DCS network fault detection and intelligent reasoning method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a DCS network fault detection and intelligent reasoning method and device. According to the method and the device, the deep learning model and the knowledge graph technology are combined, and the accuracy and the intelligent level of DCS network fault detection are improved. Specifically, flow data and equipment state data in a DCS network are acquired through a DPI technology and an SNMP protocol, and features related to faults are extracted from log data by using a natural language processing technology. And then, through a knowledge graph embedding method, compressing the extracted high-dimensional information into a low-dimensional embedded vector matrix, and inputting the low-dimensional embedded vector matrix into a deep learning model for fault detection and prediction.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and in particular relates to a DCS network fault detection and intelligent reasoning method and device. Background Art

[0002] DCS (distributed control system) is an important part of industrial control system and is widely used in various industrial automation processes. Fault detection of DCS network is a key link to ensure the safety and stable operation of industrial processes. However, with the expansion of DCS network scale and the increase of complexity, traditional fault detection methods are difficult to cope with the challenges of dynamic changes in network environment and complex fault modes.

[0003] In DCS network fault detection, accurately identifying network traffic anomalies, device status anomalies, and potential threats in logs is the core element to ensure the safe operation of the system. Traditional methods usually rely on rules and threshold settings, which are difficult to capture complex fault characteristics and patterns. Therefore, the demand for intelligent and accurate fault detection technology is becoming increasingly urgent.

[0004] In the field of network security, knowledge graph embedding methods have gradually become a key technology to improve the efficiency and accuracy of deep learning models. However, traditional embedding methods such as TransE have shown some limitations when dealing with complex entities and relationships. Specifically, although traditional embedding methods are simple and computationally efficient, they can only handle linear relationships. For network security knowledge graphs involving multiple relationships and complex structures, traditional embedding methods often have difficulty capturing nonlinear associations between entities. This results in suboptimal performance of the model when dealing with tasks such as threat detection and fault prediction. Summary of the invention

[0005] In order to overcome the problems existing in the related technologies, a DCS network fault detection and intelligent reasoning method and device are provided.

[0006] According to one aspect of an embodiment of the present disclosure, a DCS network fault detection and intelligent reasoning method is provided, the method comprising:

[0007] Step 1: Data collection and preprocessing: The terminal device collects data from the DCS network and extracts the feature set after cleaning and classification.

[0008] Step 2: knowledge graph construction, including:

[0009] Step 21, domain knowledge extraction, extracting domain knowledge related to network failures from industrial control system related literature, technical documents and expert knowledge;

[0010] Step 22, knowledge representation, using standard language to represent knowledge and constructing a graph of entity nodes and relationship edges;

[0011] Step 23, knowledge graph construction and update, including:

[0012] Step 231, knowledge acquisition, automatically extracting knowledge from unstructured data through text mining and expert systems;

[0013] Step 232, knowledge fusion and reasoning, combining the existing industrial control system fault knowledge base, using the score function of the Complex model to measure the credibility of the triples containing the head entity, relationship, and tail entity in the knowledge graph, mapping the entities and relationships to the complex space, and then calculating the score of the triples through the dot product of the complex numbers, and automatically generating reasoning rules;

[0014] Step 3: Deep learning model training and prediction. Fault detection is performed based on the deep learning model, and a multi-layer LSTM or Transformer-based model is used. The input data includes network traffic, device status, and log data. Combined with the features generated by the knowledge graph, the fault probability, type prediction, and cause location are output.

[0015] In a possible implementation, step 1 includes:

[0016] Step 11, data acquisition, the terminal device collects data through the DCS switch gateway system and stores the collected data in categories; the data includes network traffic, device status log, alarm information and historical fault records;

[0017] Among them, the terminal device uses DPI technology to obtain network traffic data and stores it by timestamp. The network traffic data includes IP packets, protocol types, traffic size, and communication delay;

[0018] The terminal device uses SNMP or a dedicated API interface to regularly collect device status data, including CPU usage, memory usage, and network interface status;

[0019] The terminal device is equipped with a log collector to obtain log data at regular intervals, and archive and analyze the log data through the log management system. The log data includes system logs, application logs, and device logs.

[0020] The terminal device extracts historical fault data from the fault record library and generates a structured data table. The historical fault data includes the fault occurrence time, type, impact range, and fault recovery time.

[0021] Step 12: Data cleaning: The terminal device uses a data cleaning tool to remove abnormal spikes in network traffic by setting thresholds and smoothing the delay data using a sliding window method.

