A generative adversarial deduction method for security incidents in industrial production

Abstract

The embodiments of the present application relate to the technical field of security incident deduction, and in particular to a generative adversarial deduction method for security incidents in industrial production, including: determining the target device, constructing a deduction model based on a generative adversarial network that is adapted to the target device; obtaining the equipment fault tree and the personnel behavior decision tree and encoding them into a directed acyclic graph as a causal graph constraint of the deduction model; a physical generation engine generates physical parameters under extreme working conditions based on the causal graph constraint, and then a language behavior generation engine generates an operator behavior sequence based on the causal graph constraint; a multimodal discriminator performs data consistency verification based on a cross-modal attention mechanism, and approves the generation if it passes; iteratively training the deduction model, deploying the trained deduction model, synchronizing the real digital twin model of the target device to the deduction model, and obtaining the deduction results of security incidents within a preset future time output by the deduction model.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of security event deduction, and in particular to a generative adversarial deduction method for security events in industrial production. Background Art

[0002] In industrial production, the simulation and deduction of safety incidents are very important. Scientific simulation and prediction can enable safety management in industrial production to shift from "mending the fold after the sheep have been stolen" to "preparing for a rainy day", and predict which equipment is most likely to have problems at what time and in what links, so that weak points can be reinforced before accidents occur, high-risk operation plans can be adjusted, and signs of accidents can be nipped in the bud.

[0003] However, traditional safety incident simulation and deduction methods primarily rely on data augmentation methods, which rely on shallow transformations such as image rotation and noise addition. These methods struggle to generate physically plausible and logically coherent extreme risk scenarios (such as chain reactions caused by equipment aging and operational errors). Consequently, the trained deduction models lack the ability to generalize to complex and rare "black swan" events. Furthermore, traditional methods often focus on single-modal data and fail to dynamically couple multimodal information such as sensor time series data, operation log text, and surveillance video. This makes it difficult for deduction models to capture the synergistic patterns of cross-modal risk signals in complex accident chains. Furthermore, traditional deduction methods lack explicit modeling of causal relationships, often resulting in false scenarios that violate physical laws or standard operating procedures (e.g., exceeding pressure limits without triggering alarms). These inconsistencies directly undermine the reliability of the deduction models.

[0004] In summary, with the increasing complexity of industrial production, high-risk industries such as petrochemicals and nuclear power have increasingly stringent requirements for the accuracy of risk prediction. There is an urgent need to break through the technical bottlenecks of traditional technologies in physical simulation, multimodal generation, and causal reasoning, and build new solutions that can deduce the real risk evolution process. Summary of the Invention

[0005] In order to solve the above technical problems, the embodiments of the present application propose a generative adversarial deduction method for security incidents in industrial production, aiming to achieve closed-loop deduction of generation, verification, and optimization, ensure the logical self-consistency of the deduction process, and effectively improve the deduction capability of "black swan events", thereby formulating scientific and effective emergency plans, maximizing the protection of the lives of workers, and ensuring the continuous and stable operation of industrial production.

[0006] In order to achieve the above-mentioned purpose, an embodiment of the present application proposes a generative adversarial deduction method for security incidents in industrial production, the method comprising: determining a target device for which security incident deduction is required, constructing a deduction model based on a generative adversarial network adapted to the target device, the deduction model consisting of a dual-channel generator and a multimodal discriminator, the dual-channel generator consisting of a physical scene generation engine and a language behavior generation engine; obtaining a device fault tree of the target device and a personnel behavior decision tree corresponding to the device fault tree, encoding the device fault tree and the personnel behavior decision tree into a directed acyclic graph as a causal graph constraint of the deduction model; generating a target device at an extreme state based on the causal graph constraint by the physical generation engine. The physical parameters that follow the basic laws of physics under working conditions are used as the physical scene. The language behavior generation engine then uses the pre-trained language model based on the causal graph constraints to generate an operator behavior sequence that matches the physical scene and conforms to the standard operating process logic; the multimodal discriminator uses the cross-modal attention mechanism to verify the data consistency of the physical scene and the operator behavior sequence. If the verification is passed, the generation of the dual-channel generator is approved; the deduction model is iteratively trained until convergence, and the trained deduction model is deployed. The real digital twin model of the target device is synchronized with the deployed deduction model to obtain the deduction results of safety events within the preset future time output by the deduction model.

