Dcs network fault detection and intelligent inference method and device

Abstract

The present disclosure belongs to the technical field of nuclear power and specifically relates to a DCS network fault detection and intelligent inference method and device. The present disclosure combines deep learning models and knowledge graph technology, aiming to improve the accuracy and intelligence level of DCS network fault detection. Specifically, the present disclosure collects traffic data and device state data in the DCS network through DPI technology and SNMP protocol, and extracts features related to faults from log data using natural language processing technology. Subsequently, through a knowledge graph embedding method, the extracted high-dimensional information is compressed into a low-dimensional embedding vector matrix, which is input into a deep learning model for fault detection and prediction.

Description

Technical Field

[0001] This disclosure belongs to the field of nuclear power technology, specifically relating to a DCS network fault detection and intelligent reasoning method and device. Background Technology

[0002] DCS (Distributed Control System) is an important component of industrial control systems and is widely used in various industrial automation processes. Fault detection in DCS networks is a key link in ensuring the safe and stable operation of industrial processes. However, with the expansion of DCS network scale and increasing complexity, traditional fault detection methods are struggling to cope with the challenges of dynamic changes in the network environment and complex fault modes.

[0003] In DCS network fault detection, accurately identifying abnormal network traffic, abnormal device status, and potential threats in logs is a core element in ensuring the safe operation of the system. Traditional methods typically rely on rules and threshold settings, making it difficult to capture complex fault characteristics and patterns. Therefore, the need for intelligent and precise fault detection technologies is becoming increasingly urgent.

[0004] In the field of cybersecurity, knowledge graph embedding methods have gradually become a key technology for improving the efficiency and accuracy of deep learning models. However, traditional embedding methods such as TransE have shown some limitations when dealing with complex entities and relationships. Specifically, although traditional embedding methods are simple and computationally efficient, they can only handle linear relationships. For cybersecurity knowledge graphs involving multiple relationships and complex structures, traditional embedding methods often struggle to capture non-linear associations between entities. This results in less than ideal model performance when handling tasks such as threat detection and fault prediction. Summary of the Invention

[0005] To overcome the problems existing in related technologies, a method and device for DCS network fault detection and intelligent reasoning are provided.

[0006] According to one aspect of the present disclosure, a DCS network fault detection and intelligent reasoning method is provided, the method comprising:

[0007] Step 1, Data Collection and Preprocessing: The terminal device collects data from the DCS network, and after cleaning and classification, extracts the feature set.

[0008] Step 2, knowledge graph construction, including,

[0009] Step 21, domain knowledge extraction: Extract domain knowledge related to network faults from relevant literature, technical documents and expert knowledge of industrial control systems;

[0010] Step 22, Knowledge Representation: Represent knowledge using a standard language and construct a graph of entity nodes and relation edges;

[0011] Step 23, Knowledge Graph Construction and Update, including,

[0012] Step 231, Knowledge Acquisition: Automatically extract knowledge from unstructured data through text mining and expert systems;

[0013] Step 232, Knowledge Fusion and Reasoning: Combining the existing industrial control system fault knowledge base, the scoring function of the Complex model is used to measure the credibility of triples containing head entities, relations, and tail entities in the knowledge graph. Entities and relations are mapped to complex space, and then the score of triples is calculated by the dot product of complex numbers, and reasoning rules are automatically generated.

[0014] Step 3: Deep learning model training and prediction. Fault detection is performed based on a deep learning model, using a multi-layer LSTM or a Transformer-based model. Input data includes network traffic, device status, and log data. Combined with features generated from a knowledge graph, the output includes the probability of fault occurrence, type prediction, and cause localization.

[0015] In one possible implementation, step 1 includes:

[0016] Step 11, Data Acquisition: The terminal device collects data through the DCS switch gateway system and categorizes and stores the collected data; the data includes network traffic, device status logs, alarm information, and historical fault records.

[0017] The terminal device uses DPI technology to acquire network traffic data and stores it by timestamp. The network traffic data includes IP packets, protocol type, traffic size, and communication latency.