[0022] Step 13, feature extraction, the terminal device uses a feature extraction tool to extract key features of the cleaned data.

[0023] In a possible implementation, step 13 includes:

[0024] Step 131, the terminal device determines the high-dimensional features of the cleaned data, the high-dimensional features including the rate of change of the traffic pattern, the time interval between statistical packets, and the response delay of the analysis device;

[0025] Step 132: The terminal device uses PCA or LDA to reduce the dimension of the high-dimensional features and retain the most representative feature set;

[0026] In step 133, the terminal device uses pre-stored fault records to label the data. To address the problem of scarce fault samples, SMOTE is also used for data enhancement to balance the data set.

[0027] In one possible implementation, step 232 includes:

[0028] Step 2321, input the triple form data into the Complex embedding model; each triple consists of a head entity h, a relation r, and a tail entity t, describing a fact in the knowledge graph;

[0029] In the complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk respectively. The complex representation of the head entity h includes the real part and the imaginary part, which are represented as Re(H) and Im(H) respectively. The relation r is also mapped to a complex representation.

[0030] Step 2322, the Complex model projects Hk and Tk into the complex space, and by calculating the vector dot product of the head entity and the tail entity in the complex space, the Complex model determines the internal relationship of the triple (h, r, t);

[0031] Step 2323, the output of the Complex model is an embedding vector matrix as a feature generated by the knowledge graph, where each row corresponds to an embedded representation of an entity or relationship.

[0032] In a possible implementation, step 3 further includes:

[0033] Step 31, model selection and design;

[0034] Step 311, select the model architecture. Based on the time series data characteristics of the DCS network, select the LSTM or GRU model, and design a multi-layer network structure to improve the time series prediction ability of the model; for complex multimodal data, consider using the Transformer model to enhance the global feature capture capability;

[0035] Step 312: Input feature settings, combining the features extracted by the data preprocessing module with the knowledge graph reasoning results as the input of the model; the input features include network traffic features, device status features, log features, and reasoning features generated by the knowledge graph;

[0036] Step 313, output setting, the output of the model includes fault probability, fault type prediction, fault cause location, and the Softmax function is used to predict multiple categories of fault types, and a detailed fault analysis is provided in combination with the explanatory output of the knowledge graph;

[0037] Step 32, model training;

[0038] Step 321, training data preparation, using the labeled data set generated by the data preprocessing module to divide into a training set, a validation set and a test set;

[0039] Step 322, hyperparameter tuning, determining the optimal hyperparameter configuration of the model through grid search or Bayesian optimization;

[0040] Step 323, training process, using a distributed training framework (such as TensorFlow or PyTorch) to train the model in a GPU acceleration environment; regularly evaluating the model performance on the validation set, and preventing overfitting through EarlyStopping;

[0041] Step 33, model verification and testing;

[0042] Step 331, verification and testing, using confusion matrix, ROC curve, AUC, F1-score indicators to evaluate model performance;

[0043] Step 332, model improvement, retraining and optimizing the model for the fault types that performed poorly during the verification process; using transfer learning technology, continuously updating the model to adapt to new data features.

[0044] In a possible implementation, the method further includes step 4, system integration and deployment, including:

[0045] Step 41, real-time fault detection system, builds a data stream processing pipeline, inputs real-time network traffic and device status data into the trained model, and when an anomaly is detected, the system automatically triggers an alarm and notifies relevant personnel;

[0046] Step 42: The knowledge graph and the model work together to conduct an in-depth analysis of the detected faults in combination with the knowledge graph, and provide explanations of the causes of the faults and treatment suggestions; at the same time, the model and knowledge graph are continuously updated by collecting new data.

[0047] In a possible implementation, the method further includes step 5, performance optimization and evaluation, including:

[0048] Step 51, performance optimization, optimizing the model architecture according to the characteristics of the DCS network, such as adding a mechanism that is sensitive to delays or a method for handling data incompleteness, and accelerating the response speed of real-time detection to adapt to the resource limitations of the DCS system;

[0049] Step 52, system evaluation, simulates different fault scenarios in the DCS network environment through simulation tools to comprehensively evaluate the real-time detection capability of the system; deploys the system in the actual DCS network, collects long-term operation data, and evaluates the stability, detection accuracy and response speed of the system under different load conditions.

