PLC anomaly detection method and system based on self-attention mechanism and OCNN

Abstract

The invention discloses a PLC anomaly detection method and system based on a self-attention mechanism and an OCNN, and relates to the technical field of industrial automation control, and the method comprises the steps: collecting PLC operation data through a Modbus communication protocol, carrying out the standardization processing, constructing a time sequence sample, constructing a feature extraction network based on the self-attention mechanism, and carrying out the detection of the PLC anomaly. Generating a query matrix, a key matrix and a value matrix through three linear transformation layers to perform global feature extraction, further performing local feature extraction, designing an improved OCNN detector, splicing global and local features through a special fusion layer, introducing residual connection, and calculating an abnormal score through an abnormal boundary learning layer; joint optimization of a feature extraction network and a detector is realized, a multi-task loss function is designed, and a two-stage training strategy is adopted for optimization; and finally, online anomaly detection is executed, real-time data preprocessing and feature extraction are carried out, multi-level early warning judgment is carried out, and an early warning information report containing processing suggestions is generated in combination with space-time correlation analysis.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial automation control, and particularly to a PLC anomaly detection method and system based on self-attention mechanism and OCNN. Background Art

[0002] Under the background of the rapid advancement of Industry 4.0 and intelligent manufacturing, the programmable logic controller, as the core component of the industrial control system, its operating stability directly affects the safety of critical infrastructure. Anomaly detection, as a key technology to ensure the reliability of PLC process control, has long relied on traditional unsupervised machine learning methods. However, with the increasing complexity of industrial systems, data presents characteristics such as multi-dimensionality, strong temporal correlation, and complex noise interference. Traditional methods gradually show limitations in feature representation ability and complex anomaly pattern recognition. Therefore, it is particularly important to invent a PLC anomaly detection method and system based on self-attention mechanism and OCNN.

[0003] The prior art also has the following defects, specifically reflected in: 1. The prior art uses a simple feedforward neural network for feature extraction. Limited by the local connection structure, it is difficult to establish long-range dependence relationships between different features, resulting in poor detection effects for complex anomaly patterns involving multiple feature interactions.

[0004] 2. In the prior art, the training objectives of the feature extraction network and the anomaly detection hyperplane are independent of each other. The extracted feature representations cannot be optimized for the anomaly detection task, reducing the accuracy of anomaly detection and having significant deficiencies in controlling the false alarm rate, posing a major safety hazard to time-sensitive operations.

[0005] 3. Due to the lack of in-depth understanding and modeling of the data structure in the prior art, it is easily affected by noise and interference in the data and is difficult to accurately distinguish real anomalies from background fluctuations. In the test sets of various attack types, it cannot meet the systematic security protection requirements, and the system is prone to misjudging normal state transitions as anomalies or missing malicious privilege escalation attacks as normal states. Summary of the Invention

[0006] The purpose of the present invention is to provide a PLC anomaly detection method and system based on self-attention mechanism and OCNN, which solves the problems existing in the background art.

[0007] To solve the above technical problems, the present invention adopts the following technical solutions: The present invention provides a PLC anomaly detection method based on self-attention mechanism and OCNN, including: Step 1: Data acquisition, collecting PLC operation data, including data sampling and normalization processing.

[0008] Step 2: Data preprocessing, constructing a feature extraction network based on self-attention mechanism, including a global feature extraction module and a local feature extraction module.

[0009] Step 3: Feature extraction. Design an improved OCNN detector, including a feature fusion layer and an abnormal boundary learning layer.

[0010] Step 4: Abnormal detection. Implement a joint optimization mechanism for the feature extraction network and the detector, including the design of a multi-task loss function and the formulation of a training strategy.

[0011] Step 5: Model optimization. Perform online abnormal detection, including real-time data processing, abnormal scoring, and early warning.

[0012] Preferably, the method for collecting PLC operation data is as follows: Step 1.1: Read data from the PLC memory address at a sampling period of 100 ms through the Modbus communication protocol, and record n input signals X = {x1, x2,..., x n}, m output signals Y = {y1, y2,..., y m}, and k timer states T = {t1, t2,..., t k}.

[0013] Step 1.2: Standardize each type of signal.