[0018] Terminal devices use SNMP or a dedicated API interface to periodically collect device status data, which includes CPU utilization, memory usage, and network interface status.

[0019] The terminal device is equipped with a log collector to periodically acquire log data and archive and analyze it through the log management system. The log data includes system logs, application logs and device logs.

[0020] The terminal device extracts historical fault data from the fault record database and generates a structured data table. The historical fault data includes the fault occurrence time, type, scope of impact, and fault recovery time.

[0021] Step 12, data cleaning: The terminal device uses a data cleaning tool to remove abnormal spikes in network traffic by setting thresholds and uses a sliding window method to smooth latency data.

[0022] Step 13, Feature Extraction: The terminal device uses a feature extraction tool to extract the key features of the cleaned data.

[0023] In one possible implementation, step 13 includes:

[0024] Step 131: The terminal device determines the high-dimensional features of the cleaned data. The high-dimensional features include the rate of change of the flow pattern, the time interval between statistical packets, and the response delay of the analysis device.

[0025] Step 132: The terminal device uses PCA or LDA to reduce the dimensionality of the high-dimensional features and retain the most representative feature set.

[0026] Step 133: The terminal device uses pre-stored fault records to label the data. In order to address the problem of scarce fault samples, SMOTE is also used for data augmentation to balance the dataset.

[0027] In one possible implementation, step 232 includes:

[0028] Step 2321: Input the triplet data into the Complex embedding model; each triplet consists of a head entity h, a relation r, and a tail entity t, describing a fact in the knowledge graph;

[0029] In the complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk, respectively. The complex representation of the head entity h includes a real part and an imaginary part, which are represented as Re(H) and Im(H), respectively. The relation r is also mapped to a complex representation.

[0030] Step 2322: The Complex model projects Hk and Tk into the complex space, and determines the intrinsic relationship of the triple (h,r,t) by calculating the vector dot product of the head entity and the tail entity in the complex space.

[0031] Step 2323: The output of the Complex model is an embedding vector matrix as a feature for generating the knowledge graph, where each row corresponds to the embedding representation of an entity or relation.

[0032] In one possible implementation, step 3 further includes:

[0033] Step 31, Model Selection and Design;

[0034] Step 311: Select the model architecture. Based on the characteristics of the time series data of the DCS network, select the LSTM or GRU model and design a multi-layer network structure to improve the model's time series prediction capability. For complex multimodal data, consider using the Transformer model to enhance the global feature capture capability.

[0035] Step 312, Input Feature Settings: Combine the features extracted by the data preprocessing module with the knowledge graph reasoning results as input to the model; input features include network traffic features, device status features, log features, and reasoning features generated by the knowledge graph.

[0036] Step 313, Output Settings: The model output includes fault occurrence probability, fault type prediction, and fault cause localization. The Softmax function is used to predict multiple types of faults, and the interpretive output of the knowledge graph is combined to provide detailed fault analysis.

[0037] Step 32, Model Training;

[0038] Step 321, Training data preparation: Using the labeled dataset generated by the data preprocessing module, divide it into training set, validation set and test set;

[0039] Step 322: Hyperparameter tuning. Determine the optimal hyperparameter configuration of the model through grid search or Bayesian optimization.

[0040] Step 323, Training Process: Use a distributed training framework (such as TensorFlow or PyTorch) to train the model in a GPU-accelerated environment; periodically evaluate the model performance on the validation set and prevent overfitting through EarlyStopping;

[0041] Step 33, Model Validation and Testing;

[0042] Step 331, Validation and Testing: Evaluate model performance using confusion matrix, ROC curve, AUC, and F1-score metrics;

[0043] Step 332, Model Improvement: For fault types that performed poorly during the verification process, the model is retrained and optimized; transfer learning techniques are used to continuously update the model to adapt to new data features.

[0044] In one possible implementation, the method further includes step 4, system integration and deployment, including:

[0045] Step 41: Real-time fault detection system. Construct a data stream processing pipeline, input real-time network traffic and device status data into the trained model. When an anomaly is detected, the system automatically triggers an alarm and notifies relevant personnel.