[0050] According to another aspect of the embodiment of the present disclosure, a DCS network fault detection and intelligent reasoning device is provided, the device comprising:

[0051] The data collection and preprocessing module is used to collect data from the DCS network and extract the feature set after cleaning and classification;

[0052] Knowledge graph construction, including:

[0053] Domain knowledge extraction module, used to extract domain knowledge related to network failures from industrial control system related literature, technical documents and expert knowledge;

[0054] The knowledge representation module is used to represent knowledge using a standard language and construct a graph of entity nodes and relationship edges;

[0055] Knowledge graph construction and updating, including:

[0056] Knowledge acquisition module, used to automatically extract knowledge from unstructured data through text mining and expert systems;

[0057] The knowledge fusion and reasoning module is used to combine the existing industrial control system fault knowledge base, use the score function of the Complex model to measure the credibility of the triples containing the head entity, relationship, and tail entity in the knowledge graph, map the entities and relationships to the complex space, and then calculate the score of the triples through the dot product of the complex numbers, and automatically generate reasoning rules;

[0058] The deep learning model training and prediction module is used for fault detection based on deep learning models and uses a multi-layer LSTM or Transformer-based model; the input data includes network traffic, device status, and log data, combined with the features generated by the knowledge graph, to output the probability of fault occurrence, type prediction, and cause location.

[0059] According to another aspect of the embodiment of the present disclosure, a DCS network fault detection and intelligent reasoning device is provided, the device comprising:

[0060] processor;

[0061] a memory for storing processor-executable instructions;

[0062] Wherein, the processor is configured to execute the above method.

[0063] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0064] The beneficial effect of the present disclosure is that the present disclosure combines deep learning models and knowledge graph technology, aiming to improve the accuracy and intelligence level of DCS network fault detection. Specifically, the present disclosure collects traffic data and equipment status data in the DCS network through DPI technology and SNMP protocol, and uses natural language processing technology to extract fault-related features from log data. Subsequently, the extracted high-dimensional information is compressed into a low-dimensional embedding vector matrix through the knowledge graph embedding method, and input into the deep learning model for fault detection and prediction. Among them, the present disclosure adopts the Complex embedding model. The Complex model can better capture complex nonlinear relationships by mapping entities and relationships to complex space and using the dot product operation of complex vectors to model the relationship between entities. Through the dot product operation of complex space, the complex association between entities and relationships can be accurately modeled. The Complex model not only solves the limitations of traditional embedding methods, but also significantly improves the accuracy and efficiency of deep learning models in DCS network fault detection, and realizes more intelligent and reliable fault detection and analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a diagram showing a DCS network fault detection and intelligent reasoning method according to an exemplary embodiment.

[0066] Figure 2 The figure is a diagram of a DCS network fault detection and intelligent reasoning device according to an exemplary embodiment. DETAILED DESCRIPTION

[0067] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0068] Figure 11 is a diagram showing a DCS network fault detection and intelligent reasoning method according to an exemplary embodiment. The method can be executed by a terminal device, wherein the terminal device can be, for example, a central server or a server cluster, etc. The embodiment of the present disclosure does not limit the type of the terminal device. Figure 1 As shown, the method includes,

[0069] Step 1: Data collection and preprocessing: The terminal device collects data from the DCS network and extracts the feature set after cleaning and classification.

[0070] As an example of this embodiment, step 1 may include the following steps.

[0071] Step 11, data acquisition, the terminal device collects data through the DCS switch gateway system and stores the collected data in categories. The data includes network traffic, device status logs, alarm information and historical fault records. The data is aggregated to the terminal device through the switch gateway system to ensure coverage of all key nodes in the DCS network.

[0072] For example, the terminal device uses DPI (deep packet inspection) technology to obtain network traffic data and store it by timestamp. The network traffic data may include, for example, IP packets, protocol types, traffic size, communication delay, etc.

[0073] The terminal device uses SNMP (Simple Network Management Protocol) or a dedicated API interface to regularly collect device status data. The device status data may include, for example, CPU usage, memory usage, network interface status, etc.

[0074] The terminal device is equipped with a log collector to obtain log data at a regular interval and archive and analyze it through the log management system. The log data includes system logs, application logs, and device logs.

[0075] The terminal device extracts historical fault data from the fault record library and generates a structured data table. The historical fault data may include, for example, the time of occurrence, type, impact range, fault recovery time, etc. of the fault.

