Adaptive anomaly detection method AGAE based on anti-gating auto-encoder

Abstract

The invention discloses a self-adaptive anomaly detection method AGAE based on an adversarial gating auto-encoder. The invention relates to the field of industrial control system anomaly detection. In the aspect of data processing, the invention provides the data processing method based on the double-force multi-factor sea gull algorithm, and the influence of irrelevant variables in the data can be eliminated. Secondly, in the aspect of a neural network model, an adversarial gating auto-encoder neural network model is provided, and the fine gap between abnormal data and real data can be found by using the advantages of adversarial training. And finally, a self-adaptive threshold setting method based on an extreme value theory and a fitting root-mean-square error is proposed to carry out anomaly detection, so that a threshold can be adaptively adjusted according to change characteristics of a data set, and the problem of anomaly false detection caused by a fixed threshold is prevented.

Description

Technical Field

[0001] The present invention relates to the field of anomaly detection in industrial control systems. The data stream of industrial control equipment is detected to immediately discover its abnormal situation. Specifically, the Seagull algorithm is used to eliminate the influence of irrelevant variables, and then the original data is reconstructed using an adversarial gated autoencoder. Finally, anomaly detection is performed using an adaptive threshold setting method based on extreme value theory and fitting root mean square error. Background Art

[0002] As the digitalization, networking and intelligence of industrial control systems are further improved, the number of interconnected devices inside industrial control systems is increasing, and the number of exposed interfaces and vulnerabilities is also increasing. Industrial control systems are facing serious security threats. On the one hand, industrial control systems may have been built relatively early, and the early environment did not have the highly developed Internet and Internet of Things like today, so security issues were not considered enough or even not considered at all. On the other hand, with the continuous evolution of attack methods and the gradual reduction of attack costs, more and more attackers can easily launch attacks on industrial control systems, greatly increasing the possibility of system attacks.

[0003] The existing anomaly detection algorithms for industrial control systems can be divided into the following three categories: anomaly detection based on statistical methods or rule matching, anomaly detection based on traditional machine learning, and anomaly detection based on deep learning. Anomaly detection based on statistical methods or rule matching relies on a large number of prior normal data sets or abnormal data sets, requiring the data to be detected to match the statistical features of normal data or hit the matching rules of abnormal data sets. This method requires a large amount of prior data, and cannot well determine whether the data that has not appeared is normal data, and is prone to missed detection. Anomaly detection methods based on traditional machine learning require a large amount of labeled data to train the model, and the learning efficiency is not high. Since the data of industrial control systems is difficult to calibrate, this type of method is not efficient enough when facing complex data. Finally, due to the rapid development of deep learning in recent years, more and more efficient deep learning methods have been proposed and have achieved good application results in various fields. This type of method can unsupervisedly learn features of data of various dimensions, and then perform classification and regression related work. This feature is highly consistent with the diverse, unlabeled, and unsupervised requirements of industrial control data. Therefore, the industrial control data anomaly detection algorithm based on deep learning has a high research value.

[0004] In summary, this paper proposes an adaptive anomaly detection method AGAE based on adversarial gated autoencoder, which uses the adversarial gated autoencoder to reconstruct the original data and perform anomaly detection based on it. Summary of the invention

[0005] The present invention solves the problem of key equipment protection in industrial control systems. In a real working environment, key equipment needs to be detected in a key position because it works in a key position, and it needs to meet certain requirements in accuracy and timeliness so that it can get immediate attention and take measures when an abnormality occurs in the equipment to avoid serious losses. Therefore, an adaptive anomaly detection method AGAE based on adversarial gated autoencoder is proposed.

[0006] The present invention improves the traditional anomaly detection method. First, in terms of data processing, a data processing method based on the dual-force multi-factor Seagull algorithm is proposed. Secondly, in terms of neural network model, an adversarial gated autoencoder neural network model is proposed, which can use the advantages of adversarial training to discover the subtle gap between abnormal data and real data. Finally, an adaptive threshold setting method based on extreme value theory and fitting root mean square error is proposed for anomaly detection.

