An intrusion detection method for a remote control system for food processing

Abstract

This invention relates to the field of intrusion detection technology, and more particularly to an intrusion detection method for a remote control system for food processing. The method includes the following steps: deploying edge data acquisition nodes to synchronously acquire PLC control commands and sensor data, generating a multimodal industrial dataset; constructing an industrial protocol network using the multimodal food processing dataset; performing time-series encoding on the food processing protocol network and injecting food processing physical constraints to obtain food processing time-series-constraint feature data. Therefore, this invention, by combining multimodal data fusion with physical constraint embedding, solves the problems of poor robustness and weak physical consistency in traditional intrusion detection methods based on a single data source or static features in dynamic processing environments, thus improving the accuracy and security of intrusion detection in food processing systems in remote environments.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology, and in particular to an intrusion detection method for a remote control system for food processing. Background Technology

[0002] Existing technologies generally lack the ability to model the correlation between actual physical process parameters (such as temperature, pressure, valve status, etc.) and equipment behavior in food processing, making it impossible to effectively couple and judge process status with intrusion behavior. Secondly, traditional intrusion detection methods often rely on static rules or historical attack features, which cannot cope with the strategies of attackers hiding abnormal behavior through small perturbations in food processing control systems, resulting in insufficient response capability to low-frequency or slow attacks. Thirdly, current technologies rarely consider the hierarchical structure within food processing systems, such as the linkage patterns between equipment-level, process-level, and production line-level data, thus limiting the ability to fuse multi-granularity intrusion clues and identify attack paths. In addition, existing methods lack anomaly recognition mechanisms based on physical constraints, resulting in extremely poor recognition of attacks that achieve physical deception by tampering with sensor or controller signals, which can easily be disguised as legitimate states and evade detection. Finally, current technologies generally ignore the problem of scarce attack samples during model training, resulting in weak model generalization ability and difficulty in adapting to variant attacks in complex industrial scenarios. Summary of the Invention

[0003] Therefore, it is necessary to provide an intrusion detection method for a remote control system for food processing to solve at least one of the above-mentioned technical problems.

[0004] To achieve the above objectives, an intrusion detection method for a food processing remote control system is provided, the method comprising the following steps:

[0005] Step S1: Deploy edge data acquisition nodes to synchronously collect PLC control commands and sensor data, and generate a multimodal food processing dataset;

[0006] Step S2: Construct a food processing protocol network using a multimodal food processing dataset; perform temporal coding on the food processing protocol network and apply binary mask hard constraints using a remote control system to obtain food processing temporal-constraint feature data;

[0007] Step S3: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system; construct a remote intrusion detection model for food processing using food processing time-constraint feature data and weak nodes in the food processing system;

[0008] Step S4: Construct food processing detection indicators based on the food processing remote control system; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and obtain a food processing intrusion detection report.

[0009] The beneficial effects of this invention lie in its ability to deploy edge data acquisition nodes to synchronously acquire PLC control commands and sensor observation data in real time, forming a multimodal industrial dataset covering both the equipment command layer and the perception layer. This effectively integrates heterogeneous information such as control logic, physical state, and process behavior at the data level, making the equipment behavior and physical processes in food processing correlated and traceable. Furthermore, an industrial protocol network is constructed based on this multimodal data, and multi-scale temporal coding technology is introduced to capture the dynamic evolution patterns in the processing. By injecting physical constraint parameters of food processing, a collaborative embedding of data-driven and domain knowledge constraints is achieved, ensuring that the extracted features not only have the ability to express temporal changes but also reflect the physical consistency and equipment response patterns in the food processing process. Based on this, key control nodes are extracted using temporal-physical constraint feature data, effectively identifying core control points in the food processing flow from the data structure level. This helps to construct a remote intrusion detection model with local sensitivity and global correlation. This model employs multi-dimensional detection metrics for refined evaluation, including time response consistency, physical state deviation rate, and frequency of abnormal commands, forming a complete data-driven food processing safety analysis framework that improves the detection accuracy and response efficiency of abnormal behaviors. Therefore, this invention, through a combination of multimodal data fusion and physical constraint embedding, addresses the problems of poor robustness and weak physical consistency in dynamic processing environments encountered by traditional intrusion detection methods based on single data sources or static features, thereby improving the accuracy and security of intrusion detection in food processing systems in remote environments.

[0010] Preferably, step S1 includes the following steps:

[0011] Step S11: Collect operation codes with a frequency greater than or equal to 200Hz and food processing parameters to generate PLC instruction data;

[0012] Step S12: Set up a 16-bit ADC-quantized temperature sensor to collect food processing temperature data;

[0013] Step S13: Set a vibration sensor with a sampling rate of 10kHz to collect triaxial acceleration waveform data of the components;

[0014] Step S14: Synchronize the PLC instruction data, food processing temperature data, and component triaxial acceleration waveform data according to 5ms time intervals to construct a spatiotemporally aligned data matrix;

[0015] Step S15: Use wavelet filtering to reduce the dimensionality of the spatiotemporally aligned data matrix to obtain a multimodal food processing dataset.

[0016] This invention significantly improves the quality and data fusion capabilities of industrial data in food processing by jointly acquiring and processing different data sources at high frequency, with high precision, and through multiple channels. At the data acquisition level, a sampling frequency greater than or equal to 200Hz is set to acquire PLC operation codes and food processing parameters, ensuring high timeliness and continuous capture of control commands and providing sufficient temporal resolution for control behavior in the data dimension. A 16-bit ADC quantization precision temperature sensor is used to sample key temperature states during processing with high precision, effectively reflecting thermal changes. A vibration sensor with a 10kHz high sampling rate acquires triaxial acceleration waveform data of components during processing, accurately recording minute disturbances and dynamic responses in equipment operation. Furthermore, by aligning the above three types of heterogeneous data with a 5ms time window, a spatiotemporally unified data matrix is ​​constructed, achieving synchronous fusion between control commands, temperature changes, and mechanical vibrations at the data level, providing a solid data foundation for subsequent feature extraction and dynamic correlation analysis. By employing wavelet filtering to perform multi-scale dimensionality reduction on high-dimensional spatiotemporally aligned data, key frequency components and anomalous fluctuation signals can be preserved while reducing data redundancy and computational complexity. This results in a multimodal industrial dataset that is semantically complete, physically consistent, and free from noise interference. This dataset not only enables refined modeling of the entire food processing process but also significantly enhances the system's ability to perceive processing anomalies, structural responses, and process deviations, providing high-quality data support for intelligent monitoring, fault early warning, and remote diagnosis.

[0017] Preferably, step S2, which involves constructing a food processing protocol network using a multimodal industrial dataset, includes the following:

[0018] The device node tag data is obtained by parsing the OPC-UA protocol fields from the PLC instruction data;

[0019] Extract communication frequency data from the triaxial acceleration waveform data of the components;

[0020] Based on the mapping of device node label data to low-dimensional vectors, we obtain the node low-dimensional vector data;

[0021] Initial edge weights are defined based on communication frequency data; network construction is performed on the low-dimensional vector data of nodes using the initial edge weights, and the graph structure is verified using the industrial protocol rule IEC 62443, thus obtaining the food processing protocol graph structure network.

[0022] This invention extracts OPC-UA protocol fields from PLC instruction data, reconstructing the equipment control logic and node communication structure from the data communication content, forming semantically oriented equipment node tag data. Secondly, by performing time-frequency analysis on the triaxial acceleration waveform data of components, communication frequency features are extracted, effectively revealing the coupling relationship between the dynamic behavior of the equipment under different operating conditions and the communication frequency response. Based on this, the equipment node tag data is vectorized and mapped to form node representations in a low-dimensional embedded space, giving the original discrete tags computability and similarity measurement capabilities at the data level. Furthermore, initial edge weights are constructed based on the communication frequency data, giving the network connection structure a physical response basis and dynamic feature support in its modeling. The graph structure constructed in this way not only maintains the spatiotemporal correspondence between equipment control and response mechanisms but also introduces the industrial protocol rule IEC 62443 for structural verification, effectively eliminating potential illegal structures and redundant edges in the communication path, ensuring the protocol consistency and security integrity of the network structure. The resulting industrial protocol graph structure network achieves multi-dimensional collaborative expression from control commands and physical responses to protocol specifications at the data level. This improves the semantic accuracy and structural parsing ability of the food processing system in understanding the behavior of edge nodes, laying a high-quality data foundation for subsequent intelligent identification, anomaly detection, and control optimization.

[0023] Preferably, step S2, which involves temporally encoding the food processing protocol network and injecting food processing physical constraints, includes the following:

[0024] The multimodal food processing dataset was divided into different granularities according to the sliding window length for data extraction, resulting in multi-scale time series hierarchical data. This multi-scale time series hierarchical data includes equipment-level granularity data, process-level granularity data, and production line-level granularity data; the division length is as follows:

[0025] When the sliding window is 10s, the instantaneous fluctuation characteristics of the valve switching frequency are extracted to obtain equipment-level granular data.