[0076] Step 12: Data cleaning: The terminal device uses a data cleaning tool to remove abnormal spikes in network traffic by setting thresholds and uses a sliding window method to smooth the delay data.

[0077] Step 13, feature extraction, the terminal device uses a feature extraction tool to extract key features of the cleaned data.

[0078] In one possible implementation, step 13 includes:

[0079] Step 131, the terminal device determines the high-dimensional features of the cleaned data, the high-dimensional features including the rate of change of the traffic pattern, the time interval between statistical packets, and the response delay of the analysis device.

[0080] In step 132, the terminal device uses PCA (principal component analysis) or LDA (linear discriminant analysis) to reduce the dimension of high-dimensional features and retain the most representative feature set.

[0081] Step 133: The terminal device uses the existing fault records to label the data. To address the problem of scarce fault samples, SMOTE (synthetic minority oversampling technique) can also be used for data enhancement to generate more fault samples to balance the data set.

[0082] Step 2: knowledge graph construction, including:

[0083] Step 21, domain knowledge extraction, extracts domain knowledge related to network failures from industrial control system related literature, technical documents and expert knowledge.

[0084] Step 22, knowledge representation, uses standard languages ​​such as RDF or OWL to represent knowledge and constructs a graph including entity nodes such as "switch", "controller", "sensor" and relationship edges such as "connection relationship" and "fault cause".

[0085] Step 23, knowledge graph construction and update, including:

[0086] Step 231, knowledge acquisition, automatically extracting knowledge from unstructured data through text mining and expert systems;

[0087] Step 232, knowledge fusion and reasoning, combines the existing industrial control system fault knowledge base, uses logical reasoning and machine learning methods to fuse new knowledge, and automatically generates reasoning rules.

[0088] For example, in step 232, on the basis of constructing the knowledge graph, in order to achieve effective representation of entities and relationships, a graph embedding algorithm model is usually used. High-dimensional information knowledge (such as complex associations between entities, diversity of threat patterns, etc.) is compressed into a low-dimensional embedding matrix. However, due to the complexity of entities in the field of network security, many threat description reports have diverse writing styles, and a lot of noise is introduced in the process of text conversion, which makes the traditional Transe embedding model method difficult to cope with.

[0089] In view of this, the present disclosure uses the Complex embedding model method. The Complex model can more effectively capture and represent the interactions between complex entities and relationships by mapping entities and relationships to complex space. This method can not only improve the accuracy of embedding, but also better cope with the interference of noisy data in the field of network security, and ultimately achieve efficient fusion and reasoning of knowledge graphs.

[0090] The score function of the Complex model is used to measure the credibility of a triple (head entity, relationship, tail entity) in the knowledge graph. The entities and relationships are mapped to the complex space, and then the score of the triple is calculated by the dot product of the complex numbers. The specific score function can be expressed as,

[0091] Where h is the head entity, r is the relation, t is the tail entity, and (h, r, t) is the complex embedding triplet vector. is the complex conjugate of the tail entity embedding vector, Represents the dot product of complex vectors. The result is a complex number, and Re(.) represents the real part of the complex number.

[0092] Step 2321, input the triple-form data containing entities and relations into the Complex embedding model. Each triple consists of a head entity, a relation, and a tail entity, and describes a fact in the knowledge graph. The Complex model implements embedding representation by mapping these entities and relations from real number space to complex number space.

[0093] In the complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk, respectively. The complex representation of the head entity h includes the real part and the imaginary part, represented as Re(H) and Im(H), respectively, and the relation R is also mapped to a complex representation. By calculating the vector dot product of the head entity and the tail entity in the complex space, the Complex model can capture the intrinsic relationship of the triple (H, R, T). This dot product operation is used to measure the matching degree between the head entity and the tail entity under a given relation R.

[0094] In step 2322, the Complex model projects Hk and Tk into the complex space and effectively models the relationship between the triples through the dot product operation. These obtained complex embedding vectors are then fused with the knowledge in the existing cybersecurity knowledge base. The newly extracted knowledge is merged with the existing knowledge by calculating similarity or using other fusion techniques to generate new reasoning rules and update the knowledge graph. In this way, the knowledge graph not only covers the updated entity relationships, but also includes new reasoning rules, thereby improving the coverage and accuracy of the graph.