[0007] In order to achieve the above-mentioned purpose, the embodiment of the present application also proposes a generative adversarial deduction system for security incidents in industrial production, the system comprising: a target determination module for determining the target device for which security incident deduction is required; a model construction module for constructing a deduction model based on a generative adversarial network adapted to the target device, the constructed deduction model consisting of a dual-channel generator and a multimodal discriminator, the dual-channel generator consisting of a physical scene generation engine and a language behavior generation engine; a constraint generation module for obtaining the device fault tree of the target device and the personnel behavior decision tree corresponding to the device fault tree, encoding the obtained device fault tree and personnel behavior decision tree into a directed acyclic graph as a causal graph constraint of the constructed deduction model; a sample generation module for instructing the physical generation engine to generate a target device based on the causal graph constraint. The physical parameters that follow the basic laws of physics under extreme working conditions are used as the physical scene, and then the language behavior generation engine is instructed to use the pre-trained language model based on the causal graph constraints to generate an operator behavior sequence that matches the physical scene and conforms to the standard operating process logic. Finally, the multimodal discriminator is instructed to verify the data consistency of the physical scene and the operator behavior sequence based on the cross-modal attention mechanism. If the verification is passed, the generation of the dual-channel generator is approved; the training and deployment module is used to iteratively train the constructed deduction model until convergence, obtain the trained deduction model, and deploy the trained deduction model; the security event deduction execution module is used to synchronize the real digital twin model of the target device to the deployed deduction model, and obtain the deduction results of security events within the future preset time output by the deduction model.

[0008] In order to achieve the above-mentioned purpose, an embodiment of the present application also proposes an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a generative adversarial deduction method for security incidents for industrial production as described above.

[0009] In order to achieve the above-mentioned purpose, an embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a generative adversarial deduction method for security incidents for industrial production as described above.

[0010] This application proposes a generative adversarial deduction method for industrial production security incidents. In the face of the problem of insufficient data for "black swan events", this application constructs a deduction model consisting of a dual-channel generator and a multimodal discriminator based on a generative adversarial network. The physical scene generation engine in the dual-channel generator can well cover extreme scenarios, breaking through the limitation of traditional data enhancement that can only fine-tune the distribution of existing data. The physical scene generation engine and the language behavior generation engine work together so that the causal relationship between the generated physical scene and the operator's behavior sequence can be explicitly modeled. In order to improve the authenticity of security incident deduction, this application designs a causal graph constraint for the deduction model based on the device fault tree of the target device and the personnel behavior decision tree corresponding to the device fault tree. This makes the deduction of the deduction model have causal premises, rather than random and isolated deduction, and can avoid the deduction of obviously wrong and illogical results. After completing the training and deployment of the deduction model, the real digital twin model of the target device is synchronized with the deduction model to ensure that the deduction of the deduction model is aligned with the actual situation, thereby increasing the rationality of the deduction results. In summary, this application has effectively implemented closed-loop deduction of generation, verification, and optimization, ensuring the logical consistency of the deduction process of safety incidents, effectively improving the deduction capability of "black swan events", thereby facilitating staff to formulate scientific and effective emergency plans, maximizing the protection of staff life safety, and ensuring the continuous and stable operation of industrial production.

