Modbus device signal fingerprint extraction and self-updating method based on transient time-domain waveform multi-modal fusion
By using transient time-domain waveform multimodal fusion and self-updating mechanism, the problem of accurate identification caused by Modbus device aging and failure is solved, and efficient, accurate identification and long-term adaptability of device identity are achieved.
Patent Information
- Application Number
- CN202510318642.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-18
- Publication Date
- 2025-11-04
- Estimated Expiration
- 2045-03-18
AI Technical Summary
Existing technologies struggle to accurately identify Modbus devices when they are aging or malfunctioning. Traditional methods rely on steady-state characteristics while ignoring transient signals, resulting in insufficient accuracy and robustness in identification.
A method based on transient time-domain waveform multimodal fusion is adopted. Through signal acquisition, multimodal preprocessing, improved sparse representation (SRC) model and deep learning model, a unique fingerprint code of the device is generated. Combined with a self-updating mechanism, the model is adjusted in real time to adapt to changes in device state.
It improves the accuracy and long-term effectiveness of device identification, can adapt to changes in signal characteristics caused by device aging and failure, and enhances the robustness and security of the system.
Smart Images
Figure CN120257088B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of industrial automation, and in particular to a Modbus device signal fingerprint extraction and self-updating method based on transient time-domain waveform multi-modal fusion. BACKGROUND
[0002] In industrial automation systems, Modbus is a widely used communication protocol in the field of industrial automation, which supports data exchange between devices and improves the efficiency and reliability of industrial automation systems. However, as devices age and fail, the characteristics of Modbus communication signals may change, causing traditional identity recognition methods to fail. Specifically, as devices age, hardware performance may decline, affecting signal transmission quality and stability; the occurrence of faults may introduce noise or signal distortion, making it difficult to accurately identify the signal characteristics.
[0003] Currently, although some methods attempt to identify device identity through signal processing techniques, these methods often fail to effectively address signal characteristic changes caused by device aging and failure. Meanwhile, existing identity recognition methods typically rely on steady-state signal characteristics and ignore transient signal characteristics at device startup, which limits their accuracy and robustness to some extent. SUMMARY
[0004] The present application aims to provide a Modbus device signal fingerprint extraction and self-updating method based on transient time-domain waveform multi-modal fusion to accurately extract device physical fingerprints and address signal characteristic changes caused by device aging and failure, thereby improving the accuracy and long-term effectiveness of device identity recognition.
[0005] TECHNICAL SOLUTION In order to achieve the above-mentioned application purpose, the present application adopts the following technical solutions:
[0006] In a first aspect, the present application provides a Modbus device signal fingerprint extraction method based on transient time-domain waveform multi-modal fusion, comprising the following steps:
[0007] Step 1: Collect the signal at the start of the Modbus device to obtain a signal sequence;
[0008] Step 2: Use transient time-domain waveform characteristics, spectral characteristics, and signal features at different scales to pre-process the signal sequence in multiple modalities to obtain a signal comprehensive feature vector, including transient characteristic statistics and morphological parameters that describe the signal, actual frequency components calculated by frequency domain analysis, and the average of standard deviations at all scales calculated by wavelet domain decomposition;
[0009] Step 3: By introducing an improved sparse representation (SRC) model with non-negative constraints, find a sparse coefficient vector such that the product of the dictionary matrix and the coefficient vector is closest to the comprehensive feature vector of the test sample.
[0010] Step 4: Input the sparse coefficient vector as a feature into the deep learning model for training to generate a unique fingerprint code for the device. The fingerprint code is a probability distribution that represents the probability that the test sample belongs to each category.
[0011] Preferably, in step 2, the signal synthesis feature vector includes peak amplitude, rise time, overshoot, ringing, main frequency components, and the average of the standard deviations of wavelet transform coefficients at all scales.
[0012] Preferably, in step 3, the calculation formula for the improved SRC model is as follows:
[0013]
[0014] Where D is the dictionary matrix, y is the comprehensive feature vector of the training samples, x is the sparse coefficient vector, and ∥x∥1 is the L1 norm, used to promote sparsity. λ is the reconstruction error, used to measure the difference between Dx and y, and λ is the regularization parameter, used to balance sparsity and reconstruction error.
[0015] Preferably, the dictionary matrix D = [F1, F2, ..., F N ], N represents a class of devices, F i F is the comprehensive feature vector F of the initial training samples of the i-th type of device. i Each F i It is a 1×d vector, where d is the dimension of the feature vector.