[0095] Step 2323, the output of the Complex model is an embedding vector matrix, in which each row corresponds to an embedding representation of an entity or relationship. This embedding matrix contains the fused new knowledge and existing knowledge. The present disclosure inputs this embedding matrix into a suitable deep learning model architecture (such as LSTM) for supervised training to significantly improve the accuracy of the model in network security fault detection. In this way, the fused knowledge graph not only enhances the ability to identify complex threats, but also provides more comprehensive and accurate protection measures for network security.

[0096] Step 3: Deep learning model training and prediction. Fault detection is performed based on deep learning models (such as RNN, LSTM, GRU, etc.), and multi-layer LSTM or Transformer-based models are considered. Input data includes network traffic, device status, and log data. Combined with the features generated by the knowledge graph, the output is the probability of fault occurrence, type prediction, and cause location.

[0097] As an example of this embodiment, in step 3, the following steps are also included:

[0098] Step 31, model selection and design.

[0099] Step 311, select the model architecture. Based on the time series data characteristics of the DCS network, select the LSTM or GRU model, and design a multi-layer network structure to improve the time series prediction ability of the model. For complex multimodal data, consider using the Transformer model to enhance the global feature capture capability.

[0100] Step 312, input feature settings, combine the features extracted by the data preprocessing module with the knowledge graph reasoning results as the input of the model. The input features include network traffic features, device status features, log features, and reasoning features generated by the knowledge graph.

[0101] Step 313, output setting, the output of the model includes fault probability, fault type prediction, fault cause location, etc. The Softmax function is used to predict multi-category fault types, and a detailed fault analysis is provided in combination with the explanatory output of the knowledge graph.

[0102] Step 32: model training.

[0103] Step 321, training data preparation, uses the labeled data set generated by the data preprocessing module to divide the training set, validation set and test set to ensure the generalization ability of the model.

[0104] Step 322, hyperparameter tuning, determines the optimal hyperparameter configuration of the model (such as learning rate, number of LSTM layers, number of hidden units, etc.) through grid search or Bayesian optimization to ensure the training convergence and prediction performance of the model.

[0105] Step 323, training process, uses a distributed training framework (such as TensorFlow or PyTorch) to train the model in a GPU accelerated environment. Regularly evaluate the model performance on the validation set, and use EarlyStopping to prevent overfitting.

[0106] Step 33: Model verification and testing.

[0107] Step 331, verification and testing, uses confusion matrix, ROC curve, AUC, F1-score and other indicators to evaluate model performance, paying special attention to the recall rate of fault detection to ensure the high sensitivity of the model to faults.

[0108] Step 332, model improvement, retraining and optimizing the model for the fault types that performed poorly during the verification process. Using transfer learning technology, the model is continuously updated to adapt to new data features.

[0109] Step 4, system integration and deployment, includes:

[0110] Step 41, real-time fault detection system, builds a data stream processing pipeline, inputs real-time network traffic and device status data into the trained model, and when an anomaly is detected, the system automatically triggers an alarm and notifies relevant personnel.

[0111] For example, in the construction of data stream pipelines, Apache Kafka is used as a real-time data transmission channel to transmit network traffic and device status data to the model in real time. Apache Flink or Apache Spark Streaming is used to process data streams to ensure that the data is cleaned and preprocessed before entering the model.

[0112] Model deployment: deploy the trained deep learning model on the core server of the DCS system, and combine it with Docker containerization technology to achieve rapid deployment and expansion of the model.

[0113] The real-time alarm system defines alarm rules based on the prediction results of the model. When the model predicts that the probability of a fault exceeds the set threshold, the system immediately triggers an alarm and notifies relevant personnel through the SCADA system interface, SMS or email.

[0114] Step 42: The knowledge graph and the model work together to perform an in-depth analysis of the detected faults, and provide explanations of the causes of the faults and suggestions for handling them. At the same time, the model and knowledge graph are continuously updated by collecting new data to continuously improve the detection accuracy.

[0115] For example, the fault cause analysis system combines the reasoning results of the knowledge graph during the fault detection process to provide explanations and suggestions for the fault cause. The system automatically generates a fault analysis report, including possible root causes of the fault, propagation paths, and recommended repair measures.

[0116] Self-learning and model updating: During system operation, new network data and fault information are continuously collected, and the input features of the model are continuously updated through the knowledge graph to achieve adaptive learning and dynamic updating of the model.