[0011] Optionally, a device fault tree of the target device and a personnel behavior decision tree corresponding to the device fault tree are obtained, and the device fault tree and the personnel behavior decision tree are encoded into a directed acyclic graph as a causal graph constraint of the deduction model, including: obtaining a device fault tree of the target device and a personnel behavior decision tree corresponding to the device fault tree, wherein the device fault tree records a number of possible faults of the target device, and the personnel behavior decision tree records a number of possible behavioral decisions that the technicians may make with respect to the target device; traversing each fault recorded in the device fault tree, matching the current fault with each behavioral decision recorded in the personnel behavior decision tree, thereby determining the causal relationship between each fault and each behavioral decision; adding mandatory constraints and prohibited constraints to the device fault tree and the personnel behavior decision tree, respectively, wherein the mandatory constraints are used to characterize that there is a necessary connection between two faults or two behavioral decisions, and the prohibited constraints are used to characterize that there should not be any connection between two faults or two behavioral decisions; based on the causal relationship between each fault and each behavioral decision, the device fault tree and the personnel behavior decision tree to which the mandatory constraints and prohibited constraints are added are linked to possible security incidents, and encoded into a directed acyclic graph as a causal graph constraint of the deduction model.

[0012] Optionally, the physical scene generated by the physical generation engine is recorded as , let the operator behavior sequence generated by the language behavior generation engine be , , , for The elements, for The elements, for The total number of elements in , The total number of elements in The total number of elements in is the same;

[0013] The multimodal discriminator verifies the data consistency of the physical scene and the operator's behavior sequence based on the cross-modal attention mechanism. If the verification passes, the generation of the dual-channel generator is approved, including:

[0014] Calculate the physical scene using the following formula Operator behavior sequence The consistency score between:

[0015] ;

[0016] ;

[0017] ;

[0018] ;

[0019] ;

[0020] ;

[0021] ;

[0022] ;

[0023] ;

[0024] in, is the calculated consistency score, represents the similarity attention score, represents the content attention score, represents the structural attention score, 、 、 They are 、 、 The corresponding balance weight, represents the cosine similarity score, represents the Euclidean distance similarity score, represents the Pearson correlation coefficient similarity score, 、 、 They are 、 、 The corresponding balance weight, express The mean of the elements in , express The mean of the elements in , represents a numerical feature extractor, Indicates word embedding, represents the graph attention network, represents a recursive attention network;

[0025] Determining whether the calculated consistency score is greater than a preset consistency score threshold;

[0026] If it is determined that the calculated consistency score is greater than the consistency score threshold, the generation of the dual-channel generator is approved, otherwise the generation of the dual-channel generator is rejected.

[0027] Optionally, the loss function used in iterative training of the inference model is expressed as follows:

[0028] ;

[0029] in, Represents the physical scene generation engine, represents the language behavior generation engine, represents the multimodal discriminator, Represents real data expectations, Represents real data The distribution of Represents the multimodal discriminator on real data The judgment results given are Indicates noise expectations, Represents noise The potential distribution of Indicates that the physical scene generation engine is based on noise Generated physical scene, Represents the multimodal discriminator pair The judgment results given are Indicates noise expectations, Represents noise The potential distribution of The language behavior generation engine is based on noise The generated operator behavior sequence, Represents the multimodal discriminator pair The judgment results given.

[0030] Optionally, when iteratively training the inference model, the multimodal discriminator also needs to calculate the risk severity score of the physical scenario generated by the physical scenario generation engine based on the causal graph constraints, and assign different dynamic weights in the loss function to different physical scenarios based on the calculated risk severity score, wherein the physical scenario with a higher risk severity score is assigned a greater dynamic weight.

[0031] Optionally, the real digital twin model of the target device is synchronized to the deployed deduction model to obtain the deduction results of security events within a preset future time output by the deduction model, including: digital twin modeling of the target device to obtain the real digital twin model of the target device, or directly calling the real digital twin model of the target device from the factory digital twin model corresponding to the factory where the target device is located; synchronizing the real digital twin model of the target device with the physical scene generation engine in the deduction model to ensure that the physical scene generated by the physical scene generation engine is aligned with the real digital twin model of the target device; starting the deduction model, performing security event deduction based on the real digital twin model of the target device, and obtaining the deduction results of security events within a preset future time output by the deduction model.