[0014] Step 1.3: Use a sliding window with a size of w = 32 and a step size of s = 16 to construct time series samples, and obtain a time series sample matrix D ∈ R N*w*c , where N is the number of samples and c is the feature dimension.

[0015] Preferably, the method for constructing a feature extraction network based on the self-attention mechanism is as follows:

[0016] Step 2.1: Global feature extraction. Generate a query matrix Q = XW q , a key matrix K = XW k , and a value matrix V = XW v through three linear transformation layers respectively, with dimensions all being (N, w, d), where W q , W k , W v are learnable weight matrices, d is the attention feature dimension, calculate the similarity between the query matrix and the key matrix, and the calculation formula is: Normalize the similarity matrix through the softmax function to obtain an attention weight matrix A, and obtain a global feature representation F global = AV.

[0017] Step 2.2: Local feature extraction. Use 1×1 convolution to perform channel fusion and dimensionality reduction on the input features to obtain intermediate features F1, and perform batch normalization and ReLU activation processing. Use 3×3 convolution to extract local spatio-temporal features to obtain F local , followed by batch normalization and ReLU activation processing.

[0018] Preferably, the implementation method of the improved OCNN detector is as follows: Step 3.1: Design a special fusion layer to splice the global feature F global and the local feature F local on the channel dimension to form a unified feature representation F, and use 1×1 convolution for feature transformation to obtain F conv , and introduce a residual connection mechanism F fused =LayerNorm(F conv +F) to maintain information flow, where LayerNorm is used to stabilize the training process.

[0019] Step 3.2: Design an abnormal boundary learning layer. Perform global average pooling on the fused features to obtain F pool , compress the temporal dimension information, and calculate the anomaly score through the learnable hyperplane parameters w and bias term b. The calculation formula is: score = w T ·F pool +b.

[0020] Preferably, the implementation method of the joint optimization mechanism of the feature extraction network and the detector is as follows: Step 4.1: Design a multi-task loss function. The loss includes anomaly detection loss, attention mechanism loss, and regularization loss. Among them, the anomaly detection loss L detection adopts a margin-based form max(0, ρ - score), and the attention mechanism loss L attention is based on the Frobenius norm ||A|| of the attention matrix F , and the regularization loss L regular imposes an L2 constraint on the network parameters. The total loss function is calculated as: L total =L detection +λ1·L attention +λ2·L regular , where λ1 and λ2 respectively represent the attention mechanism loss weight factor and regularization loss weight factor stored in the database.

[0021] Step 4.2: Implement the phased training strategy. Adopt a two-stage training strategy. In the first stage, fix the detector parameters and pre-train the feature extraction network for 10 epochs with a learning rate of 0.001. In the second stage, unfreeze all parameters, reduce the learning rate to 0.0001, and perform end-to-end joint optimization for 50 epochs. Use the Adam optimizer and introduce an early stopping mechanism.

[0022] Preferably, the online anomaly detection is performed, including preprocessing and feature extraction of real-time data, calculating the anomaly score; setting a dynamic warning threshold based on statistical features, calculating the anomaly confidence; performing multi-level warning determination, conducting spatio-temporal correlation analysis, and generating a warning information report. The specific implementation method is as follows: Step 5.1: Perform real-time anomaly detection, standardize the real-time data stream stream collected from the PLC, map the data to a unified scale using the statistics saved in the training stage, and extract features through the trained feature extraction network: F test = model.extract_features(stream norm ), and calculate the anomaly score: score = model.computer_score(F test ). Dynamically calculate the threshold threshold based on historical data, and finally obtain the anomaly score: anomaly score = |score - threshold|.

[0023] Step 5.2: Set the dynamic warning threshold based on statistics. According to the statistical features of historical anomaly scores, calculate the mean μ and standard deviation σ, and set three-level warning thresholds based on the 3σ criterion: LEVEL1 = μ + σ is defined as the minor anomaly threshold, LEVEL2 = μ + 2σ is defined as the medium anomaly threshold, and LEVEL3 = μ + 3σ is defined as the severe anomaly threshold.

[0024] Step 5.3: Calculate the anomaly confidence. Use an exponential decay function based on distance to calculate the confidence of the current anomaly score:

[0025] Step 5.4: Perform multi-level warning determination. When the anomaly score exceeds LEVEL3, trigger a red warning, indicating that there may be a major fault in the system; when the anomaly score is between LEVEL2 and LEVEL3, trigger an orange warning, indicating that key attention is required; when the anomaly score is between LEVEL1 and LEVEL2, trigger a yellow warning, indicating that it is recommended to check; if it is lower than LEVEL1, it is determined to be in a normal state.