[0117] Step 5, performance optimization and evaluation, including:

[0118] Step 51, performance optimization, optimizes the model architecture according to the characteristics of the DCS network, such as adding a mechanism that is sensitive to delay or a method for handling data incompleteness, and speeding up the response speed of real-time detection to adapt to the resource limitations of the DCS system.

[0119] Step 52, system evaluation, simulates different fault scenarios in the DCS network environment through simulation tools to comprehensively evaluate the real-time detection capability of the system. Deploy the system in the actual DCS network, collect long-term operation data, and evaluate the stability, detection accuracy and response speed of the system under different load conditions.

[0120] The method disclosed in this paper not only improves the accuracy of embedded representation, but also improves the performance of deep learning models in fault detection and safety assessment in complex network environments. By combining the Complex model, this paper has achieved significant improvements in improving the accuracy and interpretability of DCS network fault detection, solving the shortcomings of traditional embedding methods, and combining knowledge graphs with deep learning models, which can not only improve the accuracy of fault detection, but also provide support for the explanation and reasoning of fault causes, thereby enhancing the overall security and reliability of the DCS network.

[0121] Figure 2 1900 is a diagram showing a DCS network fault detection and intelligent reasoning device according to an exemplary embodiment. For example, the device 1900 can be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0122] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, FreeBSD TM or the like.

[0123] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0124] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0125] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or raised structures in grooves on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0126] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0127] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0128] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0129] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0130] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0131] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0132] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A DCS network fault detection and intelligent reasoning method, characterized in that: The method comprises: Step 1: Data collection and preprocessing: The terminal device collects data from the DCS network and extracts the feature set after cleaning and classification. Step 2: knowledge graph construction, including: Step 21, domain knowledge extraction, extracting domain knowledge related to network failures from industrial control system related literature, technical documents and expert knowledge; Step 22, knowledge representation, using standard language to represent knowledge and constructing a graph of entity nodes and relationship edges; Step 23, knowledge graph construction and update, including: Step 231, knowledge acquisition, automatically extracting knowledge from unstructured data through text mining and expert systems; Step 232, knowledge fusion and reasoning, combining the existing industrial control system fault knowledge base, using the score function of the Complex model to measure the credibility of the triples containing the head entity, relationship, and tail entity in the knowledge graph, mapping the entities and relationships to the complex space, and then calculating the score of the triples through the dot product of the complex numbers, and automatically generating reasoning rules; Step 3: Deep learning model training and prediction. Fault detection is performed based on the deep learning model, and a multi-layer LSTM or Transformer-based model is used. The input data includes network traffic, device status, and log data. Combined with the features generated by the knowledge graph, the fault probability, type prediction, and cause location are output.

2. The method according to claim 1, characterized in that Step 1 includes: Step 11, data acquisition, the terminal device collects data through the DCS switch gateway system and stores the collected data in categories; the data includes network traffic, device status log, alarm information and historical fault records; Among them, the terminal device uses DPI technology to obtain network traffic data and stores it by timestamp. The network traffic data includes IP packets, protocol types, traffic size, and communication delay; The terminal device uses SNMP or a dedicated API interface to regularly collect device status data, including CPU usage, memory usage, and network interface status; The terminal device is equipped with a log collector to obtain log data at regular intervals, and archive and analyze the log data through the log management system. The log data includes system logs, application logs, and device logs. The terminal device extracts historical fault data from the fault record library and generates a structured data table. The historical fault data includes the fault occurrence time, type, impact range, and fault recovery time. Step 12: Data cleaning: The terminal device uses a data cleaning tool to remove abnormal spikes in network traffic by setting thresholds and smoothing the delay data using a sliding window method. Step 13, feature extraction, the terminal device uses a feature extraction tool to extract key features of the cleaned data.

3. The method according to claim 2, characterized in that Step 13 includes: Step 131, the terminal device determines the high-dimensional features of the cleaned data, the high-dimensional features including the rate of change of the traffic pattern, the time interval between statistical packets, and the response delay of the analysis device; Step 132: The terminal device uses PCA or LDA to reduce the dimension of the high-dimensional features and retain the most representative feature set; In step 133, the terminal device uses pre-stored fault records to label the data. To address the problem of scarce fault samples, SMOTE is also used for data enhancement to balance the data set.