[0026] When the sliding window is 5 minutes, the data extracted is the synchronization data between the steam valve and the temperature sensor during the sterilization stage, which yields process-level particle size data.

[0027] When the sliding window is 1 hour, the extracted data are the energy consumption trend of motor current energy consumption and equipment degradation data, resulting in production line-level granular data.

[0028] Time-series coding is performed on multi-scale time-series hierarchical data to obtain multi-scale coded data;

[0029] Based on the multi-scale encoded data, a remote control system is used to apply binary mask hard constraints to obtain food processing time-constraint feature data.

[0030] This invention employs a sliding window mechanism to partition multimodal industrial datasets into time series data of different granularities, achieving dynamic expression and structural reconstruction of data at three levels: equipment, process, and production line. This significantly enhances the hierarchical modeling capability of temporal behavior in food processing. During data extraction, a 10-second sliding window focuses on the rapid response characteristics of control behavior, accurately capturing instantaneous fluctuations such as valve switching frequency to form high-frequency temporal features reflecting changes in equipment operation status. A 5-minute window covers typical process cycles, extracting synchronization and process coordination data for the dynamic coupling relationship between steam valve action and temperature sensor feedback during sterilization, thus forming process-level granular features. A 1-hour window reflects the overall system's energy consumption trends and long-term performance changes, such as motor current fluctuations and equipment degradation processes, thereby constructing production line-level feature data reflecting the overall process's operational efficiency and health status. Unified encoding of these different granular temporal hierarchical data allows for the extraction of key dynamic features at each time level through multi-scale temporal encoding technology, achieving cross-scale alignment and feature fusion across the time dimension. Furthermore, embedding constraint information from the physical process into multi-scale encoded data, such as processing physics laws like thermal inertia, energy conservation, and mechanical response delay, can guide the model's learning towards physical consistency and contextual dependence at the data level, improving its ability to identify problems like process anomalies, equipment failures, and system coordination deviations. Overall, this method forms a system that combines strong physical constraints and multi-scale representation in data structure construction and temporal feature fusion, providing a robust, high-resolution feature data foundation with physical semantic support for subsequent intelligent analysis tasks.

[0031] Preferably, time-series coding based on multi-scale time-series hierarchical data includes the following:

[0032] The device-level granular data is subjected to millisecond-level fluctuations with a length of 3 and a stride of 1, and a first-order direct-connection device convolution kernel is constructed to obtain the ST-GCN device branch layer.

[0033] The process-level granular data is analyzed in a complete sub-process stage with a length of 15 and a step size of 5, and a global convolution kernel for the equipment group is constructed to obtain the ST-GCN sub-process branch layer.

[0034] The production line-level granular data is extracted daily at a length of 60 and a step size of 20, and a global system convolution kernel is constructed to obtain the ST-GCN global branch layer.

[0035] The ST-GCN equipment branch layer, ST-GCN sub-process branch layer, and ST-GCN global branch layer are fused using a gated cyclic unit formula, and then temporal coding is performed to obtain multi-scale coded data. The gated cyclic unit formula is as follows:

[0036] h t+1 =GRU(h t ST-GCN(A) t ,X t ));

[0037] Among them, h t+1 h represents the model's implicit memory at time step. t Indicates storing historical information; ST-GCN represents a spatiotemporal graph convolutional network; A t Let X represent the adjacency matrix. t This represents the node feature matrix.

[0038] This invention employs a multi-granularity sliding window mechanism to perform time-slicing of industrial data at the equipment, process, and production line levels, and constructs a hierarchical spatiotemporal graph convolutional network (ST-GCN) model to achieve dynamic modeling and feature extraction of industrial behavior across multiple time scales. At the data level, equipment-level granular data is divided into high-frequency, fine-grained segments with a length of 3 and a step size of 1, capturing the fluctuation characteristics of equipment operation under second-level perturbations, establishing close local dynamic response relationships, and extracting local spatiotemporal correlation information through the ST-GCN branch network. Process-level granular data is divided with a length of 15 and a step size of 5, covering the entire process sub-process interval, enabling the model to identify equipment collaborative actions and stage feature evolution at the mesoscale level, and extracting mid-range dependencies. Production line-level granular data is sliced ​​with a length of 60 and a step size of 20, focusing on the long-term operating trends of equipment groups and system performance degradation characteristics, thereby extracting data patterns of system-level stability and long-term behavioral changes. The three spatiotemporal slices mentioned above are processed by convolutional encoding through the construction of ST-GCN local branch, sub-process branch, and global branch networks. A gated recurrent unit (GRU) is introduced in the control stage to fuse historical state memory and temporal information, constructing multi-scale temporal encoded data with temporal continuity, spatial topology, and process logic constraints. Specifically, at each time step, the GRU integrates the current ST-GCN encoding state and historical hidden information, ensuring that the model has temporal consistency and feature transfer capability at different scales at the data level. Overall, this method achieves multi-granularity analysis and encoding of local rapid perturbations, staged process behaviors, and global system trends at the data level, effectively improving the completeness of industrial data representation and modeling accuracy across time, space, and process logic dimensions.

[0039] Preferably, step S3 includes the following steps:

[0040] Step S31: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system;

[0041] Step S32: Construct a perceptual intrusion detection model using food processing time-constraint feature data and weak nodes in the food processing system, and create adversarial example training data;

[0042] Step S33: Optimize the perceptual intrusion detection model using adversarial example training data, and incrementally update it using key nodes of the food processing system to obtain a remote intrusion detection model for food processing.

[0043] This invention, through deep analysis of the temporal-constraint feature data of food processing, first extracts key control points in the system that possess high control sensitivity and strong correlation with process constraints. This enables precise location and node selection of high-risk decision-making processes at the data level, forming a set of key nodes in the food processing system with priority detection value. Based on this, a perception-level intrusion detection model is constructed by combining the dynamic behavioral characteristics and physical state transition information of the key node context. This ensures that the model's boundary delineation between normal process states and potential abnormal states at the data level possesses physical rationality and temporal consistency. To enhance the model's robustness in real-world attack scenarios, adversarial sample training data is further constructed based on the original features. By injecting micro-perturbations, misleading data samples are generated, challenging and expanding the model's recognition boundaries without disrupting the physical logic of the process. Through training and optimization on adversarial samples, the model can adapt to various minor anomalies, gradually evolving attack postures, and stealthy operational behaviors at the data level, thereby improving the sensitivity of anomaly detection and the ability to suppress false positives. Furthermore, to address process variations and dynamic evolution of nodes during food processing, this model introduces an incremental update mechanism centered on key nodes. This mechanism enables continuous learning and knowledge supplementation of newly emerging features within a time window at the data level, effectively enhancing the model's adaptability to structural changes and control strategy adjustments in heterogeneous data scenarios. Overall, this method, based on feature extraction, reinforced by adversarial training, and driven by key nodes, achieves a complete closed-loop data processing flow from high-dimensional feature fusion and anomaly boundary optimization to dynamic evolution of knowledge structure. This improves the real-time performance, accuracy, and sustainable update capability of the remote intrusion detection model in intelligent control scenarios for food processing.

[0044] Preferably, step S32 includes the following steps:

[0045] Step S321: Construct three-level feature curves for equipment, process, and production line based on the food processing time-constraint feature data;

[0046] Step S322: Perform weighted characteristic curve slope analysis on the three-level characteristic curves of equipment-process-production line, and construct a perception intrusion detection model;

[0047] Step S323: Obtain the training dataset; input the training dataset into the perceptual intrusion detection model to simulate white-box attacks, and perform temperature perturbation to obtain adversarial example training data.

[0048] This invention employs hierarchical processing of food processing time-constraint characteristic data. First, it constructs three levels of characteristic curves: equipment-level, process-level, and production line-level. This hierarchical modeling across the data dimension enables coupled analysis and correlation modeling of dynamic behaviors at different scales. Specifically, the equipment-level characteristic curves primarily reflect the response characteristics of micro-control units; the process-level curves embody the physical parameter changes under multi-device collaboration; and the production line-level curves capture the macroscopic evolution trajectory of energy consumption and degradation trends during long-term process operation. By applying differentiated weights to these three levels of characteristic curves and introducing a curve slope analysis mechanism at the data level, the gradient trend and abrupt change characteristics of the system's operating state under time-series changes are effectively captured. This allows the intrusion detection model to possess not only the overall perception capability of abnormal states but also the dynamic expression capability of multi-layered response structures triggered by minor perturbations. After constructing the intrusion detection model, a white-box attack simulation mechanism is introduced. The training dataset is input into the model in a controllable manner, and its structural parameters are exposed, thereby exploring the model's vulnerability boundaries to potential attacks under data-driven conditions. Building upon this foundation, temperature perturbations are applied to simulate abnormal physical layer conditions, generating adversarial training data with realistic attack characteristics and model misleading capabilities. This improves the diversity and attack coverage of the training set from a data perspective, effectively enhancing the model's adaptability and robustness to complex attack scenarios. Overall, this method enhances the perceptual intrusion detection model's ability to capture multi-scale dynamic anomalies in the system through a triple data mechanism of hierarchical feature construction, weighted slope analysis, and adversarial example generation. It addresses the insufficient recognition performance of traditional intrusion detection methods in dealing with cascading attacks and temperature-controlled perturbation scenarios, improving the system's comprehensive detection capability for multi-level and multi-source intrusion behaviors.