[0032] Optionally, after obtaining the deduction results of security events within a preset future time output by the deduction model, the method further includes: performing physical rationality verification, logical consistency verification and expert knowledge verification on the deduction results in sequence; if all three verifications are passed, targeted analysis of the deduction results is allowed; otherwise, the deduction model is used to re-deduct; wherein, the physical rationality verification is to reversely verify whether the deduction results comply with the law of conservation of energy, the law of conservation of mass, and the law of conservation of momentum through numerical simulation, the logical consistency verification is to check whether the deduction results comply with industry safety specifications based on a rule engine, and the expert knowledge verification is to allow industry experts to check whether there are logical errors in the visualized deduction results through an interactive interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the related technologies, the following is a brief introduction to the drawings required for use in the embodiments of the present application or the description of the related technologies. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0034] Figure 1This is a flowchart of a generative adversarial deduction method for security incidents in industrial production provided in one embodiment of the present application;

[0035] Figure 2 is a schematic structural diagram of a deduction model provided in one embodiment of the present application;

[0036] Figure 3 This is a schematic diagram of a physical scene generation engine dynamically calculating the relationship between leakage rate and pressure change when simulating leakage caused by corrosion in a chemical pipeline, provided in one embodiment of the present application;

[0037] Figure 4 An embodiment of the present application provides a directed acyclic graph obtained by encoding a device fault tree and a personnel behavior decision tree;

[0038] Figure 5 This is a schematic diagram of using a deduction model to perform security event deduction according to an embodiment of the present application;

[0039] Figure 6 This is a schematic diagram of the structure of a generative adversarial deduction system for security events in industrial production provided in another embodiment of the present application;

[0040] Figure 7 It is a structural diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, each embodiment of the present application will be described in detail below with reference to the accompanying drawings. However, it will be understood by those skilled in the art that in each embodiment of the present application, many technical details are proposed to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the present application can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present application. The various embodiments can be combined with each other and referenced to each other under the premise of no contradiction.

[0042] One embodiment of the present application proposes a generative adversarial deduction method for security incidents in industrial production, which is applied to an electronic device, where the electronic device can be a terminal or a server. This embodiment and the following embodiments are described using a server as an example. The following describes the implementation details of the generative adversarial deduction method for security incidents in industrial production proposed in this embodiment. The following content is only for the convenience of understanding the implementation details and is not required for the implementation of this solution.

[0043] The specific process of the generative adversarial deduction method for industrial production security events proposed in this embodiment can be as follows: Figure 1 Shown, including:

[0044] Step 101: Determine the target device for which security incident simulation is required, and construct a simulation model based on a generative adversarial network that is compatible with the target device. The simulation model consists of a dual-channel generator and a multimodal discriminator. The dual-channel generator consists of a physical scene generation engine and a language behavior generation engine.

[0045] In practice, the server first selects the target device for security event simulation. This target device can be a large, modular device, such as a cooling system, or a small, independent device, such as a chemical pipeline. Once the target device is selected, the server constructs a generative adversarial network-based simulation model tailored to the target device. This robust simulation model consists of a dual-channel generator, comprised of a physical scenario generation engine and a language behavior generation engine, and a multimodal discriminator.

[0046] In one example, the specific structure of the deduction model can be as follows Figure 2 As shown in the figure, the physical scene generation engine and the language behavior generation engine form a dual-channel generator. The physical scene generation engine is connected to the language behavior generation engine, and both generation engines are bidirectionally connected to the multimodal discriminator integrated with the cross-modal attention mechanism.