[0046] Step 42: The knowledge graph and the model work together to conduct in-depth analysis of the detected faults, providing explanations of the causes of the faults and suggestions for handling them; at the same time, the model and the knowledge graph are continuously updated by collecting new data.

[0047] In one possible implementation, the method further includes step 5, performance optimization and evaluation, including:

[0048] Step 51, performance optimization: optimize the model architecture according to the characteristics of the DCS network, such as adding latency-sensitive mechanisms or methods to handle data incompleteness, and accelerate the response speed of real-time detection to adapt to the resource constraints of the DCS system.

[0049] Step 52, System Evaluation: Simulate different fault scenarios in the DCS network environment using simulation tools to comprehensively evaluate the system's real-time detection capabilities; Deploy the system in an actual DCS network, collect long-term operating data, and evaluate the system's stability, detection accuracy, and response speed under different load conditions.

[0050] According to another aspect of the present disclosure, a DCS network fault detection and intelligent inference device is provided, the device comprising:

[0051] The data collection and preprocessing module is used to collect data from the DCS network, and extract the feature set after cleaning and classification.

[0052] Knowledge graph construction, including,

[0053] The domain knowledge extraction module is used to extract domain knowledge related to network faults from relevant literature, technical documents and expert knowledge of industrial control systems.

[0054] The knowledge representation module is used to represent knowledge using a standard language and construct a graph of entity nodes and relation edges.

[0055] Knowledge graph construction and updating, including,

[0056] The knowledge acquisition module is used to automatically extract knowledge from unstructured data through text mining and expert systems;

[0057] The knowledge fusion and reasoning module is used to combine the existing industrial control system fault knowledge base, use the scoring function of the Complex model to measure the credibility of triples containing head entities, relations and tail entities in the knowledge graph, map entities and relations to complex space, and then calculate the score of triples by the dot product of complex numbers, and automatically generate reasoning rules.

[0058] The deep learning model training and prediction module is used for fault detection based on deep learning models, using multi-layer LSTM or Transformer-based models. Input data includes network traffic, device status, and log data. Combined with features generated from knowledge graphs, the module outputs the probability of fault occurrence, type prediction, and cause localization.

[0059] According to another aspect of the embodiments of this disclosure, a DCS network fault detection and intelligent inference device is provided, the device comprising,

[0060] processor;

[0061] Memory used to store processor-executable instructions;

[0062] The processor is configured to execute the above-described method.

[0063] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, which, when executed by a processor, implement the above-described method.

[0064] The beneficial effect of this disclosure lies in its combination of deep learning models and knowledge graph technology, aiming to improve the accuracy and intelligence of DCS network fault detection. Specifically, this disclosure collects traffic data and device status data in the DCS network through DPI technology and SNMP protocol, and extracts fault-related features from log data using natural language processing technology. Subsequently, the extracted high-dimensional information is compressed into a low-dimensional embedding vector matrix using a knowledge graph embedding method, which is then input into a deep learning model for fault detection and prediction. This disclosure employs a Complex embedding model. The Complex model maps entities and relations to a complex space and uses the dot product operation of complex vectors to model the relationships between entities, enabling it to better capture complex nonlinear relationships. Through the dot product operation in complex space, it accurately models the complex associations between entities and relations. The Complex model not only overcomes the limitations of traditional embedding methods but also significantly improves the accuracy and efficiency of deep learning models in DCS network fault detection, achieving more intelligent and reliable fault detection and analysis. Attached Figure Description

[0065] Figure 1 This is a diagram illustrating a DCS network fault detection and intelligent reasoning method according to an exemplary embodiment.

[0066] Figure 2 This is a diagram illustrating a DCS network fault detection and intelligent inference device according to an exemplary embodiment. Detailed Implementation

[0067] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0068] Figure 1This diagram illustrates a DCS network fault detection and intelligent reasoning method according to an exemplary embodiment. The method can be executed by a terminal device, which may be, for example, a central server or a server cluster. This disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes,

[0069] Step 1, Data Collection and Preprocessing: The terminal device collects data from the DCS network, and after cleaning and classification, extracts the feature set.

