Method and device for determining steady state of industrial control network equipment

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an industrial control network equipment steady state determination method and device. The method comprises the following steps: determining a plurality of operation vectors used for representing the operated state of equipment according to the actually running equipment data, carrying out clustering processing on the operation vectors, selecting an average value vector with the most clusters, and taking the shortest duration corresponding to a plurality of continuously unchanged values in the determined average value vector as a steady-state window of target equipment, so that the steady-state window of the target equipment is obtained. Therefore, the steady-state window corresponding to the most common operation can be obtained through screening in a mode of the average value vector with the most clusters from the whole industrial control network, the shortest duration for the equipment to enter the steady state in the sorting network can be more widely represented, and the steady state of the equipment can be quickly and accurately judged.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to a method and a device for determining the steady state of industrial control network equipment. Background Art

[0002] Compared with traditional Internet networks, the attacks on industrial control networks of large industrial systems are more covert, and they focus on interference and destruction of the system's business logic. Therefore, it is necessary to understand the semantic information of data packets in the industrial control network in order to effectively improve the network security protection capabilities of the industrial control system. The set value attack is to control multiple nodes to achieve a large-amplitude attack on a single device, thereby destroying the stability and reliability of the device. Therefore, it is necessary to look at the entire network and quickly monitor the abnormal behavior of each device in the industrial control network. Generally speaking, in actual nuclear power operation scenarios, the equipment value does not change all the time, but is in a steady state for a long time. When directly analyzing the equipment value fluctuation curve, a large amount of irrelevant data will be generated. Therefore, it is necessary to reduce the calculation error and resource waste caused by irrelevant data, and quickly and accurately identify the steady state of the equipment. Summary of the invention

[0003] In order to overcome the problems existing in the related art, a method and device for determining the steady state of an industrial control network device are provided.

[0004] According to one aspect of an embodiment of the present disclosure, a method for determining a steady state of an industrial control network device is provided, the method comprising:

[0005] Step 1, determining a plurality of operation vectors according to data of actual operation of the target device in a preset period, each operation vector comprising a plurality of device values ​​arranged in time sequence, for indicating a state of the device being operated;

[0006] Step 2: clustering the determined multiple operation vectors using a clustering model to obtain multiple clusters, each cluster including one or more operation vectors;

[0007] Step 3, determining the average value vector of each operation vector in the cluster containing the largest number of operation vectors;

[0008] Step 4, taking the shortest duration corresponding to a plurality of values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device, where the steady-state window is the shortest duration for the device to enter a steady state;

[0009] Step 5: When it is determined that the device value of the device is equal to v and remains unchanged for a continuous period greater than the steady-state window, it is determined that the device is in a steady state with a value of v.

[0010] In a possible implementation, step 1 includes:

[0011] Step 11, obtaining and processing the actual operation data of the target device in the preset time period to form a total sequence, in which the values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time;

[0012] Step 12, determine all intervals in the total sequence where N consecutive device values ​​are the same, and mark the last device value in each interval as a reference point;

[0013] Step 13, in the total sequence, traverse backward sequentially from each reference point until the first device value different from the reference point appears, and use multiple device value sequences from the reference point to the device value as operation vectors.

[0014] In a possible implementation, step 2 further includes:

[0015] Step 21, determining the mean-shift vector between each operation vector and other operation vectors;

[0016] Step 22: multiple operation vectors whose mean-shift vectors converge to the same operation vector are regarded as members of the same cluster.

[0017] In a possible implementation, in step 121, the mean-shift vector M between each operation vector and other operation vectors is determined by the following formula: h (x).

[0018]

[0019] Among them, x is the operation vector, x i For S h Other operation vectors in S, i is an integer, 1≤i≤n, h is a high-dimensional sphere with x as the center and radius h. K is the kernel function used to measure the contribution of each sample point.

[0020] According to another aspect of an embodiment of the present disclosure, a device for determining a steady state of an industrial control network device is provided, the device comprising:

[0021] An acquisition processing module is used to determine a plurality of operation vectors according to the data of the actual operation of the target device in a preset period of time, each operation vector includes a plurality of device values ​​arranged in time sequence, and is used to indicate the state of the device being operated;

[0022] A clustering module, used for clustering the determined multiple operation vectors using a clustering model to obtain multiple clusters, each cluster including one or more operation vectors;

[0023] An average value module, used for determining an average value vector of each operation vector in the cluster class containing the largest number of operation vectors;

[0024] A steady-state window determination module, used to take the shortest duration corresponding to a plurality of values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device, where the steady-state window is the shortest duration for the device to enter a steady state;

[0025] The steady-state determination module is used to determine that the device is in a steady state with a value of v when it is determined that the device value of the device is equal to v and remains unchanged for a continuous period greater than the steady-state window.