[0049] Preferably, step S4 includes the following steps:

[0050] Step S41: Construct food processing detection indicators based on the food processing remote control system;

[0051] Step S42: Obtain historical attack logs; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and historical attack logs to obtain multi-dimensional intrusion detection evaluation data;

[0052] Step S43: Generate a high-frequency attack profile based on multi-dimensional intrusion detection and assessment data to obtain a high-frequency attack profile for food processing; use the high-frequency attack profile for food processing to supplement system firewall vulnerabilities and generate a food processing intrusion detection report.

[0053] This invention introduces a multi-dimensional detection index system to structurally evaluate and analyze the attack response of a remote intrusion detection model for food processing, significantly improving the model's ability to identify and judge complex intrusion behaviors. Specifically, the multi-dimensional detection index covers multiple dimensions such as detection accuracy, response latency, anomaly threshold offset, physical constraint deviation, and node behavior confidence changes. Data observation points are established at both the model output layer and the time axis to ensure the model's consistency in anomaly discrimination across temporal dynamics and spatial distribution. After acquiring historical attack logs, this method further uses data alignment and feature reconstruction mechanisms to jointly analyze the multi-dimensional detection indexes and log data, thereby constructing multi-dimensional intrusion detection evaluation data. This evaluation data not only includes traditional binary classification results but also incorporates the temporal distribution characteristics of attack events, interference method labeling, and physical impact quantification parameters, achieving multi-angle and multi-level analysis of intrusion behavior. Based on this, frequency analysis and clustering algorithms are used to extract high-frequency attack pattern features from the evaluation data, generating a high-frequency attack profile for food processing. This profile can characterize the triggering conditions, attack paths, and response results of repeated attack behaviors in the target system, representing an abstract expression of attack patterns at the data level. Finally, based on this attack profile, the system firewall rules and response policy library are further updated to supplement the vulnerability types that are not covered or repeatedly fail in historical logs, thereby improving the proactive and adaptive defense capabilities of the intrusion detection system. This method, based on multi-dimensional data fusion, time-series log parsing, and attack profile extraction, achieves closed-loop optimization from detection and evaluation to defense feedback. It effectively solves the problems of traditional intrusion detection results being of a single dimension, model updates being slow, and firewall responses being static, thus improving the response speed and defense coverage breadth of the food processing system when facing high-frequency attack events.

[0054] Preferably, the construction of food processing detection indicators in step S41 includes the following steps:

[0055] Based on the remote control system for food processing, equipment-level instantaneous attack analysis was performed to obtain instantaneous attack analysis trends; key trends were marked on the instantaneous attack analysis trends, and instantaneous attack detection indicators were generated.

[0056] Extract temperature-pressure mismatch alarm latency data based on the food processing remote control system; perform data mapping on the temperature-pressure mismatch alarm latency data and calculate the average latency to obtain process-level collaborative detection indicators;

[0057] Data from the sterilization stage of the food processing remote control system is extracted to obtain food processing sterilization temperature data; based on the food processing sterilization temperature data, a complete sterilization rule test is performed to obtain the rule coverage test index.

[0058] This invention performs multi-level, multi-perspective data analysis and index reconstruction on the output of a remote intrusion detection model for food processing. At the data level, it achieves refined expression and structural quantification of detection capabilities, effectively enhancing the system's sensitivity and recognition breadth against various types of attacks. Specifically, the device-level instantaneous attack analysis captures fluctuation trends caused by abnormal PLC commands, sensor response delays, or sudden changes in device behavior at the millisecond sampling granularity, generating instantaneous attack analysis trends. Trend markers are formed by modeling the joint features of fluctuation slope and duration, constructing instantaneous attack detection indicators reflecting sudden intrusion behaviors. At the process level, this method extracts nonlinear correspondence data between temperature and pressure in key stages. By constructing response time curves for alarm events, the data is mapped and transformed, and its stability characteristics are statistically analyzed, thereby constructing process-level collaborative detection indicators characterizing the performance of process collaborative anomaly response. At the system level, further, by extracting the core parameter of the sterilization stage—the change data of sterilization temperature—and comparing it with a preset sterilization process rule library, a rule coverage detection indicator is constructed using rule matching degree to measure the completeness of the detection model's coverage of attack behaviors and constraint recognition in complex process stages. Ultimately, the three types of detection indicators comprehensively evaluate the system from the dimensions of local response, stage coordination, and full-process rule adaptation. A weighted fusion strategy is used to construct multi-dimensional detection indicators, forming a unified quantitative criterion to support application scenarios such as model optimization, attack early warning, and strategy feedback. This data construction path features clear hierarchy, traceable sources, and complementary features, significantly improving the intrusion detection system's ability to express multi-dimensional attack dynamics, process complexity, and rule adaptability. It overcomes the limitations of traditional models' single-dimensional detection indicators, lack of response coordination mechanisms, and process constraint desensitization, enhancing the security monitoring efficiency and protection reliability of food processing systems in complex industrial scenarios.

[0059] Preferably, step S42 includes the following steps:

[0060] Step S421: Obtain historical attack logs;

[0061] Step S422: Detect the gas processing remote intrusion detection model and historical attack logs according to the instantaneous attack detection index. When the identification rate of abnormal valve switching within 10 seconds is less than or equal to 75%, trigger an alarm and generate an instantaneous attack detection log.

[0062] Step S423: Calculate the average mismatch time using the food processing remote intrusion detection model and historical attack logs. If the average mismatch time is greater than or equal to the process-level collaborative detection index, trigger an alarm and generate a process-level collaborative detection log.

[0063] Step S424: Use the coverage detection index to detect the sterilization process rule coverage of the food processing remote intrusion detection model and historical attack logs. If the temperature rule coverage is less than 100%, trigger an alarm and generate a physical compliance detection log.

[0064] Step S425: Evaluate the intrusion detection results by combining the instantaneous attack detection logs, process-level collaborative detection logs, and physical compliance detection logs to obtain multi-dimensional intrusion detection evaluation data.

[0065] This invention constructs a multi-dimensional deep interpretation mechanism for historical attack logs by introducing instantaneous indicators, collaborative response time indicators, and physical rule coverage indicators. This significantly enhances the intrusion detection system's ability to analyze the evolution of attack behavior and its ability to backtrack and distinguish abnormal patterns. At the data level, the mechanism first compares historical attack logs with the remote intrusion detection model, performing a line-by-line detection of valve switching frequency recognition rate within a 10-second sliding window. If the rate falls below a set threshold, an instantaneous attack detection log is automatically generated. This type of log can be used to extract the distribution of response capabilities of critical equipment under short-cycle sudden behavior, thereby locating the changing trend of abnormal behavior patterns at the equipment level. Furthermore, the system statistically analyzes the response time difference between co-variables such as temperature and pressure using the average mismatch time index, and compares it with process-level co-detection indicators. If the delay time is significantly abnormal, an alarm is triggered and a co-detection log is generated. This log reflects the degradation characteristics of the co-efficiency between process variables under attack conditions. Simultaneously, the system uses a rule coverage detection method to align the sterilization stage process rules (such as whether the temperature curve meets time coverage) with the model detection results. If there is a case where a rule is not fully covered, it is recorded as a physical compliance detection log. This type of log can reflect the weakening characteristics of system rule adaptability under multi-step attacks. Ultimately, this method structurally integrates the three types of logs mentioned above, extracting feature responses of intrusion behavior across multiple dimensions to construct intrusion detection evaluation data. This enables a systematic retrospective evaluation of the model's detection effectiveness, rule adaptability, and process stability. This evaluation data not only improves the utilization efficiency of historical attack logs but also supports subsequent model fine-tuning, defense mechanism modification, and attack profile reconstruction. It effectively overcomes the challenges of traditional detection systems, such as a single data hierarchy structure, insensitive indicator settings, and insufficient rule response loops. This provides a data foundation and strategic basis for building a dynamically evolving food processing industry safety system. Attached Figure Description

[0066] Figure 1 A schematic diagram of the steps of an intrusion detection method for a remote control system for food processing;

[0067] Figure 2 for Figure 1 A detailed flowchart illustrating the implementation steps of step S3.

[0068] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0069] The technical method of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this invention.

[0070] Furthermore, the accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor methods and / or microcontroller methods.