[0007] The method proposed in the present invention is a method that can be applied to real-time abnormal data detection of industrial control equipment. It mainly includes the steps of data processing based on the dual-force multi-factor Seagull algorithm, reconstructed data generation based on the adversarial gated autoencoder, and adaptive threshold anomaly judgment based on the reconstructed data.

[0008] The specific contents are:

[0009] In order to collect more effective data, factory sensors transmit multivariate data in most cases. However, different variables have different effects on data. For some irrelevant variables, even if the fluctuation is large, the administrator can consider it normal, while some variables are sensitive to change and need to be taken seriously even if they have small fluctuations. A single normalization operation can only put all data on the same scale, but cannot reflect the importance of different variables. Therefore, giving appropriate weights to different variables can improve the accuracy of anomaly detection. However, the advantages of the Seagull algorithm, such as simple steps and efficient calculation, also lead to the problem that the algorithm converges slowly and is easy to fall into the local optimal solution. The dual-force multi-factor Seagull algorithm does not change the calculation method of initializing the position vector, calculating the conflicting position, and the direction and distance from the optimal Seagull. On the basis of the original algorithm, it introduces the individual optimal solution and the global worst solution, and iterates in two search methods, which is no longer affected only by the global optimal solution. This improvement enriches the reference information for position update, which can largely avoid being misled by one-sided information and falling into the local optimal solution. At the same time, the strategy of multiple search methods makes the search results more generalized, which can improve the convergence speed and search accuracy of the algorithm and improve the efficiency of the algorithm.

[0010] When reconstructing the original data, when the difference between abnormal data and normal data is small, it is difficult for existing algorithms to effectively detect it. Therefore, the adversarial gated autoencoder network structure is introduced. The model is mainly composed of two gated autoencoders GAE. The gated autoencoder is an autoencoder composed of a gated recurrent unit GRU and a fully connected layer. Industrial control data is a kind of time-series multivariate data. The introduction of GRU is to better learn the time-series characteristics of the data. GRU is a recurrent neural network with a simple structure. It can reduce the amount of calculation while maintaining efficient learning ability. Therefore, using it to form an autoencoder can control the complexity of the model.

[0011] The last stage is the anomaly determination stage. This stage will use the original data, the reconstructed data obtained in the data reconstruction stage, and the direct determination result of the discriminator on the original data. The anomaly score calculation method of the reconstructed data is used to calculate its anomaly score, and then it is compared with the threshold to obtain the final anomaly determination result.

[0012] The positive effects of the present invention are:

[0013] 1. The model proposed in the present invention uses the dual-power multi-factor Seagull algorithm to process the original data, which can eliminate the influence of irrelevant variables.

[0014] 2. The present invention proposes an adversarial gated autoencoder network, which can train the model through adversarial learning so that the model can distinguish finer differences between normal and abnormal data.

[0015] 3. The adaptive threshold setting method based on extreme value theory and fitting root mean square error proposed in the present invention can dynamically set the threshold according to the characteristics of the data, making the algorithm adaptive. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is the overall algorithm framework diagram of the present invention;

[0017] Figure 2 is a neural network structure diagram used in the present invention;

[0018] Figure 3 It is the specific adversarial learning details of neural networks. DETAILED DESCRIPTION

[0019] The present invention mainly targets the abnormality detection scenario of industrial control system equipment, uses the dual-force multi-factor Seagull algorithm to process data, uses the adversarial gated autoencoder to reconstruct the original data, and uses the dynamic threshold to make abnormality judgments. The present invention is further described below in conjunction with the accompanying drawings.

[0020] The method proposed in this invention is applicable to real-time abnormal data detection of industrial control equipment. It mainly includes data processing based on the dual-force multi-factor Seagull algorithm, reconstructed data generation based on the adversarial gated autoencoder, and adaptive threshold abnormality judgment based on the reconstructed data. The entire algorithm framework is as follows Figure 1 shown.