[0016] Preferably, in step 4, the deep learning model adopts a 1D CNN model, including an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer; wherein: the input layer inputs a sparse coefficient vector; the convolutional layer is used to extract local features; the pooling layer is used to reduce the feature dimension; the fully connected layer is used to map the features to the final fingerprint code; and the output layer is used to generate a fixed-length fingerprint code.
[0017] Secondly, the present invention provides a Modbus device signal fingerprint self-updating method based on transient time-domain waveform multimodal fusion, comprising the following steps:
[0018] The device fingerprint code is obtained using the Modbus device signal fingerprint extraction method based on transient time-domain waveform multimodal fusion. The obtained fingerprint code C is then detected. new Query the database to find the stored fingerprint C of the corresponding device dbCollecting corresponding new signal data when there is a change;
[0019] Multimodal preprocessing of newly collected data to obtain signal comprehensive feature vectors;
[0020] Using an improved SRC model to generate new sparse coefficient vectors;
[0021] Adding new sparse coefficient vectors and corresponding category labels to the training set;
[0022] Fine-tuning the model, only adjusting the weights of the last fully connected layer, and keeping the parameters of the previous layers unchanged.
[0023] Further, the self-updating method further comprises: calculating the Euclidean distance between the fingerprint code C new and the stored fingerprint code C db , setting a threshold and making a judgment, triggering an alarm mechanism when the difference between the current fingerprint code and the historical record exceeds a certain range; the abnormal fingerprint code triggering the alarm does not participate in the model update training.
[0024] In a third aspect, the present application provides a computer system, comprising a memory, a processor and a computer program / instruction stored on the memory and executable on the processor, which realizes the steps of the above method when executed by the processor.
[0025] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, which realizes the steps of the above method when executed by the processor.
[0026] In a fifth aspect, the present application provides a computer program product, comprising a computer program / instruction, which realizes the steps of the above method when executed by the processor.
[0027] Beneficial effects: In the Modbus device signal fingerprint extraction process of the present application, the transient time domain waveform characteristics, spectral characteristics and signal features under different scales are fully utilized, the optimized SRC model is used for the fusion of these features, the extracted multimodal features are input into the deep learning model, the unique fingerprint code of the device is generated, the generated fingerprint code is compared with the pre-stored fingerprint database, and the identity recognition of the device is realized. The improved SRC model is used in the present application to improve the sparsity in the feature selection process by combining L1 norm minimization and non-negative constraint conditions, so that the key features can be highlighted more accurately, and the optimized SRC model multimodal fusion technology comprehensively utilizes various signal features, which can improve the accuracy and robustness of fingerprint extraction. In addition, the self-updating mechanism of the present application adopts an online learning mode to keep the fingerprint library updated in real time, and enhances the long-term applicability and security of the system. BRIEF DESCRIPTION OF DRAWINGS
[0028] Figure 1 Fig. 1 is a schematic diagram of a fingerprint extraction process according to an embodiment of the present application.
[0029] Figure 2 Fig. 2 is a schematic diagram of a fingerprint self-updating process according to an embodiment of the present application.
[0030] Figure 3 Fig. 3 is a signal waveform diagram of three different Modbus devices according to an example in an embodiment.
[0031] Figure 4 Fig. 4 is a model training and verification accuracy curve diagram according to an embodiment.
[0032] Figure 5 Fig. 5 is a fingerprint code mapping relationship diagram of three different devices according to an example in an embodiment. DETAILED DESCRIPTION
[0033] The technical solutions and effects of the present application will be further described below in combination with the drawings and specific embodiments.
[0034] As shown in Figure 1 Fig. 1, the Modbus device signal fingerprint extraction method based on transient time-domain waveform multi-modal fusion disclosed in the embodiment of the present application mainly includes: signal acquisition, multi-modal preprocessing, feature fusion and extraction, deep learning model training, and fingerprint generation. Each step will be described in detail as follows:
[0035] S1. Signal acquisition: the signal at the start of the Modbus device is collected to obtain a signal sequence.
[0036] Among them, S1. Signal acquisition uses a high-precision data acquisition card, and the collection frequency is set to a sampling rate of at least 20 kHz to ensure that the transient signal with sufficient details is captured. At the moment of starting the Modbus device, the high-precision data acquisition card captures the electrical signal on the communication line. Assuming that we obtain a signal sequence s[n] with a length of 1 second (i.e. 20000 sample points), where n = 0, 1, 2,..., 19999. Based on this data, we perform S2. Multi-modal preprocessing.