[0026] Step 5.5: Relevance analysis. In the time dimension, check the consecutive warning situations in the historical warning records. When there are 3 or more consecutive warnings within the specified time window, upgrade the current warning level by one level. In the space dimension, identify other PLC signals related to the current abnormal signal. When multiple related signals are abnormal simultaneously, increase the confidence level of the current warning by a preset value.

[0027] Step 5.6: Warning information generation. Integrate information such as warning level, confidence level, timestamp, and abnormal status of related signals, and generate corresponding handling suggestions according to the warning level to form a complete warning information report. The report includes the severity of the abnormality, possible cause analysis, and recommended measures.

[0028] The second aspect of the present invention provides a system for executing a PLC anomaly detection method based on the self-attention mechanism and OCNN, including: a data acquisition module for collecting PLC operation data, including data sampling and normalization processing.

[0029] A data preprocessing module for constructing a feature extraction network based on the self-attention mechanism, including a global feature extraction module and a local feature extraction module.

[0030] A feature extraction module for designing an improved OCNN detector, including a feature fusion layer and an abnormal boundary learning layer.

[0031] An anomaly detection module for implementing a joint optimization mechanism of the feature extraction network and the detector, including the design of a multi-task loss function and the formulation of a training strategy;

[0032] A model optimization module for performing online anomaly detection, including real-time data processing, anomaly scoring, and warning.

[0033] The beneficial effects of the present invention are as follows: 1. By introducing a dual feature extraction structure of the self-attention mechanism and the local feature extraction network, the present invention significantly improves the ability to capture global correlation information in PLC data. The self-attention mechanism can adaptively learn the dependence relationships between different signals, solving the problem that traditional OCNN methods cannot effectively handle long-range dependencies; while the local feature extraction network supplements the extraction of local spatio-temporal features, enabling the model to comprehensively understand the operating state of the PLC system and improving the accuracy of anomaly detection.

[0034] 2. The present invention adopts a joint optimization mechanism of the feature extraction network and the anomaly detector to achieve the collaborative optimization of feature learning and anomaly detection. By designing a multi-task loss function, feature extraction, the attention mechanism, and abnormal boundary learning are unified under the same optimization objective, overcoming the problem of the separation of feature extraction and anomaly detection in traditional methods, improving the overall performance of the model, and enhancing the discriminative ability of feature representation.

[0035] 3. The present invention designs a statistics-based dynamic early warning mechanism, which improves the robustness and practicality of the model in complex industrial environments. Through the dynamic threshold setting based on the 3σ criterion and the spatio-temporal correlation analysis, it can effectively distinguish real anomalies from background fluctuations, significantly reducing the false alarm rate. At the same time, the multi-level early warning mechanism and confidence evaluation provide more detailed decision-making basis for operation and maintenance personnel, enhancing the operability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0037] Figure 1 It is a schematic flow chart of the implementation steps of the method of the present invention.

[0038] Figure 2 It is a schematic connection diagram of the system structure of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0039] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts belong to the scope of protection of the present invention.

[0040] Refer to Figure 1 As shown, the present invention provides a PLC anomaly detection method based on the self-attention mechanism and OCNN, including: Step 1: Data collection, collecting PLC operation data, including data sampling and normalization processing.

[0041] In a specific embodiment, the method for collecting PLC operation data is specifically implemented as follows: Step 1.1: Read data from the PLC memory address at a sampling period of 100 ms through the Modbus communication protocol, and record n input signals X = {x1, x2,..., x n}, m output signals Y = {y1, y2,..., y m}, and k timer states T = {t1, t2,..., t k}.

[0042] Step 1.2: Perform normalization processing on each type of signal.

[0043] Step 1.3: Construct temporal samples using a sliding window with size w = 32 and stride s = 16 to obtain a temporal sample matrix D ∈ R N*w*c , where N is the number of samples and c is the feature dimension.

[0044] It should be noted that the feature dimension c = the number of input signals n + the number of output signals m + the number of timer states k.