[0047] In one example, the physical scene generation engine is used to generate the physical scene, and the language behavior generation engine is used to generate the operator behavior sequence that matches the physical scene. In the case where the selected target device is a chemical pipeline, the physical scene generated by the physical scene generation engine can be as follows: Figure 3 shown.

[0048] In one example, the physical scene generated by the physical scene generation engine is essentially numerical modal, and the operator behavior sequence generated by the language behavior generation engine is textual modal. The multimodal discriminator needs to simultaneously discriminate the physical scene in numerical modality and the operator behavior sequence in textual modality, so it is "multimodal".

[0049] Step 102: Obtain a device fault tree of the target device and a human behavior decision tree corresponding to the device fault tree, and encode the device fault tree and the human behavior decision tree into a directed acyclic graph as a causal graph constraint of the deduction model.

[0050] In practice, the deduction model must simulate security incidents under certain constraints to ensure a scientific, reasonable, and logical process. The server must obtain the target device's device fault tree and the corresponding human behavior decision tree, encoding them into a directed acyclic graph (DAG), which then serves as the causal graph constraint for the deduction model.

[0051] In one example, when constructing a causal graph constraint, the server first needs to obtain the device fault tree of the target device and the personnel behavior decision tree corresponding to the device fault tree. The device fault tree records several possible faults of the target device, and the personnel behavior decision tree records several possible behavioral decisions that technicians may make for the target device.

[0052] Next, the server traverses the various faults recorded in the equipment fault tree and matches the current fault with the various behavioral decisions recorded in the personnel behavior decision tree, thereby determining the causal relationship between each fault and each behavioral decision.

[0053] Afterwards, the server adds mandatory constraints and prohibited constraints to the equipment fault tree and the personnel behavior decision tree respectively. The mandatory constraints are used to represent that there is a necessary connection between two faults or two behavior decisions, and the prohibited constraints are used to represent that there should be no connection between two faults or two behavior decisions.

[0054] For example, in the equipment fault tree, "pump failure → flow rate drop → reactant ratio imbalance → explosion" is a mandatory causal chain, which needs to be added to the equipment fault tree as a mandatory constraint. "Flow rate drop → reactant ratio normal" is a contradictory event that cannot occur, so it needs to be added to the equipment fault tree as a prohibited constraint.

[0055] Finally, based on the causal relationship between various faults and various behavioral decisions, the server needs to link the equipment fault tree and personnel behavior decision tree with mandatory and prohibited constraints with possible safety incidents and encode them into a directed acyclic graph as the causal graph constraint of the deduction model.

[0056] In an example, the directed acyclic graph obtained by encoding the equipment fault tree and personnel behavior decision tree based on the chemical pipeline can be as follows: Figure 4 shown.

[0057] In step 103, the physical generation engine generates the physical parameters of the target device under extreme working conditions that follow the basic laws of physics based on the causal graph constraints as a physical scenario. Then, the language behavior generation engine uses the pre-trained language model based on the causal graph constraints to generate an operator behavior sequence that matches the physical scenario and conforms to the standard operating process logic.

[0058] In the specific implementation, both the physical generation engine and the language behavior generation engine need to work under the constraints of the causal graph. Based on the causal graph constraints, the physical generation engine generates the physical parameters of the target equipment under extreme working conditions that follow the basic laws of physics as the physical scenario. The language behavior generation engine, based on the causal graph constraints, uses a pre-trained language model to generate an operator behavior sequence that matches the physical scenario and conforms to the standard operating process logic.

[0059] In one example, the target equipment is a chemical pipeline. The physical parameters generated by the physics generation engine include, but are not limited to, temperature, pressure, and vibration spectrum. These physical parameters must adhere to fundamental laws of physics, such as thermodynamics and fluid dynamics. The operator behavior sequences generated by the language behavior generation engine are stored as log text. For example, "The operator failed to close the valve in a timely manner" is an operator behavior.