[0037] S2. Multi-modal preprocessing: fully utilize the transient time-domain waveform characteristics, frequency spectrum characteristics and signal features under different scales to analyze the collected information in multiple dimensions to more comprehensively obtain the signal characteristics.
[0038] Specifically, the analysis and processing method in this embodiment is as follows:
[0039] I. Time domain analysis: time domain transient waveform feature extraction
[0040] Transient time-domain waveform generally refers to the waveform characteristics of a signal at the start of the transient, in order to extract these characteristics, the following statistical quantities and morphological parameters are used in this embodiment to describe the transient characteristics of the signal:
[0041] Peak amplitude (Peak Amplitude, A peak ): A peak = max n |s[n]|
[0042] Rise time (Rise Time, T r ): That is, the time from 10% to 90% of the peak value, find the sample points n 10 and n 90％ corresponding to 10% and 90% of the peak value, where f s is the sampling frequency.
[0043] Overshoot (Overshoot, O): The percentage difference between the peak value and the final stable value, where the final stable value is A final .
[0044] Ringing (Ringing, R): The oscillation amplitude after the peak value, which can be determined by calculating the first local minimum and maximum after the peak value.
[0045] Example: Suppose we have a simplified signal sequence s[n] as follows (in actual applications there will be more data points): s[0]=0.0, s[1]=0.2, s[2]=0.5, s[3]=0.8, s[4]=1.0, s[5]=0.8, s[6]=0.6, s[7]=0.4, s[8]=0.2, s[9]=0.1.
[0046] Peak amplitude: A peak = max n |s[n]| = 1.0.
[0047] Rise time: 10% peak value is 0.1, corresponding to n 10％ = 0 (assuming the initial value is 0, and taking the nearest value); 90% peak value is 0.9, corresponding to n 90％ = 4 (taking the nearest value), assuming the sampling frequency f s = 20000Hz, then the rise time is calculated as:
[0048]
[0049] Overshoot: Assuming the final stable value A final = 0.1, the overshoot
[0050] Ringing: the first local minimum after the peak is s[5]=0.8, the first local maximum after the peak is s[4]=1.0, then the ringing amplitude is R=1.0-0.8=0.2.
[0051] II. Frequency domain analysis: perform frequency domain conversion to analyze the main frequency components in the frequency domain
[0052] The power spectral density PSD[k] of the spectrum can be obtained by fast Fourier transform (FFT), first convert the time domain signal s[n] to the frequency domain S[k], the specific calculation formula is:
[0053]
[0054] Where k=0,1,…,N-1.
[0055] Then calculate the power spectral density of the spectrum:
[0056] Then get the main frequency component according to the above formula, find the frequency index k corresponding to the maximum value in PSD[k] peak : k peak =argmax k (PSD[k]).
[0057] Convert the index k peak to the actual frequency f peak :
[0058] Where f s is the sampling frequency, and N is the signal length.
[0059] Example: first convert the signal sequence s[n] to the frequency domain S[k] by fast Fourier transform (FFT) (simplified example, omit the calculation process, assuming the results of the first 5 model series conversion): S[0]=10+0j, S[1]=8+6j, S[2]=5+0j, S[3]=3-4j, S[4]=2+0j; Then calculate the corresponding power spectral density PSD[k] as follows:
[0060]
[0061] Find the index corresponding to the maximum power spectral density: k peak =argmax k (PSD[k])=0.