[0021] Model training will use real data Figure 2 The neural network model structure shown in the figure is trained. The overall model consists of two gated autoencoders GAE, and the training details of the autoencoder are as follows Figure 3 As shown, the goal is to minimize the difference between the generated data GAE(X) and X obtained based on the original data X, so that the gated autoencoder can generate generated data that conforms to the probability distribution of the original data. Therefore, the first training goal is to minimize X and GAE 1 (X) and GAE 2 In addition, in order to further improve the learning of the original data features by the gated autoencoder, the idea of ​​adversarial learning is adopted to transform the GAE 1 Output of GAE 1 (X) Input to GAE 2 Get GAE 2 (GAE 1 (X)), at this time GAE 1 Analogous to a generator, GAE 2 Similar to the discriminator. The difference is that GAE 2 The output of is not a probability value to judge whether the input comes from real data or generated data, but another reconstructed data. At this time, GAE 1 The training goal is to minimize X and GAE 2 (GAE 1 (X)) and GAE 2 The training goal is to maximize X and GAE 2 (GAE 1 (X)). In this way, GAE is constantly learning against 1 and GAE 2 It will have a stronger ability to learn data features. The training objectives of the two are shown in the following formula.

[0022]

[0023] Where e represents the training round, and λ is a hyperparameter close to but greater than 1. If λ is set too large, the model will not learn enough original data features and will have a poor reconstruction effect. e is the training round. In the early stage of training, the value of e is small, so that the training goal is more focused on GAE. 1 and GAE2 As the number of training rounds increases, both gated autoencoders have a certain degree of reconstruction ability. The training goal will focus on GAE 1 and GAE 2 In order to make GAE 1 and GAE 2 Possesses further ability to generate accurate data.

[0024] Finally, the anomaly determination stage uses the following formula to make an anomaly determination:

[0025]

[0026] n represents the number of data points in a window class, R 1 (x i ) and R 2 (x i ) represent the data points x i In GAE 1 and GAE 2 The generated points and x i The residual between is calculated as shown in the following formula. γ represents a controllable weight value less than 1, which is used to control the reference weight of the two GAEs. τ is the abnormal threshold, and exceeding this threshold is considered abnormal.

[0027] R(x i )=||x i -GAE(x i ))|| 1

[0028] For the threshold of anomaly determination, most studies give a fixed value τ, and the case where the anomaly score is greater than this value is considered an anomaly. However, in actual production environments, there will be data fluctuations. A fixed anomaly threshold will cause misjudgment of anomalies, and as the data changes, the threshold may need to be re-determined. The setting of γ will control the overall detection effect. 1 It tends to generate reconstruction data that fits the normal data well, so if the γ value is set larger, the reference will be more biased towards GAE 1 This results in a lower proportion of positive points in the model detection results, making the model's false alarm rate lower. On the contrary, if the γ value is set to a smaller value, it will be more biased towards GAE. 2 Generate data. 2It tends to generate data that is different from the original data. At this time, the proportion of positive points in the model's detection results will increase, which will increase the model recall rate, but will also increase the false alarm rate. By controlling the γ value, the model effect can be effectively adjusted to meet different environmental requirements. The setting of the threshold τ will determine the effectiveness of the detection. For the threshold for anomaly determination, most studies give a fixed value τ, and the anomaly score greater than this value is considered an anomaly. However, there will be data fluctuations in the actual production environment. A fixed anomaly threshold will cause misjudgment of anomalies. The dynamic threshold commonly used in the industry is based on the extreme theory:

[0029]

[0030] The peak value in the above formula is often selected using the average excess function, which is the average excess function that exceeds the corresponding peak value x c The average of the random variables is as follows:

[0031]

[0032] In formula (17), n is greater than the peak value x c The number of values ​​of x c As the horizontal axis, e(x c ) is the ordinate, since e(x c ) for x c The slope of the function depends on ξ, which is a number greater than 1, so we only need to take the part of the function graph with a positive slope. That is, when x>x c If the image is tilted upward, it means that the data comes from a GPD distribution with a positive parameter. Then, we only need to select the peak value x c So that when x>x c When e(x c ) is approximately linear and has a positive slope. The traditional average excess function method requires subjective judgment and has large errors. Therefore, a selection method based on the root mean square error of the fitting is proposed. Using the multi-point test method, the following formula is used to calculate and select the minimum residual point, where the function g(l i )>0 is the straight line l connecting the first and last points in each set of data i The slope of e(x i ) is the average transcendental function.