[0060] In step 104, the multimodal discriminator verifies the data consistency of the physical scene and the operator's behavior sequence based on the cross-modal attention mechanism. If the verification is passed, the generation of the dual-channel generator is approved.

[0061] In the specific implementation, after the physical generation engine generates the physical scene and the language behavior generation engine generates the operator behavior sequence, the multimodal discriminator will start working. The multimodal discriminator verifies the data consistency of the physical scene and the operator behavior sequence based on the cross-modal attention mechanism. Only if the verification is passed can the generation of the dual-channel generator be approved. If the verification fails, the generation of the dual-channel generator will be rejected.

[0062] In one example, the target device is a reaction boiler. If the physical scene generated by the physical generation engine is "boiler explosion", then the operator behavior sequence generated by the language behavior generation engine must contain "safety valve failure" to meet data consistency. If "safety valve failure" does not exist in the operator behavior sequence, the multimodal discriminator will reject the generation of the dual-channel generator.

[0063] In an example, the physical scene generated by the physical generation engine is , let the operator behavior sequence generated by the language behavior generation engine be , , , for The elements, for The elements, for The total number of elements in , The total number of elements in The total number of elements in is the same. The multimodal discriminator is good at analyzing physical scenes. and operator behavior sequences When verifying data consistency, you need to use the following formula to calculate the physical scene Operator behavior sequence The consistency score between:

[0064] ;

[0065] ;

[0066] ;

[0067] ;

[0068] ;

[0069] ;

[0070] ;

[0071] ;

[0072] ;

[0073] in, is the calculated consistency score, represents the similarity attention score, represents the content attention score, represents the structural attention score, 、 、 They are 、 、 The corresponding balance weight, represents the cosine similarity score, represents the Euclidean distance similarity score, represents the Pearson correlation coefficient similarity score, 、 、 They are 、 、 The corresponding balance weight, express The mean of the elements in , express The mean of the elements in , represents a numerical feature extractor, Indicates word embedding, represents the graph attention network, represents a recursive attention network.

[0074] Next, the multimodal discriminator needs to judge the calculated physical scene Operator behavior sequence Whether the calculated consistency score is greater than a preset consistency score threshold. If it is determined that the calculated consistency score is greater than the preset consistency score threshold, the generation of the dual-channel generator is approved; otherwise, the generation of the dual-channel generator is rejected. The preset consistency score threshold can be set by those skilled in the art according to actual needs.

[0075] In one example, the loss function used in iterative training of the inference model is expressed as follows:

[0076] ;

[0077] in, Represents the physical scene generation engine, represents the language behavior generation engine, represents the multimodal discriminator, Represents real data expectations, Represents real data The distribution of Represents the multimodal discriminator on real data The judgment results given are Indicates noise expectations, Represents noise The potential distribution of Indicates that the physical scene generation engine is based on noise Generated physical scene, Represents the multimodal discriminator pair The judgment results given are Indicates noise expectations, Represents noise The potential distribution of The language behavior generation engine is based on noise The generated operator behavior sequence, Represents the multimodal discriminator pair The judgment results given.

[0078] In one example, when iteratively training the inference model, the multimodal discriminator also needs to calculate the risk severity score of the physical scenario generated by the physical scenario generation engine based on the causal graph constraints, and assign different dynamic weights to different physical scenarios in the loss function based on the calculated risk severity score. The higher the risk severity score, the greater the dynamic weight assigned to the physical scenario, and correspondingly, the lower the risk severity score, the smaller the dynamic weight assigned to the physical scenario. This can force the dual-channel generator to prioritize optimizing the generation quality of such samples.

[0079] In one example, the target equipment is a chemical pipeline. When the multimodal discriminator scores the risk severity of the physical scenario, it needs to consider the leakage volume, chain reaction level, etc. For physical scenarios with multiple levels of faults superimposed, a higher risk severity score needs to be assigned.