[0070] As an example of this embodiment, step 1 may include the following steps.

[0071] Step 11, Data Acquisition: The terminal device collects data through the DCS switch gateway system and categorizes and stores the collected data. The data includes network traffic, device status logs, alarm information, and historical fault records. The data is aggregated to the terminal device through the switch gateway system, ensuring coverage of all critical nodes in the DCS network.

[0072] For example, terminal devices use DPI (Deep Packet Inspection) technology to acquire network traffic data and store it by timestamp. Network traffic data may include, for example, IP packets, protocol types, traffic size, communication latency, etc.

[0073] Terminal devices use SNMP (Simple Network Management Protocol) or a dedicated API interface to periodically collect device status data, which may include, for example, CPU usage, memory usage, and network interface status.

[0074] The terminal device is equipped with a log collector to periodically acquire log data, which is then archived and analyzed through the log management system. The log data includes system logs, application logs, and device logs.

[0075] The terminal device extracts historical fault data from the fault record database and generates a structured data table. The historical fault data may include, for example, the fault occurrence time, type, scope of impact, and fault recovery time.

[0076] Step 12, data cleaning: The terminal device uses a data cleaning tool to remove abnormal spikes in network traffic by setting thresholds and uses a sliding window method to smooth latency data.

[0077] Step 13, Feature Extraction: The terminal device uses a feature extraction tool to extract the key features of the cleaned data.

[0078] In one possible implementation, step 13 includes,

[0079] Step 131: The terminal device determines the high-dimensional features of the cleaned data. The high-dimensional features include the rate of change of the flow pattern, the time interval between statistical packets, and the response delay of the analysis device.

[0080] Step 132: The terminal device uses PCA (Principal Component Analysis) or LDA (Linear Discriminant Analysis) to reduce the dimensionality of the high-dimensional features and retain the most representative feature set.

[0081] Step 133: The terminal device annotates the data using existing fault records. To address the problem of scarce fault samples, SMOTE (Synthetic Minority Oversampling) can be used for data augmentation to generate more fault samples to balance the dataset.

[0082] Step 2, knowledge graph construction, including,

[0083] Step 21: Domain knowledge extraction. Extract domain knowledge related to network faults from relevant literature, technical documents, and expert knowledge of industrial control systems.

[0084] Step 22, Knowledge Representation: Use standard languages ​​such as RDF or OWL to represent knowledge and construct a graph that includes entity nodes such as "switch", "controller", and "sensor" and relational edges such as "connection relationship" and "fault cause".

[0085] Step 23, Knowledge Graph Construction and Update, including,

[0086] Step 231, Knowledge Acquisition: Automatically extract knowledge from unstructured data through text mining and expert systems;

[0087] Step 232, Knowledge Fusion and Reasoning: Combining the existing industrial control system fault knowledge base, new knowledge is fused using logical reasoning and machine learning methods, and reasoning rules are automatically generated.

[0088] For example, in step 232, after constructing the knowledge graph, a graph embedding algorithm model is typically used to achieve effective representation of entities and relationships. This compresses high-dimensional information (such as complex relationships between entities and the diversity of threat patterns) into a low-dimensional embedding matrix. However, due to the complexity of entities in the cybersecurity field, many threat description reports exhibit diverse writing styles, and a significant amount of noise is introduced during the text conversion process, making traditional Trans embedding models inadequate.

[0089] Therefore, this disclosure employs the Complex embedding model approach. By mapping entities and relations to a complex space, the Complex model can more effectively capture and represent the interactions between complex entities and relations. This approach not only improves the accuracy of embedding but also better addresses the interference of noisy data in the cybersecurity field, ultimately achieving efficient fusion and reasoning of knowledge graphs.