[0033]

[0034] Examples of user scenarios of the present invention:

[0035] In some factories, such as hydropower stations or water conservancy testing institutions, it is necessary to detect water pressure, voltage and other data, and these data are required to be stable. If an abnormal situation occurs, such as the sensor is damaged or the water voltage rises or falls suddenly, an alarm needs to be issued. Here, the method of the present invention can be used.

Claims

1. An adaptive anomaly detection method AGAE based on adversarial gated autoencoder, characterized in that: The method comprises the following steps: Step 1: In the data processing stage based on the dual-force multi-factor Seagull algorithm, considering that the detection scenario faces a multivariate data stream, and different variables have different effects on anomaly detection, there is a problem that high-value irrelevant variables have a large impact while low-value key variables have a small impact. A dual-force multi-factor Seagull algorithm is proposed to find the contribution of different variables, so that the sensitivity of the model to different variables can be reasonably set; Step 2: Reconstructed data generation stage based on adversarial gated autoencoder. In this stage, the data is first divided into windows using a time domain window, and based on the generated window batch data, the adversarial gated autoencoder is used to obtain generated data based on the original data features. The main idea is to use the reconstruction error between the model's reconstructed data and the original data to make anomaly judgments. The adversarial gated autoencoder GAE is an AE model that introduces GRU. This paper proposes to use adversarial training to enable the two GAEs to have excellent data reconstruction capabilities. At the same time, in order to reduce the redundant calculation of GAE, a GRU structure with a decision-making mechanism is proposed; Step 3: Adaptive threshold anomaly judgment stage based on reconstructed data. In this stage, an anomaly score function combining two GAE generated data is proposed. At the same time, considering that there are data fluctuations in the actual generation environment, fixed threshold judgment may have misjudgment, so an adaptive threshold calculation method is proposed to dynamically calculate the threshold according to the generation situation, so that the model has strong adaptability.

2. The adaptive anomaly detection method AGAE based on adversarial gated autoencoder according to claim 1, characterized in that: In order to collect more effective data, factory sensors transmit multivariate data in most cases. However, different variables have different effects on data. Administrators may consider some irrelevant variables as normal even if they fluctuate greatly, while some variables are sensitive to changes and even small fluctuations need to be taken seriously. A single normalization operation can only put the data on the same scale, but cannot reflect the importance of different variables. Therefore, giving appropriate weights to different variables can improve the accuracy of anomaly detection. However, the advantages of the Seagull algorithm, such as simple steps and efficient calculation, also lead to the problem of slow convergence of the algorithm and easy to fall into the local optimal solution. Therefore, these shortcomings of the SOA algorithm will be addressed to improve the optimization effect. The position update strategy of the SOA algorithm adopts a spiral attack method to approach the optimal seagull. However, the optimal seagull is not necessarily the real optimal, which may cause the algorithm to converge slowly and fall into the local optimum. Venkata introduced the concepts of attraction and repulsion in his Jaya algorithm, that is, each position update will be attracted by the optimal value and repelled by the worst value. However, the update scheme still has little reference information. In order to refer to more information when updating the position, a dual-force multi-factor SOA is proposed by modifying the original SOA position update method, as shown in the following formula: In the formula, HS i (t+1) represents the updated position of the i-th seagull, D s (t) and x, y, z refer to the classic Seagull algorithm, HS i (t) indicates the current position, HS b (t) and HS w (t) represent the best position and the worst position of the current round, HS ib (i) represents the historical optimal position of the i-th seagull, r∈[0,1] is a random number. Different update strategies are adopted according to its value, which enriches the seagull's optimization method.