[0026] In a possible implementation, the acquisition processing module includes:

[0027] The acquisition submodule is used to acquire and process the data of the actual operation of the target device in the preset period to form a total sequence, in which the values ​​of each device in the total sequence are arranged in chronological order according to the corresponding moments;

[0028] The marking submodule is used to determine the intervals in the total sequence where all N consecutive device values ​​are the same, and mark the last device value in each interval as a reference point;

[0029] The partitioning submodule is used to sequentially traverse backward from each reference point in the total sequence until the first device value different from the reference point appears, and multiple device value sequences between the reference point and the device value are used as operation vectors.

[0030] In a possible implementation, the clustering module further includes:

[0031] Mean-shift vector determination submodule, used to determine the mean-shift vector between each operation vector and other operation vectors;

[0032] The cluster submodule is used to take multiple operation vectors whose mean-shift vectors converge to the same operation vector as members of the same cluster.

[0033] In a possible implementation, in the mean-shift vector determination submodule, the mean-shift vector M between each operation vector and other operation vectors is determined by the following formula: h (x).

[0034]

[0035] Among them, x is the operation vector, x i For S h Other operation vectors in S, i is an integer, 1≤i≤n, h is a high-dimensional sphere with x as the center and radius h. K is the kernel function used to measure the contribution of each sample point.

[0036] According to another aspect of an embodiment of the present disclosure, a device for determining a steady state of an industrial control network device is provided, the device comprising:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured to execute the above method.

[0040] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0041] The beneficial effects of the present disclosure are as follows: the present disclosure determines multiple operation vectors for characterizing the operated state of the device based on the device data of actual operation, and clusters the operation vectors, selects the average value vector with the most clusters, and uses the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device. In this way, the steady-state window corresponding to the most common operation can be obtained from the perspective of the overall industrial control network by screening out the average value vector with the most clusters, which can more broadly represent the shortest duration for the device in the network to enter a steady state, and is helpful for quickly and accurately judging the steady state of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of a method for determining the steady state of an industrial control network device shown in an embodiment of the present disclosure.

[0043] Figure 2 The diagram is a schematic diagram showing an example of how the device value of a device in an industrial control network changes over time.

[0044] Figure 3 It is a block diagram of a device for determining a steady state of an industrial control network device shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0045] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0047] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0048] Figure 1 1 is a flow chart of a method for determining the steady state of an industrial control network device shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, a laptop computer, etc. The embodiment of the present disclosure does not limit the type of the terminal device. Figure 1 As shown, the method includes:

[0049] Step 1: Determine a plurality of operation vectors according to data of actual operation of the target device in a preset period of time, each operation vector comprising a plurality of device values ​​arranged in time sequence, and used to indicate a state in which the device is operated.

[0050] As an example of this embodiment, step 1 may include: step 11 to step 13.

[0051] Step 11, obtain and process the actual operation data of the target device during the preset period, and form Figure 2 The total sequence shown, the device values ​​in the total sequence are arranged in chronological order according to the corresponding moments.

[0052] Step 12: determine all intervals in the total sequence where N consecutive device values ​​are the same, and mark the last device value in each interval as a reference point. N can be 4, for example, and the specific value of N can be adjusted according to expert experience, which is not limited in the present disclosure.

[0053] Step 13, in the total sequence, traverse backward sequentially from each reference point until the first device value different from the reference point appears, and use multiple device value sequences from the reference point to the device value as operation vectors.

[0054] In this way, the present disclosure can quickly filter the steady-state data in the sample through the empirical value, which helps to accurately capture the fluctuating device value from the time when the device value changes to the time when it enters the steady state as the operation vector. In addition, in step 1, the steady-state value of the device in the steady state can also be determined in advance based on experience, and multiple device values ​​that continuously exceed the steady-state value can be used as the operation vector.

[0055] Step 2: cluster the determined multiple operation vectors using a clustering model to obtain multiple clusters, each cluster including one or more operation vectors. As an example of this embodiment, step 2 also includes: steps 21 to 23.