[0071] It should be understood that although the terms "first," "second," etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are used merely to distinguish one unit from another. For example, without departing from the scope of the exemplary embodiments, a first unit may be referred to as a second unit, and similarly, a second unit may be referred to as a first unit. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0072] To achieve the above objectives, please refer to Figures 1 to 2 An intrusion detection method for a remote control system for food processing, the method comprising the following steps:

[0073] Step S1: Deploy edge data acquisition nodes to synchronously collect PLC control commands and sensor data, and generate a multimodal food processing dataset;

[0074] Step S2: Construct a food processing protocol network using a multimodal food processing dataset; perform temporal coding on the food processing protocol network and apply binary mask hard constraints using a remote control system to obtain food processing temporal-constraint feature data;

[0075] Step S3: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system; construct a remote intrusion detection model for food processing using food processing time-constraint feature data and weak nodes in the food processing system;

[0076] Step S4: Construct food processing detection indicators based on the food processing remote control system; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and obtain a food processing intrusion detection report.

[0077] In this embodiment of the invention, reference Figure 1 The diagram shown is a flowchart illustrating the steps of an intrusion detection method for a food processing remote control system according to the present invention. In this example, the intrusion detection method for the food processing remote control system includes the following steps:

[0078] Step S1: Deploy edge data acquisition nodes to synchronously collect PLC control commands and sensor data, and generate a multimodal food processing dataset;

[0079] In this embodiment of the invention, edge computing nodes are deployed at key locations on the production site to collect control commands from PLCs (Programmable Logic Controllers) and physical quantity data from various sensors (such as temperature, humidity, pressure, flow rate, etc.) in real time. To ensure the timeliness and accuracy of the data, the data acquisition nodes employ high-performance embedded devices. These devices can perform preliminary data processing, filtering, and compression locally to reduce bandwidth pressure on data transmission and improve system response speed and efficiency. Secondly, PLC control command data typically includes information such as the operating status of production equipment, executed instructions, and set targets. By combining this data with sensor data, different types of time-series data are formed. This data communicates with the edge nodes via industrial protocols (such as Modbus, OPC UA, etc.) and is transmitted in real time to a cloud platform or data center for further processing and analysis.

[0080] Step S2: Construct a food processing protocol network using a multimodal food processing dataset; perform temporal coding on the food processing protocol network and apply binary mask hard constraints using a remote control system to obtain food processing temporal-constraint feature data;

[0081] In this embodiment of the invention, the industrial protocol network is constructed based on a heterogeneous graph structure formed from different data sources (such as PLC control commands, sensor data, equipment status information, etc.) in a multimodal industrial dataset. Nodes in this graph structure represent entities such as industrial equipment, sensors, and control commands, while edges represent the relationships or dependencies between them. This graph structure effectively captures the complex relationships between various devices and sensors, and extracts high-order dependencies and information transmission paths between nodes through graph convolution operations. To fully utilize the dynamic characteristics of time-series data, a multi-scale temporal coding method is used to process the temporal information in the industrial protocol graph. Specifically, the temporal coding technique encodes the time-series data based on the historical data of each node in the network using methods such as convolutional neural networks (CNN), recurrent neural networks (RNN), or long short-term memory networks (LSTM) to extract dynamic change features at different time scales. Furthermore, for the specific application scenario of food processing, binary mask hard constraints play a crucial role in temporal modeling. Binary mask hard constraints typically refer to physical constraints in the food processing process, such as the control requirements for physical parameters like temperature, humidity, and reaction rate. These constraints are embedded into the temporal feature learning process through certain mathematical forms, enabling the network to maintain the rationality and interpretability of the physical process while learning data features.

[0082] Step S3: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system; construct a remote intrusion detection model for food processing using food processing time-constraint feature data and weak nodes in the food processing system;

[0083] In this embodiment of the invention, the key control point extraction technique is based on food processing time-constraint feature data. The aim is to identify the control points that have the greatest impact on system performance and security from large-scale, multi-dimensional data. This process typically involves feature selection and dimensionality reduction techniques, utilizing statistical methods (such as principal component analysis, mutual information quantization, and information gain) or model-based feature selection methods (such as LASSO and random forest feature importance assessment) to screen for the most representative features. These techniques identify time-series data points crucial to the food processing process, such as key parameters like temperature, humidity, and pressure, and their spatiotemporal trends. These control points directly determine the efficiency and quality of food processing. Then, based on the extracted key control points and time-series data, a remote intrusion detection model for food processing can be constructed. This model utilizes anomaly detection algorithms in machine learning, such as Support Vector Machines (SVM), Isolation Forest, and Autoencoders, to identify abnormal patterns and intrusion behaviors in the system. At the data level, these algorithms build a robust model by analyzing the differences between normal and abnormal patterns in historical data. This model can automatically detect behaviors that are inconsistent with normal operations when faced with new data, thereby identifying potential intrusion risks.

[0084] Step S4: Construct food processing detection indicators based on the food processing remote control system; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and obtain a food processing intrusion detection report.

[0085] In this embodiment of the invention, the core technical means of constructing multi-dimensional detection indicators is to extract features and performance indicators of different dimensions from multiple data sources (such as sensor data, control commands, equipment status, etc.) during the food processing process. These detection indicators include, but are not limited to, system temporal changes, parameter fluctuations, equipment response time, sensor accuracy, and deviations between control commands and sensor data, which can comprehensively reflect potential abnormal behaviors or external intrusion impacts during the food processing process. For example, the deviation of temporal data, sudden changes in sensor readings, and inconsistencies between operation commands and feedback can all be components of the detection indicators. The extraction of these indicators is accomplished through feature-based analysis techniques (such as statistical feature extraction and signal processing methods) and model-based techniques (such as supervised learning and unsupervised learning). Next, these multi-dimensional detection indicators are used to evaluate the remote intrusion detection model, employing various performance evaluation methods such as accuracy, recall, F1 score, ROC curve, and AUC value to quantify the model's detection capability. During the evaluation process, the model is compared with known intrusion behavior data to assess its performance in different scenarios, including its ability to identify different types of intrusions, false alarm rate, and false negative rate. Furthermore, to fully understand the model's robustness and generalization ability, techniques such as cross-validation and confusion matrices can be introduced to comprehensively evaluate the impact of different detection metrics. Finally, through a comprehensive evaluation of the model's performance, a food processing intrusion detection report is generated.

[0086] Preferably, step S1 includes the following steps:

[0087] Step S11: Collect operation codes with a frequency greater than or equal to 200Hz and food processing parameters to generate PLC instruction data;

[0088] Step S12: Set up a 16-bit ADC-quantized temperature sensor to collect food processing temperature data;

[0089] Step S13: Set a vibration sensor with a sampling rate of 10kHz to collect triaxial acceleration waveform data of the components;

[0090] Step S14: Synchronize the PLC instruction data, food processing temperature data, and component triaxial acceleration waveform data according to 5ms time intervals to construct a spatiotemporally aligned data matrix;

[0091] Step S15: Use wavelet filtering to reduce the dimensionality of the spatiotemporally aligned data matrix to obtain a multimodal food processing dataset.

[0092] In this embodiment of the invention, the acquisition frequency of operation codes and food processing parameters is greater than or equal to 200Hz, aiming to acquire PLC (Programmable Logic Controller) instructions and related process data in real time. Operation code data typically includes control instructions and equipment status information, while food processing parameter data includes indicators such as temperature, pressure, and flow rate. High-frequency acquisition of this data ensures the capture of subtle operational changes, providing high-resolution data support for subsequent analysis. A 16-bit ADC (Analog-to-Digital Converter) is used to quantify the food processing temperature data acquired by the temperature sensor. The high resolution of the 16-bit ADC provides more accurate temperature change information, suitable for food processing processes with high temperature control accuracy requirements. The sensor's data acquisition ensures accurate recording of real-time temperature changes to support subsequent data analysis. Vibration sensor acquisition is also involved, with a sampling rate of 10kHz. This sensor is used to acquire triaxial acceleration waveform data of components, aiming to capture minute changes in the equipment's vibration state. Since vibration data typically contains rich frequency and amplitude information, the high sampling rate of 10kHz ensures the capture of high-frequency vibration characteristics, helping to accurately assess the equipment's operating status and potential failure risks. Key technical steps include data synchronization and spatiotemporal alignment. Since different sensors (operation codes, temperature, vibration) have different sampling frequencies, time alignment is required first. By synchronizing PLC instruction data, temperature data, and vibration data according to time windows of 5ms, the various data types can be aligned on the same time axis. This process is usually accomplished through interpolation or timestamp matching techniques to ensure that the various data types accurately correspond to the same moment. Wavelet filtering is then used to reduce the dimensionality of the spatiotemporally aligned data matrix. Wavelet transform can effectively extract important features from the data from multiple scales, removing high-frequency noise and redundant information.

[0093] Preferably, step S2, which involves constructing a food processing protocol network using a multimodal industrial dataset, includes the following:

[0094] The device node tag data is obtained by parsing the OPC-UA protocol fields from the PLC instruction data;

[0095] Extract communication frequency data from the triaxial acceleration waveform data of the components;

[0096] Based on the mapping of device node label data to low-dimensional vectors, we obtain the node low-dimensional vector data;

[0097] Initial edge weights are defined based on communication frequency data; network construction is performed on the low-dimensional vector data of nodes using the initial edge weights, and the graph structure is verified using the industrial protocol rule IEC 62443, thus obtaining the food processing protocol graph structure network.