[0090] The scoring function of the Complex model measures the credibility of a triple (head entity, relation, tail entity) in a knowledge graph. Entities and relations are mapped to complex space, and the score of the triple is calculated using the dot product of complex numbers. The specific scoring function can be expressed as follows:

[0091] Where h is the head entity, r is the relation, t is the tail entity, and (h,r,t) is a complex embedding triple vector. It is the complex conjugate of the tail entity embedding vector. Re represents the dot product of complex vectors, the result of which is a complex number, and Re(.) represents the real part of the complex number.

[0092] Step 2321 involves inputting triplet data containing entities and relations into the Complex embedding model. Each triple consists of a head entity, a relation, and a tail entity, describing a fact in the knowledge graph. The Complex model achieves embedding representation by mapping these entities and relations from the real space to the complex space.

[0093] In complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk, respectively. The complex representation of the head entity h includes a real part and an imaginary part, denoted as Re(H) and Im(H), respectively, and the relation R is also mapped to a complex representation. By computing the vector dot product of the head and tail entities in complex space, the Complex model can capture the intrinsic relation of the triple (H,R,T). This dot product operation is used to measure the degree of matching between the head and tail entities given the relation R.

[0094] In step 2322, the Complex model projects Hk and Tk into the complex space and effectively models the relationships between triples through a dot product operation. These resulting complex embedding vectors are then fused with knowledge from the existing cybersecurity knowledge base. The newly extracted knowledge is merged with existing knowledge by calculating similarity or using other fusion techniques to generate new inference rules and update the knowledge graph. In this way, the knowledge graph not only covers updated entity relationships but also includes new inference rules, thereby improving the graph's coverage and accuracy.

[0095] Step 2323: The output of the Complex model is an embedding vector matrix, where each row corresponds to an embedding representation of an entity or relation. This embedding matrix contains both the fused new knowledge and existing knowledge. This disclosure feeds this embedding matrix into a suitable deep learning model architecture (such as LSTM) for supervised training to significantly improve the model's accuracy in network security fault detection. In this way, the fused knowledge graph not only enhances the ability to identify complex threats but also provides more comprehensive and accurate protective measures for network security.

[0096] Step 3: Deep learning model training and prediction. Fault detection is performed based on deep learning models (such as RNN, LSTM, GRU, etc.), and multi-layer LSTM or Transformer-based models are considered. Input data includes network traffic, device status, and log data. Combined with features generated from the knowledge graph, the output includes fault occurrence probability, type prediction, and cause localization.

[0097] As an example of this embodiment, step 3 also includes the following steps:

[0098] Step 31, Model Selection and Design.

[0099] Step 311: Select the model architecture. Based on the characteristics of the time-series data of the DCS network, choose either the LSTM or GRU model, and design a multi-layer network structure to improve the model's time-series prediction capability. For complex multimodal data, consider using the Transformer model to enhance global feature capture capabilities.

[0100] Step 312, Input Feature Setting: Combine the features extracted by the data preprocessing module with the knowledge graph inference results as input to the model. Input features include network traffic features, device status features, log features, and inference features generated from the knowledge graph.

[0101] Step 313, Output Settings: The model output includes fault occurrence probability, fault type prediction, fault cause localization, etc. The Softmax function is used to predict multiple types of faults, and the interpretive output of the knowledge graph is combined to provide detailed fault analysis.

[0102] Step 32, Model Training.

[0103] Step 321: Training data preparation. Using the labeled dataset generated by the data preprocessing module, divide the dataset into training, validation, and test sets to ensure the model's generalization ability.

[0104] Step 322: Hyperparameter tuning. Through grid search or Bayesian optimization, determine the optimal hyperparameter configuration of the model (such as learning rate, number of LSTM layers, number of hidden units, etc.) to ensure the training convergence and prediction performance of the model.

[0105] Step 323, the training process, uses a distributed training framework (such as TensorFlow or PyTorch) to train the model in a GPU-accelerated environment. The model performance is periodically evaluated on the validation set, and overfitting is prevented through EarlyStopping.

[0106] Step 33, Model Validation and Testing.

[0107] Step 331, Validation and Testing: Use metrics such as confusion matrix, ROC curve, AUC, and F1-score to evaluate model performance, paying particular attention to the recall rate of fault detection to ensure high sensitivity of the model to faults.