[0045] Step 2: Data preprocessing, construct a feature extraction network based on the self-attention mechanism, including a global feature extraction module and a local feature extraction module.

[0046] The present invention significantly improves the ability to capture global correlation information in PLC data by introducing a dual feature extraction structure of the self-attention mechanism and the local feature extraction network. The self-attention mechanism can adaptively learn the dependency relationships between different signals, solving the problem that traditional OCNN methods cannot effectively handle long-range dependencies; while the local feature extraction network complements the extraction of local spatio-temporal features, enabling the model to comprehensively understand the operating state of the PLC system and improving the accuracy of anomaly detection.

[0047] In a specific embodiment, the method for constructing the feature extraction network based on the self-attention mechanism is specifically implemented as follows:

[0048] Step 2.1: Global feature extraction, generate a query matrix Q = XW q , a key matrix K = XW k and a value matrix V = XW v , all with dimensions (N, w, d), where W q , W k , W v are learnable weight matrices, d is the attention feature dimension, calculate the similarity between the query matrix and the key matrix, and the calculation formula is: Normalize the similarity matrix through the softmax function to obtain the attention weight matrix A, and obtain the global feature representation F global = AV.

[0049] It should be noted that in the embodiment, d = 64, and a scaling factor is introduced to avoid the problem of gradient disappearance when the feature dimension is relatively high.

[0050] Step 2.2: Local feature extraction, use 1×1 convolution to perform channel fusion and dimensionality reduction on the input features to obtain intermediate features F1, and perform batch normalization and ReLU activation processing. Use 3×3 convolution to extract local spatio-temporal features to obtain F local , and perform batch normalization and ReLU activation processing. In this way, the spatio-temporal correlation features in the local area can be effectively captured.

[0051] Step 3: Feature extraction. Design an improved OCNN detector, including a feature fusion layer and an abnormal boundary learning layer.

[0052] The present invention adopts a joint optimization mechanism of a feature extraction network and an abnormal detector to achieve collaborative optimization of feature learning and abnormal detection. By designing a multi-task loss function, feature extraction, an attention mechanism, and abnormal boundary learning are unified under the same optimization objective, overcoming the problem of the separation of feature extraction and abnormal detection in traditional methods, improving the overall performance of the model, and enhancing the discriminative ability of feature representation.

[0053] In a specific embodiment, the method for specifically implementing the designed improved OCNN detector is as follows: Step 3.1: Design a special fusion layer to splice the global feature F global and the local feature F local on the channel dimension to form a unified feature representation F, and use a 1×1 convolution for feature transformation to obtain F conv , and introduce a residual connection mechanism F fused = LayerNorm(F conv + F) to maintain information flow, where LayerNorm is used to stabilize the training process.

[0054] Step 3.2: Design an abnormal boundary learning layer to perform global average pooling on the fused features to obtain F pool , compress the temporal dimension information, calculate the abnormal score through the learnable hyperplane parameters w and the bias term b, and the calculation formula is: score = w T ·F pool + b. This score characterizes the degree to which the sample deviates from the normal mode and provides a basis for subsequent abnormal detection.

[0055] Step 4: Abnormal detection. Implement a joint optimization mechanism of a feature extraction network and a detector, including the design of a multi-task loss function and the formulation of a training strategy.

[0056] The present invention designs a dynamic early warning mechanism based on statistics, improving the robustness and practicality of the model in a complex industrial environment. Through dynamic threshold setting based on the 3σ criterion and spatio-temporal correlation analysis, real abnormal conditions and background fluctuations can be effectively distinguished, significantly reducing the false alarm rate. At the same time, the multi-level early warning mechanism and confidence evaluation provide more detailed decision-making basis for operation and maintenance personnel, enhancing the operability of the system.

[0057] In a specific embodiment, the method for specifically implementing the joint optimization mechanism of a feature extraction network and a detector is as follows: Step 4.1: Design of a multi-task loss function. The loss includes an abnormal detection loss, an attention mechanism loss, and a regularization loss, where the abnormal detection loss Ldetection Adopt the margin-based form max(0, ρ - score), the attention mechanism loss L attention The Frobenius norm ||A|| of the attention matrix F , the regularization loss L regular Apply L2 constraints to the network parameters, and calculate the total loss function. The calculation formula is: L total = L detection + λ1·L attention + λ2·L regular , where λ1 and λ2 respectively represent the attention mechanism loss weight factor and the regularization loss weight factor stored in the database.