[0062] Assuming the sampling frequency f s =20000Hz, the signal length N=5, then:
[0063]
[0064] Three, wavelet domain decomposition: analysis of the standard deviation of CWT coefficients under different scales
[0065] Continuous wavelet transform (CWT): CWT is performed on the signal s[n], Morlet wavelet is selected as the base function, the scale range is from 1 to 128, the result of CWT is a two-dimensional matrix W(a, b), where a represents the scale, b represents the time shift, A represents the total number of scales, and B represents the total number of time shifts. After obtaining the result W(a, b) of CWT, the following analysis is performed:
[0066] First, for each scale a, the standard deviation σaof the CWT coefficients of all b under this scale is calculated a :
[0067]
[0068] Where μa a is the mean of the CWT coefficients under this scale:
[0069] Then, the average value σ a of the standard deviations σa avg of all scales a is calculated as a feature:
[0070]
[0071] Example: suppose the CWT result W(a, b) is as follows (simplified example):
[0072] Table 1: Example of W(a, b)
[0073] b＝0 b＝1 b＝2 a＝1 0.2 0.1 0.3 a＝2 0.4 0.5 0.6
[0074] For scale a = 1:
[0075]
[0076] For scale a = 2:
[0077]
[0078] Calculate the average value of the standard deviations of all scales:
[0079] S3. Feature fusion and extraction: make full use of the transient time domain waveform characteristics, spectral characteristics and signal characteristics under different scales obtained in S2 multi-modal preprocessing, use these features to obtain the characteristics of a Modbus device and complete the construction of a feature vector, according to the three analysis results of the signal above, a comprehensive feature vector F can be constructed: F = [Apeak ,T r ,O,R,f peak ,σ avg This output can be used in the next step of the multimodal fusion algorithm to more accurately highlight key features.
[0080] For example, based on the previous calculations, we obtain the following characteristic value: peak amplitude A peak =1.0, rise time T r =0.2ms, overshoot O=900%, ringing R=0.2, dominant frequency component f peak =0Hz, CWT coefficient standard deviation σ avg =0.0745, then the comprehensive feature vector F is: F = [1.0, 0.2, 900, 0.2, 0, 0.0745].
[0081] Next, further calculations are performed using the improved SRC model. The improved SRC model combines L1 norm minimization and non-negativity constraints to improve sparsity in the feature selection process and enhance the prominence of key features. The improved SRC model introduces a non-negativity constraint, requiring all elements in the sparse coefficients x to be non-negative. This further enhances the sparsity and robustness of feature selection. The goal of the improved SRC model is to find a sparse coefficient vector x such that Dx is closest to the comprehensive feature vector y of the samples (including training and test samples). The specific calculation formula is as follows:
[0082]
[0083] Where D is the dictionary matrix. y is the composite feature vector of the training samples. x is the sparse coefficient vector. ∥x∥1 is the L1 norm, used to promote sparsity. λ is the reconstruction error, used to measure the difference between Dx and y. λ is the regularization parameter, used to balance sparsity and reconstruction error.
[0084] In performing the above calculations, the dictionary matrix D must first be constructed. In this embodiment, the dictionary matrix D is composed of sparse representations of multiple training samples, which are extracted from the comprehensive feature vector F. Assume we have initial training samples of N types of devices, each sample having a comprehensive feature vector F. u The dictionary matrix D can be represented as:
[0085] D = [F1, F2, ..., F N ]
[0086] Among them, each F i It is a 1×d vector, where d is the dimension of the feature vector.
[0087] For example: suppose we have three types of Modbus devices, and we select the comprehensive feature vectors corresponding to the three types of devices in the training samples, and the comprehensive feature vector F of each sample is i As follows:
[0088] F1 = [1.0, 0.2, 900, 0.2, 0, 0.0745] T
[0089] F2 = [2.0, 0.3, 800, 0.1, 1, 0.0545] T
[0090] F3 = [3.0, 0.4, 700, 0.2, 2, 0.0765] T
[0091] 1. Construct the dictionary matrix D: according to the comprehensive feature vector F obtained in the last step i , the dictionary matrix D is:
[0092]
[0093] 2. Solve the optimization problem: use an optimization algorithm (such as basis pursuit, interior point method, etc.) to solve the above optimization problem for all training samples y, and obtain the sparse system vector set corresponding to the training set
[0094] S4. Deep learning model training and fingerprint generation: train the sparse coefficient vector training set using a 1D CNN model to generate a unique fingerprint code for the device. The specific process is as follows:
[0095] In this embodiment, 1D CNN is used to process feature vectors and generate fingerprint codes, and the CNN architecture includes the following parts:
[0096] Input layer: the input is a sparse coefficient vector
[0097] Convolutional layer: extract local features.
[0098] Pooling layer: reduce feature dimension, retain main information.
[0099] Fully connected layer: map features to final fingerprint code.
[0100] Output layer: generate a fixed-length fingerprint code.