[0056] Step 21, determining the mean-shift vector between each operation vector and other operation vectors;

[0057] Step 22: multiple operation vectors whose mean-shift vectors converge to the same operation vector are regarded as members of the same cluster.

[0058] In a possible implementation, in step 121, the mean-shift vector M between each operation vector and other operation vectors is determined by the following formula: h (x).

[0059]

[0060] Among them, x is the operation vector, x i For S h Other operation vectors in S, i is an integer, 1≤i≤n, h is a high-dimensional spherical region with x as the center point and a radius of h. K is a kernel function used to measure the contribution of each sample point. In the present disclosure, the kernel function can be, for example, a Gaussian kernel or a flat kernel. It should be noted that the mean-shift vector can also be determined by a basic calculation method, which is not limited in the present disclosure.

[0061] Step 3: Determine the average value vector of each operation vector in the cluster containing the largest number of operation vectors. In this way, the most common operations can be screened out, making the determined steady-state window more representative.

[0062] Step 4: The shortest duration corresponding to a plurality of values ​​that remain unchanged continuously in the determined average value vector is used as the steady-state window of the target device. The steady-state window is the shortest duration for the device to enter a steady state.

[0063] Step 5: When it is determined that the device value of the device is equal to v and remains unchanged for a continuous period greater than the steady-state window, it is determined that the device is in a steady state with a value of v.

[0064] The present invention determines multiple operation vectors for characterizing the operated state of a device based on the device data of actual operation, clusters the operation vectors, selects the average value vector with the most clusters, and uses the shortest duration corresponding to multiple values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device. In this way, the steady-state window corresponding to the most common operation can be obtained from the perspective of the entire industrial control network by screening out the average value vector with the most clusters. This can more broadly represent the shortest duration for devices in the network to enter a steady state, and is helpful for quickly and accurately judging the steady state of the device.

[0065] According to another aspect of an embodiment of the present disclosure, a device for determining a steady state of an industrial control network device is provided, the device comprising:

[0066] An acquisition processing module is used to determine a plurality of operation vectors according to the data of the actual operation of the target device in a preset period of time, each operation vector includes a plurality of device values ​​arranged in time sequence, and is used to indicate the state of the device being operated;

[0067] A clustering module, used for clustering the determined multiple operation vectors using a clustering model to obtain multiple clusters, each cluster including one or more operation vectors;

[0068] An average value module, used for determining an average value vector of each operation vector in the cluster class containing the largest number of operation vectors;

[0069] A steady-state window determination module, used to take the shortest duration corresponding to a plurality of values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device, where the steady-state window is the shortest duration for the device to enter a steady state;

[0070] The steady-state determination module is used to determine that the device is in a steady state with a value of v when it is determined that the device value of the device is equal to v and remains unchanged for a continuous period greater than the steady-state window.

[0071] In a possible implementation, the acquisition processing module includes:

[0072] The acquisition submodule is used to acquire and process the data of the actual operation of the target device in the preset period to form a total sequence, in which the values ​​of each device in the total sequence are arranged in chronological order according to the corresponding moments;

[0073] The marking submodule is used to determine the intervals in the total sequence where all N consecutive device values ​​are the same, and mark the last device value in each interval as a reference point;

[0074] The partitioning submodule is used to sequentially traverse backward from each reference point in the total sequence until the first device value different from the reference point appears, and multiple device value sequences between the reference point and the device value are used as operation vectors.

[0075] In a possible implementation, the clustering module further includes:

[0076] Mean-shift vector determination submodule, used to determine the mean-shift vector between each operation vector and other operation vectors;

[0077] The cluster submodule is used to take multiple operation vectors whose mean-shift vectors converge to the same operation vector as members of the same cluster.

[0078] In a possible implementation, in the mean-shift vector determination submodule, the mean-shift vector M between each operation vector and other operation vectors is determined by the following formula: h (x).

[0079]

[0080] Among them, x is the operation vector, x i For S h Other operation vectors in S, i is an integer, 1≤i≤n, h is a high-dimensional sphere with x as the center and radius h. K is the kernel function used to measure the contribution of each sample point.