[0058] It should be noted that in the embodiment, λ1 = 0.1 and λ2 = 0.01, where ρ is the preset margin value.

[0059] Step 4.2: Implement the phased training strategy. Adopt a two-stage training strategy. In the first stage, fix the detector parameters and pre-train the feature extraction network for 10 epochs with a learning rate of 0.001. In the second stage, unfreeze all parameters, reduce the learning rate to 0.0001 for end-to-end joint optimization for 50 epochs, use the Adam optimizer and introduce an early stopping mechanism. Evaluate the model performance on the validation set and select the optimal model to ensure that the model has good generalization ability.

[0060] Step 5: Model optimization. Perform online anomaly detection, including real-time data processing, anomaly scoring, and early warning.

[0061] In a specific embodiment, the execution of online anomaly detection includes preprocessing and feature extraction of real-time data, calculating anomaly scores; setting dynamic early warning thresholds based on statistical features, calculating anomaly confidence levels; performing multi-level early warning determination, conducting spatio-temporal correlation analysis, and generating an early warning information report. The specific implementation method is: Step 5.1: Perform real-time anomaly detection. Standardize the real-time data stream stream collected from the PLC, map the data to a unified scale using the statistics saved in the training stage, and extract features through the trained feature extraction network: F test = model.extract_features(stream norm ), and calculate the anomaly score: score = model.computer_score(F test ), dynamically calculate the threshold threshold based on historical data, and finally obtain the anomaly score: anomaly score = |score - threshold|.

[0062] Step 5.2: Setting dynamic warning thresholds based on statistics. Calculate the mean μ and standard deviation σ according to the statistical characteristics of historical anomaly scores. Set three-level warning thresholds based on the 3σ criterion: LEVEL1 = μ + σ is defined as the minor anomaly threshold, LEVEL2 = μ + 2σ is defined as the medium anomaly threshold, and LEVEL3 = μ + 3σ is defined as the severe anomaly threshold.

[0063] Step 5.3: Calculating anomaly confidence. Use an exponential decay function based on distance to calculate the confidence of the current anomaly score: which is used to represent the reliability of anomaly judgment.

[0064] Step 5.4: Multi-level warning determination. When the anomaly score exceeds LEVEL3, trigger a red warning, indicating that there may be a major fault in the system; when the anomaly score is between LEVEL2 and LEVEL3, trigger an orange warning, indicating that key attention is required; when the anomaly score is between LEVEL1 and LEVEL2, trigger a yellow warning, indicating that inspection is recommended; if it is lower than LEVEL1, it is determined to be in a normal state.

[0065] Step 5.5: Correlation analysis. In the time dimension, check the continuous warning situation in the historical warning records. When there are 3 or more consecutive warnings within the specified time window, upgrade the current warning level by one level; in the space dimension, identify other PLC signals related to the current anomaly signal. When multiple related signals are abnormal simultaneously, increase the confidence of the current warning by a preset value.

[0066] It should be noted that the preset value is 20%.

[0067] Step 5.6: Generating warning information. Integrate information such as warning level, confidence, timestamp, and abnormal status of related signals, and generate corresponding handling suggestions according to the warning level to form a complete warning information report. The report includes the severity of the anomaly, possible cause analysis, and recommended measures to be taken.

[0068] Refer to Figure 2 As shown, the present invention provides a system for implementing a PLC anomaly detection method based on self-attention mechanism and OCNN, including: a data acquisition module for collecting PLC operation data, including data sampling and normalization processing.

[0069] A data preprocessing module for constructing a feature extraction network based on the self-attention mechanism, including a global feature extraction module and a local feature extraction module.

[0070] A feature extraction module for designing an improved OCNN detector, including a feature fusion layer and an anomaly boundary learning layer.

[0071] Anomaly detection module, which is used to implement the joint optimization mechanism of the feature extraction network and the detector, including the design of a multi-task loss function and the formulation of a training strategy;

[0072] Model optimization module, which is used to perform online anomaly detection, including real-time data processing, anomaly scoring, and early warning.