[0098] In this embodiment of the invention, when parsing PLC instruction data, the PLC instruction fields are parsed using the OPC-UA (Open Platform Unified Communication Architecture) protocol. The main goal is to extract device node tag data from the OPC-UA protocol. OPC-UA is a standard protocol for communication between industrial automation devices. By parsing its fields, detailed information about the device can be obtained, such as device identification, status, and control commands. This process typically uses a specific protocol parsing library to extract key fields from the PLC control commands, thereby obtaining device node tag data. Communication frequency data is extracted based on the triaxial acceleration waveform data of the components. This process involves frequency domain analysis of the triaxial acceleration signals collected by vibration sensors, mainly using Fourier transform or other spectral analysis techniques to calculate the vibration frequency of the components. The communication frequency in the vibration data can reveal the frequency characteristics and dynamic changes during device operation, exhibiting high temporal sequence and correlation, which can provide a basis for assigning weights to edges in the subsequent network. After obtaining the device node tag data and communication frequency data, low-dimensional vector mapping of the nodes is performed. Specifically, the device node tag data is mapped to a low-dimensional vector space using embedding techniques (such as word embedding or graph-based embedding methods). This process can be achieved using classic embedding algorithms (such as PCA, t-SNE, or graph-based node embedding methods such as DeepWalk or Node2Vec) to compress the original high-dimensional node information into a low-dimensional vector, facilitating subsequent network construction and analysis. Then, initial edge weights are defined based on communication frequency data. In a network, edge weights typically reflect the strength of relationships or interaction frequency between nodes. By using the communication frequency between devices as edge weights, the degree of mutual influence between nodes can be represented. Devices with high communication frequencies have stronger interactions or a greater impact on system performance; therefore, their corresponding edge weights are larger. The network is then constructed using the defined initial edge weights and the low-dimensional node vector data. This step models the device nodes and their relationships as a graph structure using a graph neural network (GNN) or other graph-based construction methods. In the graph, nodes represent devices, and edges represent communication relationships or dependencies between devices. This graph structure can be used to capture information such as interactions between devices, data flow, and control command transmission. Finally, to ensure the rationality and security of the graph structure, the constructed network is validated using the industry protocol standard IEC 62443. IEC 62443 is a standard for the safety of industrial automation and control systems, which provides requirements for equipment communication, data protection and system security.

[0099] Preferably, step S2, which involves temporally encoding the food processing protocol network and injecting food processing physical constraints, includes the following:

[0100] The multimodal food processing dataset was divided into different granularities according to the sliding window length for data extraction, resulting in multi-scale time series hierarchical data. This multi-scale time series hierarchical data includes equipment-level granularity data, process-level granularity data, and production line-level granularity data; the division length is as follows:

[0101] When the sliding window is 10s, the instantaneous fluctuation characteristics of the valve switching frequency are extracted to obtain equipment-level granular data.

[0102] When the sliding window is 5 minutes, the data extracted is the synchronization data between the steam valve and the temperature sensor during the sterilization stage, which yields process-level particle size data.

[0103] When the sliding window is 1 hour, the extracted data are the energy consumption trend of motor current energy consumption and equipment degradation data, resulting in production line-level granular data.

[0104] Time-series coding is performed on multi-scale time-series hierarchical data to obtain multi-scale coded data;

[0105] Based on the multi-scale encoded data, a remote control system is used to apply binary mask hard constraints to obtain food processing time-constraint feature data.

[0106] In this embodiment of the invention, a sliding window method is used to extract data at different granularities for the partitioning of multimodal industrial datasets. The sliding window is a commonly used time-series data segmentation method. It extracts data features within a fixed-length window in the data stream by sliding it in steps. Specifically, when the sliding window length is set to 10 seconds, the instantaneous fluctuation characteristics of valve switching frequency are mainly extracted. By analyzing these high-frequency instantaneous changes, equipment-level granular data can be obtained, reflecting the rapid dynamic characteristics of individual devices. For a 5-minute window length, the synchronization data between the steam valve and temperature sensor during the sterilization stage is extracted, focusing on the time synchronization and parameter changes in the process, thereby generating process-level granular data to reveal key changes throughout the process. Finally, when the window length is 1 hour, the energy consumption trend of motor current and equipment degradation information are mainly extracted. This long-term data reflects the overall trend at the production line level and the long-term health status of the system, thus obtaining production line-level granular data. Then, after obtaining these multi-scale time-series data, multi-scale time-series encoding is performed. The purpose of time-series coding is to convert time-series data of different proportions into a format suitable for model processing. In multi-scale time-series coding, deep learning methods such as Convolutional Neural Networks (CNNs) or Recurrent Neural Networks (RNNs), especially Long Short-Term Memory Networks (LSTM), are typically used to capture the long-short-term dependencies in time series data. Multi-scale coding can simultaneously process data from different granularities, allowing the model to integrate equipment-level, process-level, and production-line-level information during processing, thereby obtaining a more comprehensive system performance. Finally, after time-series coding, physical constraints for food processing are injected. Physical constraint injection is a method of introducing domain knowledge into machine learning models. By combining known physical rules (such as the relationship between temperature, pressure, and equipment load) with time-series data, the model's understanding of the actual production process is enhanced. For example, temperature variation ranges can be adjusted through constraints, or outputs can be limited through equipment performance degradation models, thus obtaining time-series-constraint feature data for food processing.

[0107] Preferably, time-series coding based on multi-scale time-series hierarchical data includes the following:

[0108] The device-level granular data is subjected to millisecond-level fluctuations with a length of 3 and a stride of 1, and a first-order direct-connection device convolution kernel is constructed to obtain the ST-GCN device branch layer.

[0109] The process-level granular data is analyzed in a complete sub-process stage with a length of 15 and a step size of 5, and a global convolution kernel for the equipment group is constructed to obtain the ST-GCN sub-process branch layer.

[0110] The production line-level granular data is extracted daily at a length of 60 and a step size of 20, and a global system convolution kernel is constructed to obtain the ST-GCN global branch layer.

[0111] The ST-GCN equipment branch layer, ST-GCN sub-process branch layer, and ST-GCN global branch layer are fused using a gated cyclic unit formula, and then temporal coding is performed to obtain multi-scale coded data. The gated cyclic unit formula is as follows:

[0112] h t+1 =GRU(h t ST-GCN(A) t ,X t ));

[0113] Among them, h t+1 h represents the model's implicit memory at time step. t Indicates storing historical information; ST-GCN represents a spatiotemporal graph convolutional network; A t Let X represent the adjacency matrix. t This represents the node feature matrix.

[0114] In this embodiment of the invention, the core of the technical means lies in the use of a collaborative architecture of a multi-scale spatiotemporal graph convolutional network (ST-GCN) and a gated recurrent unit (GRU) to achieve hierarchical feature extraction and fusion of industrial multimodal data, from microscopic equipment-level instantaneous behavior to macroscopic production line-level long-term trends. Specifically, firstly, for equipment-level granular data (such as high-frequency sensor signals within a 10-second window), a spatiotemporal convolutional kernel with a length of 3 and a stride of 1 is used, combined with a first-order adjacency matrix (containing only the physical or control relationships of directly connected equipment), to construct an ST-GCN equipment branch layer, whose adjacency matrix A... t The node feature matrix X dynamically reflects the instantaneous interaction strength between devices (such as the direct coupling weight between valve switching signals and temperature sensors). tThis includes millisecond-level fluctuation features (such as rate of change and instantaneous extreme values), and short-time convolutional kernels are used to capture abnormal patterns such as equipment jitter and drift. For process-level granular data (such as equipment collaboration time series within a 5-minute window), a convolutional kernel with a length of 15 and a stride of 5 is used to cover the complete process sub-stage (such as the sterilization heating period). An ST-GCN sub-process branch layer is constructed based on the global adjacency matrix of the equipment group (defined by the process knowledge graph to define cross-equipment collaboration rules, such as the strong correlation weight between steam valves and temperature sensors). Its node feature matrix integrates the equipment group state correlation coefficient and phase synchronization index, and the spatial convolutional kernel enhances the modeling of cross-equipment collaboration relationships through high-order neighborhood aggregation. In production line-level granular data (such as energy consumption and degradation trends within a 1-hour window), a long-term convolutional kernel with a length of 60 and a stride of 20 is used, combined with a global adjacency matrix (constructed based on historical material flow and energy transfer ratios between subsystems). A graph attention mechanism is used to dynamically adjust the weights of production line subsystems (e.g., the priority of high-energy-consuming units in degradation modeling). The node feature matrix includes long-term indicators such as trend slope and degradation index. Subsequently, a gated recurrent unit (GRU) is used to perform cross-level fusion of multi-scale output features from equipment, sub-processes, and global branch layers. The hidden state h of the GRU... t As a temporal memory unit, it receives the spatiotemporal encoding result of the current STGCN branch at each time step, dynamically filters the correlation between historical states and current features through update and reset gates, and finally outputs the multidimensional fused feature h. t+1 This enables a comprehensive, joint characterization of instantaneous equipment anomalies, process coordination deviations, and production line health decline. During this process, the adjacency matrix A at each layer... t With node feature X t All strictly adhere to industrial physical constraints (such as equipment safety thresholds and process stage rules) to ensure consistency between feature generation and actual production logic, thereby providing a high-fidelity multimodal data foundation for subsequent intrusion detection and system optimization.