[0108] Step 332, Model Improvement: For fault types that performed poorly during the validation process, the model is retrained and optimized. Transfer learning techniques are used to continuously update the model to adapt to new data features.

[0109] Step 4, System Integration and Deployment, including,

[0110] Step 41: Real-time fault detection system. Construct a data stream processing pipeline, input real-time network traffic and device status data into the trained model. When an anomaly is detected, the system automatically triggers an alarm and notifies relevant personnel.

[0111] For example, the data stream pipeline is built using Apache Kafka as a real-time data transmission channel to transmit network traffic and device status data to the model in real time. Apache Flink or Apache Spark Streaming is used to process the data stream, ensuring that the data undergoes necessary cleaning and preprocessing before entering the model.

[0112] Model deployment involves deploying the trained deep learning model on the core server of the DCS system, using Docker containerization technology to achieve rapid deployment and expansion of the model.

[0113] The real-time alarm system defines alarm rules based on the model's prediction results. When the model predicts that the probability of a fault occurrence exceeds a set threshold, the system immediately triggers an alarm and notifies relevant personnel via the SCADA system interface, SMS, or email.

[0114] Step 42: The knowledge graph and model work together to perform in-depth analysis of the detected faults, providing explanations for the causes of the faults and suggestions for handling them. Simultaneously, the model and knowledge graph are continuously updated by collecting new data to continuously improve detection accuracy.

[0115] For example, a fault cause analysis system, during the fault detection process, combines the reasoning results of a knowledge graph to provide explanations and suggestions for the causes of the fault. The system automatically generates a fault analysis report, which includes possible root causes, propagation paths, and suggested remedial measures.

[0116] Self-learning and model updating: During system operation, new network data and fault information are continuously collected, and the input features of the model are continuously updated through the knowledge graph to achieve adaptive learning and dynamic updating of the model.

[0117] Step 5, performance optimization and evaluation, including,

[0118] Step 51, performance optimization: optimize the model architecture for the characteristics of the DCS network, such as adding latency-sensitive mechanisms or methods to handle data incompleteness, and accelerating the response speed of real-time detection to adapt to the resource constraints of the DCS system.

[0119] Step 52, System Evaluation: Simulate different fault scenarios in a DCS network environment using simulation tools to comprehensively evaluate the system's real-time detection capabilities. Deploy the system in an actual DCS network, collect long-term operational data, and evaluate the system's stability, detection accuracy, and response speed under different load conditions.

[0120] The method disclosed herein not only improves the accuracy of embedding representations but also enhances the performance of deep learning models in fault detection and security assessment within complex network environments. By combining complex models, this disclosure achieves significant improvements in the accuracy and interpretability of fault detection in DCS networks, addressing the shortcomings of traditional embedding methods. By integrating knowledge graphs with deep learning models, it not only improves the accuracy of fault detection but also supports the explanation and reasoning of fault causes, thereby enhancing the overall security and reliability of DCS networks.

[0121] Figure 2 This is a diagram illustrating a DCS network fault detection and intelligent inference device according to an exemplary embodiment. For example, device 1900 may be provided as a server. (Refer to...) Figure 2 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0122] Device 1900 may also include a power supply component 1926 configured to perform power management of device 1900, a wired or wireless network interface 1950 configured to connect device 1900 to a network, and an input / output (I / O) interface 1958. Device 1900 can operate on an operating system stored in memory 1932, such as Windows Server™, MacOSX™, Unix™, Linux™, FreeBSD™, or similar.

[0123] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of the device 1900 to perform the above-described method.