[0073] It should be noted that the data acquisition module is connected to the data preprocessing module, the data preprocessing module is connected to the feature extraction module, the feature extraction module is connected to the anomaly detection module, and the anomaly detection module is connected to the model optimization module.

[0074] It should be noted that in the present invention, (1) the self-attention mechanism can be replaced by a Transformer encoder.

[0075] (2) The local feature extractor can use recurrent neural networks such as LSTM.

[0076] (3) The joint optimization strategy can adopt the curriculum learning method.

[0077] The main devices and tools used in the present invention:

[0078] (1) PLC device: Aotuo Technology NJ600CPU601-0501.

[0079] (2) Communication module: An Ethernet module that supports the Modbus protocol.

[0080] (3) Computing platform: A workstation equipped with a GPU of NVIDIA GTX1080Ti or above.

[0081] (4) Development environment: Python3.7+ and PyTorch1.7+.

[0082] The above content is only an example and explanation of the concept of the present invention. Those skilled in the art of this technology can make various modifications or supplements to the specific embodiments described or use similar methods to replace them. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they should all fall within the protection scope of the present invention.

Claims

1. A PLC anomaly detection method based on self-attention mechanism and OCNN, characterized in that, Including: Step 1: Data acquisition, collecting PLC operation data, including data sampling and normalization processing; Step 2: Data preprocessing, constructing a feature extraction network based on the self-attention mechanism, including a global feature extraction module and a local feature extraction module; Step 3: Feature extraction, designing an improved OCNN detector, including a feature fusion layer and an abnormal boundary learning layer; Step 4: Anomaly detection, implementing a joint optimization mechanism for the feature extraction network and the detector, including the design of a multi-task loss function and the formulation of a training strategy; Step 5: Model optimization, performing online anomaly detection, including real-time data processing, anomaly scoring, and early warning.

2. The PLC anomaly detection method based on the self-attention mechanism and OCNN according to claim 1, wherein The specific implementation method of collecting PLC operation data is as follows: Step 1.1: Read data from the PLC memory address at a sampling period of 100 ms through the Modbus communication protocol, and record including n input signals X = {x1, x2,..., x n}, m output signals Y = {y1, y2,..., y m}, and k timer states T = {t1, t2,..., t k}; Step 1.2: Performing normalization processing on each type of signal; Step 1.3: Construct time series samples using a sliding window with size \(w = 32\) and stride \(s = 16\) to obtain a time series sample matrix \(D\in\mathbb{R}\) N*w*c , where \(N\) is the number of samples and \(c\) is the feature dimension.

3. The PLC anomaly detection method based on self-attention mechanism and OCNN according to claim 1, characterized in that, The specific implementation method of constructing a feature extraction network based on the self-attention mechanism is as follows: Step 2.1: Global feature extraction, generating query matrix Q = XW through three linear transformation layers q , key matrix K = XW k and value matrix V = XW v , with dimensions all being (N, w, d), where W q , W k , W v are learnable weight matrices, d is the attention feature dimension, calculating the similarity between the query matrix and the key matrix, and the calculation formula is: Normalize the similarity matrix through the softmax function to obtain the attention weight matrix A, and obtain the global feature representation F global = AV; Step 2.2: Local feature extraction. Use 1×1 convolution to perform channel fusion and dimensionality reduction on the input features to obtain intermediate feature F1, and perform batch normalization and ReLU activation processing. Use 3×3 convolution to extract local spatio-temporal features to obtain F local , and perform batch normalization and ReLU activation processing.

4. The PLC anomaly detection method based on self-attention mechanism and OCNN according to claim 1, characterized in that The specific implementation method of designing an improved OCNN detector is as follows: Step 3.1: Design a special fusion layer to fuse the global feature F global and the local feature F local by concatenating them along the channel dimension to form a unified feature representation F, and then performing feature transformation on F using 1×1 convolution to obtain F conv , and introducing a residual connection mechanism F fused = LayerNorm(F conv +F) to maintain information flow, where LayerNorm is used to stabilize the training process; Step 3.2: Design an outlier boundary learning layer, perform global average pooling on the fused features to obtain F pool , compress the temporal dimension information, calculate the outlier score through the learnable hyperplane parameters w and the bias term b, and the calculation formula is: score = w T ·F pool +b.