[0115] Of particular importance is that binary mask hard constraints are performed using a remote control system, including:

[0116] Generate mask constraint control commands based on the remote control system;

[0117] By using mask constraint control instructions to perform binary mask hard constraint filtering on multi-scale encoded data, illegal feature values ​​are forcibly discarded.

[0118] By forcibly discarding illegal feature values, soft-constraint gradient rules are constructed to obtain positive-constraint filtered data;

[0119] By enhancing the data with inverse physical knowledge based on the positive constraint filtering data, food processing time-constraint feature data is obtained.

[0120] In this embodiment of the invention, multi-scale encoded data is processed using binary masking. Specifically, based on the constraints of equipment operating states during food processing (such as valve status, temperature thresholds, current limits, etc.), a mask matrix corresponding to the time axis is constructed. Here, 1 represents a normal feature value conforming to the process logic, and 0 represents an illegal feature point that violates physical rules or the process flow. The mask is applied to the original encoded data, directly eliminating all illegal feature points corresponding to 0 through a bitwise AND operation, thus achieving hard constraint filtering and forming a data subset that forcibly discards illegal feature values. After hard constraint filtering, to avoid insufficient expressive power due to a sudden drop in feature dimensions, a soft constraint mechanism is further introduced. Based on the changing trends and gradient slopes of different feature dimensions in the retained data, a weighted gradient rule function is established to construct a positively oriented soft constraint filtering framework. This function is used to adjust the expression priority of the remaining features, enhance the expression density of key features such as temperature change rate, pressure response delay, and current fluctuation patterns, and weaken the participation weight of marginal or low-correlation features, forming a directional positive filtering feature set. Finally, based on the soft constraint results, reverse physics knowledge is integrated for temporal enhancement. This step uses reverse constraint logic between the physical states of food processing equipment (e.g., high heat flux density should not occur during cooling, pressure should remain stable during valve closure, and frequent speed jumps should not occur during stirring) to perform reverse scanning and condition retrieval of data through a set of logical rules, thereby generating reverse physical feature values ​​for enhancement and supplementing the dynamic details not covered in the forward encoding.

[0121] As an example of the present invention, reference is made to Figure 2 As shown, step S3 in this example includes:

[0122] Step S31: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system;

[0123] Step S32: Construct a perceptual intrusion detection model using food processing time-constraint feature data and weak nodes in the food processing system, and create adversarial example training data;

[0124] Step S33: Optimize the perceptual intrusion detection model using adversarial example training data, and incrementally update it using key nodes of the food processing system to obtain a remote intrusion detection model for food processing.

[0125] In this embodiment of the invention, key control points are extracted based on food processing time-constraint feature data. The core of the method lies in performing feature sensitivity analysis and mutation point detection on multi-dimensional time-series data. Specifically, methods based on gradient change, mutation rate determination, and mutual information entropy analysis are used to identify nodes where physical quantities change abruptly or control states change significantly during production. These nodes are defined as key control points in the food processing system. The identification of key control points depends on causal dependencies in the data, the coupling strength between equipment and process, and the historical operating state change trajectory, thereby obtaining a set of key nodes in the food processing system. Then, a perceptual intrusion detection model is constructed using the food processing time-constraint feature data. The construction process typically uses structures such as Graph Attention Network (GAT) or Variational Autoencoder (VAE) to fuse temporal dynamics and structured data, modeling multimodal data flow feature patterns under normal operating conditions, and using these patterns as a discrimination benchmark. During the model training phase, adversarial example training data is introduced. Pseudo-samples with slight perturbations but not significantly deviating from the true distribution are constructed using adversarial attack generation algorithms based on Projective Gradient Descent (PGD) or Fast Gradient Sign Method (FGSM). These adversarial examples, along with normal examples, form the training set to enhance the model's robustness and recognition ability against potential intrusions. Subsequently, the perceptual intrusion detection model is conditionally optimized using this adversarial example training data. An adversarial loss function and robustness regularization term are introduced during training to enhance the model's stability under abnormal inputs. Finally, the model requires incremental updates through key nodes in the food processing system. This involves continuously incorporating new key node data during actual operation to dynamically optimize the model's structure or parameters. Incremental updates typically employ online learning methods, such as recursive gradient descent algorithms or sliding window-based model weight redistribution strategies, ensuring the model remains sensitive to pattern drift and control strategy adjustments over long-term operation, ultimately forming a remote intrusion detection model for food processing.

[0126] Preferably, step S32 includes the following steps:

[0127] Step S321: Construct three-level feature curves for equipment, process, and production line based on the food processing time-constraint feature data;

[0128] Step S322: Perform weighted characteristic curve slope analysis on the three-level characteristic curves of equipment-process-production line, and construct a perception intrusion detection model;

[0129] Step S323: Obtain the training dataset; input the training dataset into the perceptual intrusion detection model to simulate white-box attacks, and perform temperature perturbation to obtain adversarial example training data.

[0130] In this embodiment of the invention, a three-level feature curve system for food processing time-constraint feature data is constructed. This system is based on time series data, extracting key variables at different spatial levels through hierarchical data dimensionality and performing curve modeling. Specifically, equipment-level feature curves are typically constructed based on high-frequency sampled actuator actions and local temperature or pressure response changes; process-level feature curves are constructed by calculating the parameter coupling degree between different process units, temperature control process response, and execution delay; and production line-level feature curves cover long-term energy consumption trends, quality fluctuations, and system stability indicators. The construction process uses a sliding window to extract key time series points and combines interpolation and smoothing techniques to uniformly align different dimensions, thereby ensuring the spatiotemporal comparability of data at each level. Next, a weighted feature curve slope analysis is performed on the above three-level feature curves to capture the rate of change of each feature curve under different operating conditions. Here, a linear regression sliding window method or first-order difference operation is typically used to extract local slope changes, and then different weight coefficients are assigned based on historical operating experience, so that features with drastic changes or sensitive responses receive higher modeling priority. This weighted slope analysis reveals the dynamic evolution of a food processing system under multi-level operating conditions and serves as input features to construct a perceptual intrusion detection model. This model is typically trained using lightweight neural networks or ensemble learning structures (such as random forests or gradient boosting trees) to learn the correlation between different slope change patterns and abnormal operating conditions, thereby developing the ability to perceive intrusions or abnormal behaviors. After model construction, the robustness of the model is improved by acquiring a training dataset and conducting white-box attack simulations. White-box attacks refer to attacks where the attacker has complete access to the model's structure and parameters, enabling them to generate adversarial examples based on gradient information. In this context, the Fast Gradient Sign Method (FGSM) or Projected Gradient Descent (PGD) is often used to slightly perturb the input data according to the loss function to interfere with the model's discrimination boundary. Furthermore, temperature perturbations are introduced during the attack process; that is, perturbation values ​​within the upper and lower limits of industrial operation are injected into temperature-controlled feature variables. This perturbation can be achieved by superimposing Gaussian distributed noise or fitting historical abnormal samples.

[0131] Of particular importance, step S33 includes the following steps:

[0132] Step S331: Use adversarial example training data to constrain the projection gradient descent parameters of the perceptual intrusion detection model to obtain a preliminary optimized intrusion detection model;

[0133] Step S332: Obtain the temperature-pressure correlation table; use the adversarial example training data to identify the sterilization valve state parameters of the preliminary intrusion optimization detection model, and use the temperature-pressure correlation table to perform loop verification to obtain the optimized parameters of the intrusion model;

[0134] Step S333: Incrementally update the preliminary intrusion optimization detection model using the intrusion model optimization parameters to obtain the remote intrusion detection model for food processing.