[0101] Build a CNN model through the above architecture, and use the training set (input the sparse coefficient vector of the input layer ) and the corresponding Modbus device label y, through multiple rounds of iterations, constantly adjusting the model parameters to minimize the loss function, after the model training is completed, the model can map each device's sparse coefficient vector to a fixed length fingerprint code C, that is, the physical fingerprint code of each Modbus device can be obtained, which can be used for device identity recognition and verification. In this embodiment, the fingerprint code is a probability distribution, which represents the probability of the test sample belonging to each category, for example, a system containing A, B and C three Modbus devices, its output value (i.e. fingerprint code) C = [0.96, 0.03, 0.01], which means the probability of the test sample belonging to devices A, B and C is 96%, 3% and 1% respectively, that is, it can be determined that the test sample belongs to device A.
[0102] As shown in Figure 2 , the application also discloses a Modbus device signal fingerprint self-updating method based on transient time domain waveform multi-modal fusion. The mechanism of the self-updating mechanism is to collect new data during normal operation of the device as appropriate, and the old and new data participate in the model retraining process together. The weight is updated using the incremental learning strategy, so that the model can gradually adapt to the changes in the device state. The purpose of the self-updating mechanism is to enable the system to adapt to changes in the device over time, such as aging, failure or other environmental changes. By regularly updating the training data and model parameters, the system can maintain its recognition performance. The specific implementation scheme of the self-updating mechanism of the application is that when new signal data is collected, the feature vector is updated and added to the training set, and the fine-tuning method is used to adjust only the weight of the last fully connected layer. The specific steps are as follows:
[0103] Data collection: when the fingerprint code C new obtained in the previous step is detected, the stored fingerprint code C of the corresponding device in the database is queried. db When there is a change, collect the corresponding new signal data.
[0104] Feature extraction: multi-modal preprocessing is performed on the newly collected data to extract transient time domain waveform features, main frequency components in the frequency domain, and standard deviations of CWT coefficients at different scales to obtain a signal comprehensive feature vector.
[0105] Sparse representation: use the improved SRC model to generate a new sparse coefficient vector
[0106] Update the training set: add the new sparse coefficient vector and the corresponding class label y new to the training set.
[0107] Fine-tune the model: only adjust the weight of the last fully connected layer, and keep the parameters of the previous layers unchanged.
[0108] The following is explained in connection with the formula:
[0109] Let the initial training set of the CNN model be where M represents the training set size, and each is a sparse coefficient vector, and the new sparse coefficient vector is added, the updated training set is The corresponding new label y new is also added to the label set Y, and the updated label set is Y ′ = [Y, y new ]. Assuming that the weight matrix of the last fully connected layer of the CNN model is W fc , and the bias vector is b fc , the goal of fine-tuning is to minimize the loss function on the new training data:
[0110]
[0111] where L is the cross-entropy loss function. This strategy ensures that the model can be fine-tuned with the latest data, thereby improving the long-term effectiveness and robustness of the system.
[0112] In addition, in this step, a reasonable threshold judgment standard is also set, when the current fingerprint code and historical record difference exceeds a certain range, the alarm mechanism is triggered, prompting that there may be abnormal situation, on the one hand, reminding the administrator to find the possible malfunctioning equipment in time and maintain; On the other hand, it also avoids the sparse coefficient vector and label set corresponding to the abnormal fingerprint code from entering the CNN model for updating and training, so as to avoid the CNN model from appearing error update, so as to achieve the best recognition effect and stability.
[0113] The threshold judgment standard is explained in detail as follows:
[0114] Use the current model to generate the fingerprint code C new of the new sample: Specifically, after feature extraction and sparse representation of the newly collected signal data, the new sparse coefficient vector is obtained. Input new into the trained CNN model to generate the new fingerprint code C db .
[0115] Get the fingerprint code in the database: Query the stored fingerprint code C new of the corresponding device from the database.
[0116] Calculate the Euclidean distance: Calculate the Euclidean distance d between C db and C new .
[0117]
[0118] Set threshold and determine: set a reasonable threshold θ, if d> θ, trigger the alarm.
[0119] In this embodiment, 600 groups of modbus device original signals (200 groups for each type of device) are collected as a training set, and the 3 types of device signal samples in the SRC model dictionary matrix are as shown in Figure 3 After 10 rounds of 1D CNN training, the accuracy rate reaches 99.1%, as shown in Figure 4 The fingerprint codes of the three types of devices are as shown in Figure 5
[0120] The embodiment of the application also discloses a computer system, which comprises a memory, a processor and a computer program / instruction stored on the memory and executable on the processor, and the computer program / instruction realizes the steps of the above-mentioned Modbus device signal fingerprint extraction and / or self-updating method when executed by the processor.