[0081] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0082] Figure 3 1900 is a block diagram of a device for determining a steady state of an industrial control network device according to an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0083] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0084] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0085] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0086] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0087] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0088] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0089] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0090] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0091] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0092] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0093] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for determining the steady state of an industrial control network device, characterized in that: The method comprises: Step 1, determining a plurality of operation vectors according to data of actual operation of the target device in a preset period, each operation vector comprising a plurality of device values ​​arranged in time sequence, for indicating a state of the device being operated; Step 2: clustering the determined multiple operation vectors using a clustering model to obtain multiple clusters, each cluster including one or more operation vectors; Step 3, determining the average value vector of each operation vector in the cluster containing the largest number of operation vectors; Step 4, taking the shortest duration corresponding to a plurality of values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device, where the steady-state window is the shortest duration for the device to enter a steady state; Step 5: When it is determined that the device value of the device is equal to v and remains unchanged for a continuous period greater than the steady-state window, it is determined that the device is in a steady state with a value of v.

2. The method according to claim 1, characterized in that Step 1 includes: Step 11, obtaining and processing the actual operation data of the target device in the preset time period to form a total sequence, in which the values ​​of each device in the total sequence are arranged in chronological order according to the corresponding time; Step 12, determine all intervals in the total sequence where N consecutive device values ​​are the same, and mark the last device value in each interval as a reference point; Step 13, in the total sequence, traverse backward sequentially from each reference point until the first device value different from the reference point appears, and use multiple device value sequences from the reference point to the device value as operation vectors.

3. The method according to claim 1, characterized in that Step 2 also includes: Step 21, determining the mean-shift vector between each operation vector and other operation vectors; Step 22: multiple operation vectors whose mean-shift vectors converge to the same operation vector are regarded as members of the same cluster.

4. The method according to claim 2, characterized in that: In step 121, the mean-shift vector M between each operation vector and other operation vectors is determined by the following formula: h (x); Among them, x is the operation vector, x i For S h Other operation vectors in S, i is an integer, 1≤i≤n, h It is a high-dimensional spherical area with x as the center and a radius of h. K is the kernel function used to measure the contribution of each sample point.

5. A device for determining the steady state of industrial control network equipment, characterized in that: The device comprises: An acquisition processing module is used to determine a plurality of operation vectors according to the data of the actual operation of the target device in a preset period of time, each operation vector includes a plurality of device values ​​arranged in time sequence, and is used to indicate the state of the device being operated; A clustering module, used for clustering the determined multiple operation vectors using a clustering model to obtain multiple clusters, each cluster including one or more operation vectors; An average value module, used for determining an average value vector of each operation vector in the cluster class containing the largest number of operation vectors; A steady-state window determination module, used to take the shortest duration corresponding to a plurality of values ​​that remain unchanged continuously in the determined average value vector as the steady-state window of the target device, where the steady-state window is the shortest duration for the device to enter a steady state; The steady-state determination module is used to determine that the device is in a steady state with a value of v when it is determined that the device value of the device is equal to v and remains unchanged for a continuous period greater than the steady-state window.

6. The device according to claim 1, characterized in that The acquisition processing module includes: The acquisition submodule is used to acquire and process the data of the actual operation of the target device in the preset period to form a total sequence, in which the values ​​of each device in the total sequence are arranged in chronological order according to the corresponding moments; The marking submodule is used to determine the intervals in the total sequence where all N consecutive device values ​​are the same, and mark the last device value in each interval as a reference point; The partitioning submodule is used to sequentially traverse backward from each reference point in the total sequence until the first device value different from the reference point appears, and multiple device value sequences between the reference point and the device value are used as operation vectors.

7. The device according to claim 5, characterized in that The clustering module also includes: Mean-shift vector determination submodule, used to determine the mean-shift vector between each operation vector and other operation vectors; The cluster submodule is used to take multiple operation vectors whose mean-shift vectors converge to the same operation vector as members of the same cluster.

8. The device according to claim 6, characterized in that In the mean-shift vector determination submodule, the mean-shift vector M between each operation vector and other operation vectors is determined by the following formula: h (x); Among them, x is the operation vector, x i For S h Other operation vectors in S, i is an integer, 1≤i≤n, h It is a high-dimensional spherical area with x as the center and a radius of h. K is the kernel function used to measure the contribution of each sample point.

9. A device for determining the steady state of an industrial control network device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the device described in any one of claims 1 to 4.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the apparatus according to any one of claims 1 to 4 is implemented.

Images