[0135] In this embodiment of the invention, a constrained Projected Gradient Descent (PGD) operation is performed on the perceptual intrusion detection model by introducing an adversarial example training dataset. This limits the perturbation amplitude in the model's parameter space to prevent feature generalization failure or increased false detection rate under attack samples. The PGD method restricts the weight adjustment amplitude in each parameter iteration, keeping the update direction within the original parameter neighborhood. This allows the model to stably output attack judgment probabilities even when facing adversarial perturbations, thus constructing a preliminary optimized intrusion detection model. Subsequently, a temperature-pressure correlation table is introduced as a physical rule mapping basis, and the preliminary model is validated and identified using the adversarial example training data. In specific implementation, the system uses the preliminary model to automatically identify the state parameters of the sterilization valve, extracting the valve opening and closing state sequence and its corresponding temperature response change data during sterilization. By matching and comparing this data with the temperature-pressure correlation table, parameter prediction segments that do not conform to physical laws are identified, such as abnormal behaviors like a continuous temperature rise when the valve is closed. These model output intervals that deviate from the process logic are then located. The system further constructs corrected gradients or error backpropagation quantities based on the degree of matching offset, generating intrusion model optimization parameters for fine-tuning the sensitive feature channels and classification boundaries of the model. Finally, using the intrusion model optimization parameters as incremental bases, these parameters are input into the initial intrusion optimization detection model. A finite-step incremental parameter update method is then used to complete the convergence adjustment of the remote detection model. This process maintains model structural stability, performing only local updates on the weight layers or feature transformation paths of the target neural channels, thereby enhancing the model's robustness and stability under the perturbation of actual physical characteristics in food processing. Ultimately, this results in a food processing remote intrusion detection model with constraint consistency and dynamic adaptability.

[0136] Preferably, step S4 includes the following steps:

[0137] Step S41: Construct food processing detection indicators based on the food processing remote control system;

[0138] Step S42: Obtain historical attack logs; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and historical attack logs to obtain multi-dimensional intrusion detection evaluation data;

[0139] Step S43: Generate a high-frequency attack profile based on multi-dimensional intrusion detection and assessment data to obtain a high-frequency attack profile for food processing; use the high-frequency attack profile for food processing to supplement system firewall vulnerabilities and generate a food processing intrusion detection report.

[0140] In this embodiment of the invention, the process of constructing multi-dimensional detection indicators for a remote intrusion detection model in food processing involves structurally expanding the model output, transforming it from a single classification or anomaly scoring dimension into a comprehensive indicator system reflecting detection performance, response path, attack behavior, and process impact. Common multi-dimensional indicators include model decision confidence distribution, detection latency, alarm frequency, alarm-to-device topology mapping distance, number of affected process nodes, anomaly duration, and false positive / false negative rate. The construction of these indicators relies on multi-angle comparative calculations of model prediction results and labels, combined with time-series sliding window statistics and event-level clustering analysis to generate multi-dimensional detection vectors. Obtaining historical attack logs and performing matching evaluation involves comparing the multi-dimensional detection indicators generated by the model under the current data with an archived attack event database. Historical attack logs contain tag information such as event occurrence time, attack source IP, attack strategy category, target device, operation path, and handling records. By constructing a multidimensional spatial distance metric function (such as Mahalanobis distance or cosine similarity), vectorized matching between model output metrics and label fields in logs can be achieved. This yields key evaluation data such as the spatiotemporal effectiveness, behavioral consistency, and cumulative effects of process influence in intrusion detection results, thus forming multidimensional intrusion detection evaluation data. This evaluation data not only provides a reference for model performance in actual attack scenarios but also provides label support for further attack pattern recognition. The process of generating high-frequency attack profiles using multidimensional evaluation data involves vector clustering, frequency statistics, and behavioral trajectory reconstruction of frequently occurring attack behavior patterns to ultimately generate high-frequency attack profiles. These profiles typically include information such as attacker operation path patterns, attack parameter perturbation directions, response process equipment sequences, impact duration distribution, and periodic trends in attack occurrence time. Their generation can employ clustering algorithms such as K-Means and DBSCAN to group attack events in the multidimensional feature space and use time series alignment techniques to structurally represent similar attack events. Finally, based on the generated high-frequency attack profile, the existing system firewall policy is supplemented with rules. Specifically, typical attack paths and parameter perturbation ranges are transformed into whitelist filtering conditions, intrusion behavior signatures, or boundary constraint rules and embedded into the firewall policy table. This operation generates an intrusion detection report for the food processing system. This report includes a review of model performance, reconstruction of high-frequency attack paths, policy enhancement suggestions, and corresponding data support items, achieving a data-driven closed-loop update of defense capabilities.

[0141] Preferably, the food processing detection indicators constructed in step S41 include the following:

[0142] Based on the remote control system for food processing, equipment-level instantaneous attack analysis was performed to obtain instantaneous attack analysis trends; key trends were marked on the instantaneous attack analysis trends, and instantaneous attack detection indicators were generated.

[0143] Extract temperature-pressure mismatch alarm latency data based on the food processing remote control system; perform data mapping on the temperature-pressure mismatch alarm latency data and calculate the average latency to obtain process-level collaborative detection indicators;

[0144] Data from the sterilization stage of the food processing remote control system is extracted to obtain food processing sterilization temperature data; based on the food processing sterilization temperature data, a complete sterilization rule test is performed to obtain the rule coverage test index.

[0145] In this embodiment of the invention, in the analysis of instantaneous attacks at the device level, time-series statistics and trend extraction are performed on the real-time judgment results output by the model. A sliding window technique is used to cluster and detect high-frequency anomalies in the detection results, identifying potential instantaneous attack peaks or abrupt anomalies. Subsequently, a time-series fitting curve is established by combining device operating status data such as current, voltage, and switching commands. Indicators such as the rate of change, duration, and number of affected devices in the trend abrupt changes are extracted to form a trend vector. Furthermore, a threshold judgment mechanism is set to highlight trend segments with significant fluctuations, and the characteristic values ​​in the marked segments, such as the maximum fluctuation rate, average fluctuation energy, and fluctuation duration, are used as instantaneous attack detection indicators for structured expression. At the process level, based on the collaborative logic between temperature and pressure sensors, response delay data for temperature-pressure mismatch alarms is extracted. Specifically, using the alarm trigger time as a reference, the time elapsed from the occurrence of a temperature deviation anomaly to the activation of the pressure response mechanism is calculated, forming a timestamp pair. By constructing a mapping function to normalize the time-consuming sequence to the standard process cycle scale, and statistically analyzing indicators such as average mismatch time, maximum delay, and variance across multiple process cycles, a collaborative detection index reflecting process synergy is formed. This type of data mapping can employ methods such as Z-score normalization or time-normalized linear mapping. In the rule integrity detection stage, using the sterilization stage data as the main thread, continuous data from the temperature sensor within this stage is extracted and compared with the pre-set sterilization curve rules for food processing. Rules may include a time-temperature window function structure that sets the temperature rise rate, stable duration, and cooling rate. By constructing a rule curve template and aligning it with real data using Dynamic Time Warping (DTW), features such as rule interval coverage, temperature offset rate, and continuous compliance rate can be calculated, thus obtaining the rule coverage detection index. Finally, the aforementioned instantaneous attack detection index, process-level collaborative detection index, and rule coverage detection index are vector-concatenated, and a weighted fusion mechanism is constructed. The weighting calculation method can adopt the entropy weighting method, the analytic hierarchy process (AHP) or the empirical distribution estimation method based on Bayesian updates. After projecting the three types of indicators onto a unified indicator space, they are weighted and summed to form a unified multi-dimensional detection indicator output, which provides a highly consistent and interpretable input structure for subsequent model evaluation and decision-making.

[0146] Preferably, step S42 includes the following steps:

[0147] Step S421: Obtain historical attack logs;

[0148] Step S422: Detect the gas processing remote intrusion detection model and historical attack logs according to the instantaneous attack detection index. When the identification rate of abnormal valve switching within 10 seconds is less than or equal to 75%, trigger an alarm and generate an instantaneous attack detection log.

[0149] Step S423: Calculate the average mismatch time using the food processing remote intrusion detection model and historical attack logs. If the average mismatch time is greater than or equal to the process-level collaborative detection index, trigger an alarm and generate a process-level collaborative detection log.

[0150] Step S424: Use the coverage detection index to detect the sterilization process rule coverage of the food processing remote intrusion detection model and historical attack logs. If the temperature rule coverage is less than 100%, trigger an alarm and generate a physical compliance detection log.

[0151] Step S425: Evaluate the intrusion detection results by combining the instantaneous attack detection logs, process-level collaborative detection logs, and physical compliance detection logs to obtain multi-dimensional intrusion detection evaluation data.