3. The adaptive anomaly detection method AGAE based on adversarial gated autoencoder according to claim 1, characterized in that: The existing industrial control anomaly detection algorithm has the problem of insufficient detection effect when the difference between abnormal data and normal data is small. In order to solve this problem, an adversarial gated autoencoder model is proposed. The model is mainly composed of two gated autoencoders GAE. The gated autoencoder is an autoencoder composed of a gated recurrent unit GRU and a fully connected layer. In order to reduce the calculation amount of the GAE model, this paper will transform the GRU structure and introduce a decision-making mechanism to avoid redundant calculations. After the GRU result is modified, the corresponding calculation formula is also changed, as follows: U t =σ(W u ×h t +b u ) P t =F binarize (U t ) The powerful generation ability of GAN has been recognized, but it has the problem of being unable to display the potential feature representation of the output original data, so that it can only use the discriminator part in the field of anomaly detection. In addition, due to the problem of unstable training of GAN, the detection accuracy is not high enough. In order to make up for the above defects, it is proposed to use adversarial learning to train two GAEs. In order to further improve the learning of the gated autoencoder on the original data features, the idea of ​​adversarial learning is adopted. The output of GAE1 GAE1(X) is input into GAE2 to obtain GAE2(GAE1(X)). At this time, GAE1 is analogous to the generator, and GAE2 is analogous to the discriminator. The difference is that the output of GAE2 is not a probability value for judging whether the input comes from real data or generated data, but another reconstructed data. At this time, the training goal of GAE1 is to minimize the difference between X and GAE2(GAE1(X)), and the training goal of GAE2 is to maximize the difference between X and GAE2(GAE1(X)). In this way, in the continuous adversarial learning, GAE1 and GAE2 will have stronger data feature learning capabilities. The training goals of the two are shown in the following formula:

4. The adaptive anomaly detection method AGAE based on adversarial gated autoencoder according to claim 1, characterized in that: In the final abnormality determination stage, the following formula will be used for abnormality determination: n represents the number of data points in a window class, R1(x i ) and R2(x i ) represent the data points x i The points generated in GAE1 and GAE2 are different from x i The residual between them is calculated as shown in the following formula, where γ represents a controllable weight value less than 1, which is used to control the reference weight of the two GAEs, and τ is the abnormal threshold. If it exceeds this threshold, it is considered abnormal: R(x i )=||x i -GAE(x i ))||1 The setting of γ will control the overall detection effect. Since GAE1 tends to generate reconstructed data that fits normal data well, if the γ value is set to a larger value, the reference will be more biased towards GAE1, resulting in a lower proportion of positive points in the model detection results, making the model's false alarm rate lower. On the contrary, if the γ value is set to a smaller value, it will be more biased towards the generated data of GAE2. Since GAE2 tends to generate data different from the original data, the proportion of positive points in the model's detection results will increase, which will improve the model recall rate, but will also increase the false alarm rate. By controlling the γ value, the model effect can be effectively adjusted to meet different environmental requirements. The setting of the threshold τ will determine the effectiveness of the detection. For the threshold for anomaly judgment, most studies give a fixed value τ, and the case where the anomaly score is greater than this value is considered anomaly. However, in the actual production environment, there will be data fluctuations, and the fixed anomaly threshold will cause misjudgment of anomalies. The dynamic threshold commonly used in the industry is based on the extreme theory: The peak value in the above formula is often selected using the average excess function, which is the average excess function that exceeds the corresponding peak value x c The average of the random variables is as follows: Where n is greater than the peak value x c The number of values ​​of x c As the horizontal axis, e(x c ) is the ordinate, since e(x c ) for x c The slope of the function depends on ξ, which is a number greater than 1, so we only need to take the part of the function graph with a positive slope, that is, when x>x c If the image is tilted upward, it means that the data comes from a GPD distribution with a positive parameter. Then, we only need to select the peak value x c So that when x>x c When e(x c ) is approximately linear and has a positive slope. The traditional average excess function method requires subjective judgment and has large errors. Therefore, a selection method based on the root mean square error of the fitting is proposed. Using the multi-point test method, the following formula is used to calculate and select the minimum residual point: The function g(l i )>0 is the straight line l connecting the first and last points in each set of data i The slope of e(x i ) is the average transcendental function.

Images