4. The method according to claim 1, characterized in that: Step 232 includes: Step 2321, input the triple form data into the Complex embedding model; each triple consists of a head entity h, a relation r, and a tail entity t, describing a fact in the knowledge graph; In the complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk respectively. The complex representation of the head entity h includes the real part and the imaginary part, which are represented as Re(H) and Im(H) respectively. The relation r is also mapped to a complex representation. Step 2322, the Complex model projects Hk and Tk into the complex space, and by calculating the vector dot product of the head entity and the tail entity in the complex space, the Complex model determines the internal relationship of the triple (h, r, t); Step 2323, the output of the Complex model is an embedding vector matrix as a feature generated by the knowledge graph, where each row corresponds to an embedded representation of an entity or relationship.

5. The method according to claim 1, characterized in that Step 3 also includes: Step 31, model selection and design; Step 311, select the model architecture. Based on the time series data characteristics of the DCS network, select the LSTM or GRU model, and design a multi-layer network structure to improve the time series prediction ability of the model; for complex multimodal data, consider using the Transformer model to enhance the global feature capture capability; Step 312: Input feature settings, combining the features extracted by the data preprocessing module with the knowledge graph reasoning results as the input of the model; the input features include network traffic features, device status features, log features, and reasoning features generated by the knowledge graph; Step 313, output setting, the output of the model includes fault probability, fault type prediction, fault cause location, and the Softmax function is used to predict multiple categories of fault types, and a detailed fault analysis is provided in combination with the explanatory output of the knowledge graph; Step 32, model training; Step 321, training data preparation, using the labeled data set generated by the data preprocessing module to divide into a training set, a validation set and a test set; Step 322, hyperparameter tuning, determining the optimal hyperparameter configuration of the model through grid search or Bayesian optimization; Step 323, training process, using a distributed training framework (such as TensorFlow or PyTorch) to train the model in a GPU acceleration environment; regularly evaluating the model performance on the validation set, and preventing overfitting through EarlyStopping; Step 33, model verification and testing; Step 331, verification and testing, using confusion matrix, ROC curve, AUC, F1-score indicators to evaluate model performance; Step 332, model improvement, retraining and optimizing the model for the fault types that performed poorly during the verification process; using transfer learning technology, continuously updating the model to adapt to new data features.

6. The method according to claim 1, characterized in that The method further comprises step 4, system integration and deployment, comprising: Step 41, real-time fault detection system, builds a data stream processing pipeline, inputs real-time network traffic and device status data into the trained model, and when an anomaly is detected, the system automatically triggers an alarm and notifies relevant personnel; Step 42: The knowledge graph and the model work together to conduct an in-depth analysis of the detected faults in combination with the knowledge graph, and provide explanations of the causes of the faults and treatment suggestions; at the same time, the model and knowledge graph are continuously updated by collecting new data.

7. The method according to claim 1, characterized in that The method further comprises step 5, performance optimization and evaluation, comprising: Step 51, performance optimization, optimizing the model architecture according to the characteristics of the DCS network, such as adding a mechanism that is sensitive to delays or a method for handling data incompleteness, and accelerating the response speed of real-time detection to adapt to the resource limitations of the DCS system; Step 52, system evaluation, simulates different fault scenarios in the DCS network environment through simulation tools to comprehensively evaluate the real-time detection capability of the system; deploys the system in the actual DCS network, collects long-term operation data, and evaluates the stability, detection accuracy and response speed of the system under different load conditions.

8. A DCS network fault detection and intelligent reasoning device, characterized in that: The device comprises: The data collection and preprocessing module is used to collect data from the DCS network and extract the feature set after cleaning and classification; Knowledge graph construction, including: Domain knowledge extraction module, used to extract domain knowledge related to network failures from industrial control system related literature, technical documents and expert knowledge; The knowledge representation module is used to represent knowledge using a standard language and construct a graph of entity nodes and relationship edges; Knowledge graph construction and updating, including: Knowledge acquisition module, used to automatically extract knowledge from unstructured data through text mining and expert systems; The knowledge fusion and reasoning module is used to combine the existing industrial control system fault knowledge base, use the score function of the Complex model to measure the credibility of the triples containing the head entity, relationship, and tail entity in the knowledge graph, map the entities and relationships to the complex space, and then calculate the score of the triples through the dot product of the complex numbers, and automatically generate reasoning rules; The deep learning model training and prediction module is used for fault detection based on deep learning models and uses a multi-layer LSTM or Transformer-based model; the input data includes network traffic, device status, and log data, combined with the features generated by the knowledge graph, to output the probability of fault occurrence, type prediction, and cause location.

9. A DCS network fault detection and intelligent reasoning device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images