[0124] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0125] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0126] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0127] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0128] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0129] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0130] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0131] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0132] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A DCS network fault detection and intelligent reasoning method, characterized in that, The method includes: Step 1, Data Collection and Preprocessing: The terminal device collects data from the DCS network, and after cleaning and classification, extracts the feature set. Step 2, knowledge graph construction, including, Step 21, domain knowledge extraction: Extract domain knowledge related to network faults from relevant literature, technical documents and expert knowledge of industrial control systems; Step 22, Knowledge Representation: Represent knowledge using a standard language and construct a graph of entity nodes and relation edges; Step 23, Knowledge Graph Construction and Update, including, Step 231, Knowledge Acquisition: Automatically extract knowledge from unstructured data through text mining and expert systems; Step 232, Knowledge Fusion and Reasoning: Combining the existing industrial control system fault knowledge base, the scoring function of the Complex model is used to measure the credibility of triples containing head entities, relations, and tail entities in the knowledge graph. Entities and relations are mapped to complex space, and then the score of triples is calculated by the dot product of complex numbers, and reasoning rules are automatically generated. Step 3, Deep learning model training and prediction: Fault detection is performed based on a deep learning model, using a multi-layer LSTM or a Transformer-based model; input data includes network traffic, device status, and log data, combined with features generated from a knowledge graph, outputting the probability of fault occurrence, type prediction, and cause localization; Step 232 includes: Step 2321: Input the triplet data into the Complex embedding model; each triplet consists of a head entity h, a relation r, and a tail entity t, describing a fact in the knowledge graph; In the complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk, respectively. The complex representation of the head entity h includes a real part and an imaginary part, which are represented as Re(H) and Im(H), respectively. The relation r is also mapped to a complex representation. Step 2322: The Complex model projects Hk and Tk into the complex space, and determines the intrinsic relationship of the triple (h,r,t) by calculating the vector dot product of the head entity and the tail entity in the complex space. Step 2323: The output of the Complex model is an embedding vector matrix as a feature for generating the knowledge graph, where each row corresponds to the embedding representation of an entity or relation.

2. The method according to claim 1, characterized in that, Step 1 includes: Step 11, Data Acquisition: The terminal device collects data through the DCS switch gateway system and categorizes and stores the collected data; the data includes network traffic, device status logs, alarm information, and historical fault records. The terminal device uses DPI technology to acquire network traffic data and stores it by timestamp. The network traffic data includes IP packets, protocol type, traffic size, and communication latency. Terminal devices use SNMP or a dedicated API interface to periodically collect device status data, which includes CPU utilization, memory usage, and network interface status. The terminal device is equipped with a log collector to periodically acquire log data and archive and analyze it through the log management system. The log data includes system logs, application logs and device logs. The terminal device extracts historical fault data from the fault record database and generates a structured data table. The historical fault data includes the fault occurrence time, type, scope of impact, and fault recovery time. Step 12, data cleaning: The terminal device uses a data cleaning tool to remove abnormal spikes in network traffic by setting thresholds and uses a sliding window method to smooth latency data. Step 13, Feature Extraction: The terminal device uses a feature extraction tool to extract the key features of the cleaned data.

3. The method according to claim 2, characterized in that, Step 13 includes: Step 131: The terminal device determines the high-dimensional features of the cleaned data. The high-dimensional features include the rate of change of the flow pattern, the time interval between statistical packets, and the response delay of the analysis device. Step 132: The terminal device uses PCA or LDA to reduce the dimensionality of the high-dimensional features and retain the most representative feature set. Step 133: The terminal device uses pre-stored fault records to label the data. In order to address the problem of scarce fault samples, SMOTE is also used for data augmentation to balance the dataset.

