time series. The method has real-time and robustness, and can adapt to complex data noise and diversified equipment in industrial environments. The invention aims to reduce false positives and false negatives, improve detection accuracy, simplify parameter settings in actual deployment, enhance the security and stability of industrial control systems, and ensure the reliable operation of critical infrastructure.

[0101] In a possible implementation, the method further includes step 6, wherein the host computer displays the topology of the industrial control system, and visually displays the corresponding position in the topology according to the position and device associated with the received abnormal result. The abnormal state in the industrial control network can be displayed in a timely and intuitive manner through visualization, helping relevant personnel to find problems in a timely manner.

[0102] In a possible implementation, a device for detecting anomalies in a time series of an industrial control system is provided, the device comprising:

[0103] A collection module, used for collecting data from various sensors in the industrial control system according to time sequence;

[0104] The preprocessing module is used to preprocess the classified data, including data normalization, data patching, and data alignment;

[0105] A classification module is used to classify the preprocessed data into normal data and abnormal behavior data to form training data;

[0106] A training module is used to train a deep learning model based on the formed training data and supervise the deep learning model training using the labeled labels to finally obtain a classification model;

[0107] The detection module is used to bypass the trained model into the data channel of the industrial control system to detect data anomalies and feed back the detected abnormal status to the host computer.

[0108] In a possible implementation, the preprocessing module further includes:

[0109] The normalization module is used to normalize the collected data according to the following formula:

[0110]

[0111] Among them, max(τ) and min(τ) are the minimum and maximum vectors in the collected time series, and ∈ is a very small constant used to prevent division by zero overflow;

[0112] The padding module is used to divide the normalized data into local windows of length K. When the data length is less than K, the data is copied and padded.

[0113] In a possible implementation, the training module includes:

[0114] The convolution module is used to perform global time convolution and local time convolution on the training data to generate the same number of time prediction outputs as the input. The local time convolution formula is shown below:

[0115] x t,l =f(W l *x t-K+1:t,l-1 +b l )

[0116] Where * represents the convolution operation, f(·) is the activation function, and W lrepresents the convolution kernel of size k, b l is the bias term, l represents the number of convolution layers, and the global time convolution formula is as follows:

[0117]

[0118] Where d is the dilation factor, k is the convolution filter size, and sd·i is the index into the past according to d;

[0119] The frequency domain extraction module is used to convert the time prediction output into the frequency domain by using the following formula, and obtain the frequency domain feature representation of the data by presetting the frequency domain data. The formula involved is as follows:

[0120]

[0121] F integrated =W G F+W L v(F⊙(P>θ))

[0122]

[0123] Where ⊙ represents element-wise multiplication, P is a binary mask, P>θ, frequencies with power higher than a threshold θ are retained, and other frequencies are filtered out, and θ is a learnable parameter;

[0124] An enhancement module is used to add the frequency domain feature representation as a residual term to the input feature to obtain an enhanced initial feature representation;

[0125] The cross entropy loss establishment module is used to obtain pseudo labels by passing the enhanced initial feature representation through the feedforward layer and the activation function, and construct the cross entropy loss with the existing labels. The cross entropy loss function is shown in the following formula:

[0126]

[0127] The normalization processing module is used to normalize the global cross entropy loss and the local cross entropy loss through the learnable parameter λ.

[0128] In a possible implementation, the device further includes a display module for displaying the topological structure of the industrial control system on a host computer, and performing visual display at corresponding positions in the topological structure according to the positions and devices associated with the received abnormal states.

[0129] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0130] Figure 21900 is a block diagram of an industrial control system time series anomaly detection device shown in an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0131] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0132] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0133] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0134] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0135] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0136] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0137] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0138] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0139] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0140] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0141] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting anomalies in time series of industrial control systems, characterized in that: The method comprises: Step 1, collect data from each sensor in the industrial control system according to time sequence; Step 2: preprocess the classified data, including data normalization, data patching, and data alignment; Step 3, classifying the preprocessed data into normal data and abnormal behavior data to form training data; Step 4: train the deep learning model based on the formed training data, and use the marked labels to supervise the deep learning model training, and finally obtain the classification model; Step 5: bypass the trained model to the industrial control system data channel to perform data anomaly detection and feed back the detected abnormal status to the host computer.

2. The method according to claim 1, characterized in that Step 2 also includes: step 21 and step 22; Step 21, normalize the collected data according to the following formula: Among them, max(τ) and min(τ) are the minimum and maximum vectors in the collected time series, and ∈ is a very small constant used to prevent division by zero overflow; Step 22, divide the normalized data into local windows of length K, and when the data length is less than K, perform a copy and fill operation on the data.