5. The PLC anomaly detection method based on the self-attention mechanism and OCNN according to claim 1, characterized in that, The specific implementation method of implementing the joint optimization mechanism for the feature extraction network and the detector is as follows: Step 4.1: Design of the multi-task loss function. The loss includes anomaly detection loss, attention mechanism loss, and regularization loss. Among them, the anomaly detection loss L detection adopts the margin-based form max(0, ρ - score), and the attention mechanism loss L attention is based on the Frobenius norm of the attention matrix ||A|| F , and the regularization loss L regular imposes L2 constraints on the network parameters. The total loss function is calculated, and the calculation formula is: L total = L detection + λ1·L attention + λ2·L regular , where λ1 and λ2 respectively represent the attention mechanism loss weight factor and the regularization loss weight factor stored in the database; Step 4.2: Implementing a phased training strategy, adopting a two-stage training strategy. In the first stage, fix the detector parameters and pre-train the feature extraction network for 10 epochs with a learning rate of 0.

001. In the second stage, unfreeze all parameters, reduce the learning rate to 0.0001 for end-to-end joint optimization for 50 epochs, use the Adam optimizer and introduce an early stopping mechanism.

6. The PLC anomaly detection method based on the self-attention mechanism and OCNN according to claim 1, characterized in that The execution of online anomaly detection includes preprocessing and feature extraction of real-time data, calculating anomaly scores; setting dynamic early warning thresholds based on statistical features, calculating anomaly confidence levels; performing multi-level early warning determination, conducting spatio-temporal correlation analysis, and generating an early warning information report. The specific implementation method is as follows: Step 5.1: Perform real-time anomaly detection, standardize the real-time data stream stream collected from the PLC, map the data to a unified scale using the statistics saved in the training phase, and extract features through the trained feature extraction network: F test = model.extract_features(stream norm ), and calculate the anomaly score: score = model.computer_score(F test ), dynamically calculate the threshold threshold based on historical data, and finally obtain the anomaly score: anomaly score = |score - threshold|; Step 5.2: Setting dynamic early warning thresholds based on statistics, calculating the mean μ and standard deviation σ according to the statistical features of historical anomaly scores, and setting three-level early warning thresholds based on the 3σ criterion: LEVEL1 = μ + σ is defined as the minor anomaly threshold, LEVEL2 = μ + 2σ is defined as the medium anomaly threshold, and LEVEL3 = μ + 3σ is defined as the severe anomaly threshold; Step 5.3: Abnormal confidence calculation. The confidence of the current abnormal score is calculated using an exponential decay function based on distance: Step 5.4: Multi-level early warning determination, when the anomaly score exceeds LEVEL3, trigger a red early warning, indicating that there may be a major fault in the system; when the anomaly score is between LEVEL2 and LEVEL3, trigger an orange early warning, indicating that key attention is needed; when the anomaly score is between LEVEL1 and LEVEL2, trigger a yellow early warning, indicating that it is recommended to check; if it is lower than LEVEL1, it is determined to be in a normal state; Step 5.5: Correlation analysis, in the time dimension, check the continuous early warning situation in the historical early warning records. When there are 3 or more consecutive early warnings within the specified time window, raise the current early warning level by one level; in the space dimension, identify other PLC signals related to the current abnormal signal. When multiple related signals are abnormal at the same time, increase the confidence level of the current early warning by a preset value; Step 5.6: Early warning information generation, integrating information such as early warning level, confidence level, timestamp, abnormal status of relevant signals, etc., and generating corresponding handling suggestions according to the early warning level to form a complete early warning information report, which includes the severity of the abnormality, possible cause analysis, and recommended measures to be taken.

7. A system for implementing the PLC anomaly detection method based on the self-attention mechanism and OCNN according to any one of claims 1 to 6, characterized in that, Including: Data acquisition module, used to collect PLC operation data, including data sampling and standardization processing; Data preprocessing module, used to construct a feature extraction network based on the self-attention mechanism, including a global feature extraction module and a local feature extraction module; Feature extraction module, used to design an improved OCNN detector, including a feature fusion layer and an abnormal boundary learning layer; Abnormal detection module, used to implement the joint optimization mechanism of the feature extraction network and the detector, including the design of a multi-task loss function and the formulation of a training strategy; Model optimization module, used to perform online abnormal detection, including real-time data processing, abnormal scoring, and early warning.

Images