4. The method according to claim 1, characterized in that, Step 3 also includes: Step 31, Model Selection and Design; Step 311: Select the model architecture. Based on the characteristics of the time series data of the DCS network, select the LSTM or GRU model and design a multi-layer network structure to improve the model's time series prediction capability. For complex multimodal data, consider using the Transformer model to enhance the global feature capture capability. Step 312, Input Feature Settings: Combine the features extracted by the data preprocessing module with the knowledge graph reasoning results as input to the model; input features include network traffic features, device status features, log features, and reasoning features generated by the knowledge graph. Step 313, Output Settings: The model output includes fault occurrence probability, fault type prediction, and fault cause localization. The Softmax function is used to predict multiple types of faults, and the interpretive output of the knowledge graph is combined to provide detailed fault analysis. Step 32, Model Training; Step 321, Training data preparation: Using the labeled dataset generated by the data preprocessing module, divide it into training set, validation set and test set; Step 322: Hyperparameter tuning. Determine the optimal hyperparameter configuration of the model through grid search or Bayesian optimization. Step 323, Training Process: The model is trained in a GPU-accelerated environment using the distributed training framework TensorFlow; the model performance is evaluated periodically on the validation set, and overfitting is prevented through EarlyStopping. Step 33, Model Validation and Testing; Step 331, Validation and Testing: Evaluate model performance using confusion matrix, ROC curve, AUC, and F1-score metrics; Step 332, Model Improvement: For fault types that performed poorly during the verification process, the model is retrained and optimized; transfer learning techniques are used to continuously update the model to adapt to new data features.

5. The method according to claim 1, characterized in that, The method further includes step 4, system integration and deployment, including: Step 41: Real-time fault detection system. Construct a data stream processing pipeline, input real-time network traffic and device status data into the trained model. When an anomaly is detected, the system automatically triggers an alarm and notifies relevant personnel. Step 42: The knowledge graph and the model work together to conduct in-depth analysis of the detected faults, providing explanations of the causes of the faults and suggestions for handling them; at the same time, the model and the knowledge graph are continuously updated by collecting new data.

6. The method according to claim 1, characterized in that, The method further includes step 5, performance optimization and evaluation, including: Step 51, performance optimization: optimize the model architecture according to the characteristics of the DCS network, such as adding latency-sensitive mechanisms or methods to handle data incompleteness, and accelerate the response speed of real-time detection to adapt to the resource constraints of the DCS system. Step 52, System Evaluation: Simulate different fault scenarios in the DCS network environment using simulation tools to comprehensively evaluate the system's real-time detection capabilities; Deploy the system in an actual DCS network, collect long-term operating data, and evaluate the system's stability, detection accuracy, and response speed under different load conditions.

7. A DCS network fault detection and intelligent inference device, characterized in that, The device includes: The data collection and preprocessing module is used to collect data from the DCS network, and extract the feature set after cleaning and classification. Knowledge graph construction, including, The domain knowledge extraction module is used to extract domain knowledge related to network faults from relevant literature, technical documents and expert knowledge of industrial control systems. The knowledge representation module is used to represent knowledge using a standard language and construct a graph of entity nodes and relation edges. Knowledge graph construction and updating, including, The knowledge acquisition module is used to automatically extract knowledge from unstructured data through text mining and expert systems; The knowledge fusion and reasoning module is used to combine the existing industrial control system fault knowledge base, use the scoring function of the Complex model to measure the credibility of triples containing head entities, relations and tail entities in the knowledge graph, map entities and relations to complex space, and then calculate the score of triples by the dot product of complex numbers, and automatically generate reasoning rules. The deep learning model training and prediction module is used for fault detection based on deep learning models, using multi-layer LSTM or Transformer-based models. Input data includes network traffic, device status, and log data. Combined with features generated from knowledge graphs, the module outputs the probability of fault occurrence, type prediction, and cause localization. The knowledge fusion and reasoning module includes: The input module inputs triple-form data into the Complex embedding model; each triple consists of a head entity h, a relation r, and a tail entity t, describing a fact in the knowledge graph; In the complex space, the head entity h and the tail entity t are represented as complex vectors Hk and Tk, respectively. The complex representation of the head entity h includes a real part and an imaginary part, which are represented as Re(H) and Im(H), respectively. The relation r is also mapped to a complex representation. The processing module is used to project Hk and Tk into the complex space using the Complex model, and to determine the intrinsic relationship of the triple (h,r,t) by calculating the vector dot product of the head entity and the tail entity in the complex space. The output module is used to take the output of the Complex model as an embedding vector matrix as the feature of the knowledge graph generation, where each row corresponds to the embedding representation of an entity or relation.

8. A DCS network fault detection and intelligent inference device, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the method according to any one of claims 1 to 6.

9. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images