3. The method according to claim 1, characterized in that Step 4 includes step 41 to step 45; Step 41, perform global temporal convolution and local temporal convolution on the training data to generate the same number of temporal prediction outputs as the input. The local temporal convolution formula is as follows: x t,l =f(W l *x t-K+1:t,l-1 +b l ) Where * represents the convolution operation, f(·) is the activation function, and W l represents the convolution kernel of size k, b l is the bias term, l represents the number of convolution layers, and the global time convolution formula is as follows: Where d is the dilation factor, k is the convolution filter size, and sd·i is the index into the past according to d; Step 42, the time prediction output is converted into the frequency domain using the following formula, and the frequency domain feature representation of the data is obtained by presetting the frequency domain data, wherein the formula involved is as follows: F integrated =W G ⊙F+W L ⊙(F⊙(P>θ)) Where ⊙ represents element-wise multiplication, P is a binary mask, P>θ, frequencies with power higher than a threshold θ are retained, and other frequencies are filtered out, and θ is a learnable parameter; Step 43, adding the frequency domain feature representation as a residual term to the input feature to obtain an enhanced initial feature representation; Step 44, the enhanced initial feature representation is passed through a feedforward layer and an activation function to obtain a pseudo label, and a cross entropy loss is constructed with the existing label. The cross entropy loss function is shown in the following formula: In step 45, the global cross entropy loss and the local cross entropy loss are normalized by a learnable parameter λ.

4. The method according to claim 1, characterized in that: The method further includes step 6, displaying the topological structure of the industrial control system on the host computer, and visually displaying the corresponding position in the topological structure according to the position and device associated with the received abnormal state.

5. A device for detecting anomalies in time series of an industrial control system, characterized in that: The device comprises: A collection module, used to collect data from various sensors in the industrial control system according to time sequence; The preprocessing module is used to preprocess the classified data, including data normalization, data patching, and data alignment; A classification module is used to classify the preprocessed data into normal data and abnormal behavior data to form training data; A training module is used to train a deep learning model based on the formed training data and supervise the deep learning model training using the labeled labels to finally obtain a classification model; The detection module is used to bypass the trained model into the data channel of the industrial control system to detect data anomalies and feed back the detected abnormal status to the host computer.

6. The method according to claim 1, characterized in that The preprocessing module also includes: The normalization module is used to normalize the collected data according to the following formula: Among them, max(τ) and min(τ) are the minimum and maximum vectors in the collected time series, and ∈ is a very small constant used to prevent division by zero overflow; The padding module is used to divide the normalized data into local windows of length K. When the data length is less than K, the data is copied and padded.

7. The method according to claim 1, characterized in that The training modules include: The convolution module is used to perform global time convolution and local time convolution on the training data to generate the same number of time prediction outputs as the input. The local time convolution formula is shown below: x t,l =f(W l *x t-K+1:t,l-1 +b l ) Where * represents the convolution operation, f(·) is the activation function, and W l represents the convolution kernel of size k, b l is the bias term, l represents the number of convolution layers, and the global time convolution formula is as follows: Where d is the dilation factor, k is the convolution filter size, and sd·i is the index into the past according to d; The frequency domain extraction module is used to convert the time prediction output into the frequency domain by using the following formula, and obtain the frequency domain feature representation of the data by presetting the frequency domain data. The formula involved is as follows: F integrated =W G ⊙F+W L ⊙(F⊙(P>θ)) Where ⊙ represents element-wise multiplication, P is a binary mask, P>θ, frequencies with power higher than a threshold θ are retained, and other frequencies are filtered out, and θ is a learnable parameter; An enhancement module is used to add the frequency domain feature representation as a residual term to the input feature to obtain an enhanced initial feature representation; The cross entropy loss establishment module is used to obtain pseudo labels by passing the enhanced initial feature representation through the feedforward layer and the activation function, and construct the cross entropy loss with the existing labels. The cross entropy loss function is shown in the following formula: The normalization processing module is used to normalize the global cross entropy loss and the local cross entropy loss through the learnable parameter λ.

8. The method according to claim 1, characterized in that The device also includes a display module, which is used to display the topological structure of the industrial control system on the host computer, and to perform visual display at the corresponding position in the topological structure according to the position and equipment associated with the received abnormal state.

9. A device for detecting anomalies in time series of an industrial control system, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 4.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images