[0152] In this embodiment of the invention, historical attack logs are loaded, and the valve control signals involved are replayed in time sequence. These logs are mapped to a 10-second sliding window, and the event density, switching frequency, and duration of valve state changes within each window are extracted. The accuracy of these parameters is then compared with the real-time identification results of a remote intrusion detection model. When the model's accuracy in identifying abnormal switching events within a certain window is below 75%, it is considered a trigger condition for the lower limit of instantaneous attack detection capability. An instantaneous attack detection log is then generated in that window, recording key indicators such as model prediction results, actual labels, detection latency, and misidentification locations. In the process collaborative detection stage, the interaction timeline of temperature and pressure signals is extracted from the historical attack logs. Abnormal drift points in the temperature signal and their differences from the corresponding pressure response time are identified, and the mismatch time for each event is calculated. Subsequently, all mismatch times are weighted and averaged within the process interval, and the results are compared with a preset process-level collaborative detection index. When the average mismatch time is equal to or higher than this index, it indicates an abnormal lag in the process collaborative response, triggering a process-level alarm and generating a process-level collaborative detection log. The log contains core fields such as alarm number, mismatch event list, average mismatch time, process type, and work section number. In the physical compliance detection section, the temperature time series of the sterilization stage is normalized by calling coverage detection metrics. A sliding window matching and template comparison method is used to verify whether the temperature in historical data completely meets all stage rules of the sterilization curve, including heating rate, isothermal duration, and cooling integrity. When any stage coverage is incomplete or there are issues such as temperature drift, discontinuity, or abnormal rate deviation, it is marked as insufficient rule coverage, and a physical compliance detection log is generated. The log content includes the start and end times of the uncovered interval, the missing type, the rule offset value, and the coverage percentage. These three types of logs are integrated using a unified data structure standard to form multi-dimensional intrusion detection assessment data with unified timestamps, event types, related metrics, and model response data. This assessment data possesses structural characteristics of historical comparability, model verification, and metric linkage, serving as the foundational data carrier for subsequent high-frequency attack profiling and defense mechanism generation.

[0153] Therefore, the embodiments should be considered as exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of the equivalents of the application are intended to be included within the invention.

[0154] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features of the invention herein.

Claims

1. An intrusion detection method for a remote control system for food processing, characterized in that, Includes the following steps: Step S1: Deploy edge data acquisition nodes to synchronously collect PLC control commands and sensor data, and generate a multimodal food processing dataset; Step S2: Construct a food processing protocol network using a multimodal food processing dataset; perform temporal encoding on the food processing protocol network and inject food processing physical constraints to obtain temporal-constraint feature data of food processing; wherein, performing temporal encoding on the food processing protocol network and injecting food processing physical constraints includes: Data extraction was performed on a multimodal food processing dataset by dividing it into different granularities according to the sliding window length, resulting in multi-scale time-series hierarchical data. Time-series coding is performed on multi-scale time-series hierarchical data to obtain multi-scale coded data; Based on the multi-scale encoded data, a food processing remote control system is used to apply binary mask hard constraints to obtain food processing time-constraint feature data. Step S3: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system; construct a remote intrusion detection model for food processing using food processing time-constraint feature data and weak nodes in the food processing system; Step S4: Construct food processing detection indicators based on the food processing remote control system; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and obtain a food processing intrusion detection report.

2. The intrusion detection method for the food processing remote control system according to claim 1, characterized in that, Step S1 includes the following steps: Step S11: Collect operation codes with a frequency greater than or equal to 200Hz and food processing parameters to generate PLC instruction data; Step S12: Set up a 16-bit ADC-quantized temperature sensor to collect food processing temperature data; Step S13: Set a vibration sensor with a sampling rate of 10kHz to collect triaxial acceleration waveform data of the components; Step S14: Synchronize the PLC instruction data, food processing temperature data, and component triaxial acceleration waveform data according to 5ms time intervals to construct a spatiotemporally aligned data matrix; Step S15: Use wavelet filtering to reduce the dimensionality of the spatiotemporally aligned data matrix to obtain a multimodal food processing dataset.

3. The intrusion detection method for the food processing remote control system according to claim 1, characterized in that, Step S2, which involves constructing a food processing protocol network using a multimodal food processing dataset, includes: The device node tag data is obtained by parsing the OPC-UA protocol fields from the PLC instruction data; Extract communication frequency data from the triaxial acceleration waveform data of the components; Based on the mapping of device node label data to low-dimensional vectors, we obtain the node low-dimensional vector data; Initial edge weights are defined based on communication frequency data; network construction is performed on the low-dimensional vector data of nodes using the initial edge weights, and the graph structure is verified using the industrial protocol rule IEC 62443, thus obtaining the food processing protocol graph structure network.

4. The intrusion detection method for the food processing remote control system according to claim 1, characterized in that, Step S2 also includes: The multi-scale time-series hierarchical data includes equipment-level granularity data, process-level granularity data, and production line-level granularity data; the partition length is: When the sliding window is 10s, the instantaneous fluctuation characteristics of the valve switching frequency are extracted to obtain equipment-level granular data. When the sliding window is 5 minutes, the data extracted is the synchronization data between the steam valve and the temperature sensor during the sterilization stage, which yields process-level particle size data. When the sliding window is 1 hour, the extracted data are the energy consumption trend of motor current energy consumption and equipment degradation data, resulting in production line-level granular data.

5. The intrusion detection method for a food processing remote control system according to claim 4, characterized in that, Temporal coding based on multi-scale time series hierarchical data includes: The device-level granular data is subjected to millisecond-level fluctuations with a length of 3 and a stride of 1, and a first-order direct-connection device convolution kernel is constructed to obtain the ST-GCN device branch layer. The process-level granular data is analyzed in a complete sub-process stage with a length of 15 and a step size of 5, and a global convolution kernel for the equipment group is constructed to obtain the ST-GCN sub-process branch layer. The production line-level granular data is processed with a length of 60 and a stride of 20 to extract the daily degradation trend, and a global system convolution kernel is constructed to obtain the ST-GCN global branch layer. The ST-GCN equipment branch layer, ST-GCN sub-process branch layer, and ST-GCN global branch layer are fused using a gated cyclic unit formula, and then temporal coding is performed to obtain multi-scale coded data. The gated cyclic unit formula is as follows: in, This represents the model's implicit memory at each time step. ST-GCN stands for Spatiotemporal Graph Convolutional Network, indicating the storage of historical information. Represents the adjacency matrix. This represents the node feature matrix.

6. The intrusion detection method for the food processing remote control system according to claim 1, characterized in that, Step S3 includes the following steps: Step S31: Mark and extract system weak points based on food processing time-constraint feature data to obtain weak nodes in the food processing system; Step S32: Construct a perceptual intrusion detection model using food processing time-constraint feature data and weak nodes in the food processing system, and create adversarial example training data; Step S33: Optimize the perceptual intrusion detection model using adversarial example training data, and incrementally update it using key nodes of the food processing system to obtain a remote intrusion detection model for food processing.

7. The intrusion detection method for a food processing remote control system according to claim 6, characterized in that, Step S32 includes the following steps: Step S321: Construct three-level feature curves for equipment, process, and production line based on the food processing time-constraint feature data; Step S322: Perform weighted characteristic curve slope analysis on the three-level characteristic curves of equipment-process-production line, and construct a perception intrusion detection model; Step S323: Obtain the training dataset; input the training dataset into the perceptual intrusion detection model to simulate white-box attacks, and perform temperature perturbation to obtain adversarial example training data.

8. The intrusion detection method for a food processing remote control system according to claim 1, characterized in that, Step S4 includes the following steps: Step S41: Construct food processing detection indicators based on the food processing remote control system; Step S42: Obtain historical attack logs; use multi-dimensional detection indicators to perform intrusion detection on the food processing remote intrusion detection model and historical attack logs to obtain multi-dimensional intrusion detection evaluation data; Step S43: Generate a high-frequency attack profile based on multi-dimensional intrusion detection and assessment data to obtain a high-frequency attack profile for food processing; use the high-frequency attack profile for food processing to supplement system firewall vulnerabilities and generate a food processing intrusion detection report.

9. The intrusion detection method for a food processing remote control system according to claim 8, characterized in that, Step S41, which involves constructing food processing testing indicators, includes: Based on the remote control system for food processing, equipment-level instantaneous attack analysis was performed to obtain instantaneous attack analysis trends; key trends were marked on the instantaneous attack analysis trends, and instantaneous attack detection indicators were generated. Extract temperature-pressure mismatch alarm latency data based on the food processing remote control system; perform data mapping on the temperature-pressure mismatch alarm latency data and calculate the average latency to obtain process-level collaborative detection indicators; Data from the sterilization stage of the food processing remote control system is extracted to obtain food processing sterilization temperature data; based on the food processing sterilization temperature data, a complete sterilization rule test is performed to obtain the rule coverage test index.

10. The intrusion detection method for the food processing remote control system according to claim 8, characterized in that, Step S42 includes the following steps: Step S421: Obtain historical attack logs; Step S422: Detect the gas processing remote intrusion detection model and historical attack logs according to the instantaneous attack detection index. When the recognition rate of abnormal valve switching within 10 seconds is less than or equal to 75%, trigger an alarm and generate an instantaneous attack detection log. Step S423: Calculate the average mismatch time using the food processing remote intrusion detection model and historical attack logs. If the average mismatch time is greater than or equal to the process-level collaborative detection index, trigger an alarm and generate a process-level collaborative detection log. Step S424: Use the coverage detection index to detect the sterilization process rule coverage of the food processing remote intrusion detection model and historical attack logs. If the temperature rule coverage is less than 100%, trigger an alarm and generate a physical compliance detection log. Step S425: Evaluate the intrusion detection results by combining the instantaneous attack detection logs, process-level collaborative detection logs, and physical compliance detection logs to obtain multi-dimensional intrusion detection evaluation data.

Images