[0121] The embodiment of the application also discloses a computer readable storage medium, which stores a computer program, and the computer program / instruction realizes the steps of the above-mentioned Modbus device signal fingerprint extraction and / or self-updating method when executed by the processor.
[0122] The embodiment of the application also discloses a computer program product, which comprises a computer program / instruction, and the computer program / instruction realizes the steps of the above-mentioned Modbus device signal fingerprint extraction and / or self-updating method when executed by the processor.
[0123] The program code for implementing the method of the application can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, a special purpose computer, or other programmable data processing apparatus, such that the program code, when executed by the processor or controller, causes the steps of the method of the application to be implemented. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a separate software package and partially on a remote machine, or entirely on a remote machine or server. The details of the application not described are known to those skilled in the art.
Claims
1. A Modbus device signal fingerprint extraction method based on transient time-domain waveform multimodal fusion, characterized in that, Includes the following steps: Step 1: Collect the signals when the Modbus device starts up to obtain the signal sequence; Step 2: Utilize the transient time-domain waveform characteristics, spectral characteristics, and signal features at different scales to perform multimodal preprocessing on the signal sequence, obtaining a comprehensive signal feature vector. This vector includes transient characteristic statistics and morphological parameters describing the signal, actual frequency components calculated using frequency domain analysis, and the average standard deviation calculated using wavelet domain decomposition for all scales. The transient characteristic statistics and morphological parameters include peak amplitude, rise time, overshoot, and ringing. Step 3: By introducing an improved SRC model with non-negative constraints, find a sparse coefficient vector such that the product of the dictionary matrix and the coefficient vector is closest to the comprehensive feature vector of the test sample. Step 4: Input the sparse coefficient vector as a feature into the deep learning model for training to generate a unique fingerprint code for the device. The fingerprint code is a probability distribution that represents the probability of a test sample belonging to each category. In step 3, the calculation formula for the improved SRC model is as follows: ； Where D is the dictionary matrix, It is the comprehensive feature vector of the training samples. It is a sparse coefficient vector. yes Norms are used to promote sparsity. It is the reconstruction error, used to measure and The differences between them It is a regularization parameter used to balance sparsity and reconstruction error.
2. The Modbus device signal fingerprint extraction method based on transient time-domain waveform multimodal fusion according to claim 1, characterized in that, The dictionary matrix N represents N types of devices. It is the comprehensive feature vector of the initial training samples of the i-th type of device. Each It is a 1×d vector, where d is the dimension of the feature vector.
3. The Modbus device signal fingerprint extraction method based on transient time-domain waveform multimodal fusion according to claim 1, characterized in that, In step 4, the deep learning model adopts a 1D CNN model, which includes an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer; wherein: the input layer inputs a sparse coefficient vector; the convolutional layer is used to extract local features; the pooling layer is used to reduce the feature dimension; the fully connected layer is used to map the features to the final fingerprint code; and the output layer is used to generate a fixed-length fingerprint code.
4. A Modbus device signal fingerprint self-updating method based on transient time-domain waveform multimodal fusion, characterized by comprising the following steps: The device fingerprint code is obtained using the Modbus device signal fingerprint extraction method based on transient time-domain waveform multimodal fusion according to any one of claims 1-3. The obtained fingerprint code is then detected. Query the database to find the stored fingerprint of the corresponding device. When changes occur, collect the corresponding new signal data; The newly collected data is preprocessed using multiple modes to obtain the signal synthesis feature vector; Generate a new sparse coefficient vector using an improved SRC model; Add the new sparse coefficient vector and its corresponding class label to the training set; Fine-tune the model by adjusting only the weights of the last fully connected layer while keeping the parameters of the preceding layers unchanged.
5. The Modbus device signal fingerprint self-updating method based on transient time-domain waveform multimodal fusion according to claim 4, characterized in that, Also includes: By calculating fingerprint code With stored fingerprint code The Euclidean distance between them is used to set a threshold and make judgments. When the difference between the current fingerprint code and the historical records exceeds a certain range, an alarm mechanism is triggered. Abnormal fingerprint codes that trigger alarms are not included in the model's update training.
6. A computer system comprising a memory, a processor, and computer programs / instructions stored in the memory and executable on the processor, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-5.
7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-5.
8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-5.