[0080] Step 105: Iteratively train the deduction model until convergence, deploy the trained deduction model, synchronize the real digital twin model of the target device to the deployed deduction model, and obtain the deduction results of security events within a preset future time output by the deduction model.

[0081] In the specific implementation, after the server builds the deduction model, it can start training the deduction model, iteratively train the deduction model until convergence, deploy the trained deduction model, and then synchronize the real digital twin model of the target device to the deployed deduction model to obtain the deduction results of security events within the future preset time output by the deduction model.

[0082] In one example, the process of the deduction model for security incident deduction is as follows: Figure 5 shown.

[0083] In one example, when using a deduction model to simulate a security incident, the server needs to create a digital twin of the target device to obtain a real digital twin model of the target device. Alternatively, the server can directly call (through an interface) the real digital twin model of the target device from the digital twin model of the factory where the target device is located. The real digital twin model of the target device is then synchronized with the physical scene generation engine in the deduction model to ensure that the physical scene generated by the physical scene generation engine aligns with the real digital twin model of the target device. Finally, the deduction model is activated to simulate a security incident based on the real digital twin model of the target device, and the deduction model outputs the security incident simulation results for a preset future time period.

[0084] In one example, the target equipment is a chemical pipeline. The real digital twin model of the chemical plant shows that the corrosion rate of the chemical pipeline is 0.1mm per year. The deduction model will simulate safety events in the next five years based on this physical parameter.

[0085] In one example, after obtaining the deduction results of security events within a preset future time output by the deduction model, the server also needs to perform physical rationality verification, logical consistency verification, and expert knowledge verification on the deduction results in sequence. If all three verifications are passed, targeted analysis of the deduction results is allowed. Otherwise, the deduction model is used to re-deduct. Among them, physical rationality verification is to reversely verify whether the deduction results comply with the law of conservation of energy, the law of conservation of mass, and the law of conservation of momentum through numerical simulation. Logical consistency verification is to check whether the deduction results comply with industry safety specifications based on the rule engine. Expert knowledge verification is to allow industry experts to check whether there are logical errors in the visualized deduction results through an interactive interface. The design of physical rationality verification, logical consistency verification, and expert knowledge verification can further enhance the credibility of the deduction results, thereby providing a solid data foundation for subsequent applications.

[0086] This embodiment proposes a generative adversarial deduction method for industrial production security incidents. In response to the problem of insufficient data for "black swan events", this application constructs a deduction model consisting of a dual-channel generator and a multimodal discriminator based on a generative adversarial network. The physical scene generation engine in the dual-channel generator can well cover extreme scenarios, breaking through the limitation of traditional data enhancement that can only fine-tune the distribution of existing data. The physical scene generation engine and the language behavior generation engine work together to enable the causal relationship between the generated physical scene and the operator behavior sequence to be explicitly modeled. In order to improve the authenticity of security incident deduction, this application designs a causal graph constraint for the deduction model based on the device fault tree of the target device and the human behavior decision tree corresponding to the device fault tree. This makes the deduction of the deduction model have causal premises, rather than random and isolated deduction, and can avoid the deduction of obviously wrong and illogical results. After the training and deployment of the deduction model are completed, the real digital twin model of the target device is synchronized with the deduction model to ensure that the deduction of the deduction model is aligned with the actual situation, thereby increasing the rationality of the deduction results. In summary, this application has effectively implemented closed-loop deduction of generation, verification, and optimization, ensuring the logical consistency of the deduction process of safety incidents, effectively improving the deduction capability of "black swan events", thereby facilitating staff to formulate scientific and effective emergency plans, maximizing the protection of staff life safety, and ensuring the continuous and stable operation of industrial production.

[0087] The steps of the various methods described above are divided for clarity of description only. During implementation, they can be combined into a single step, or some steps can be split into multiple steps. As long as they contain the same logical relationships, they are all within the scope of protection of this application. Adding minor modifications or introducing minor designs to the algorithm or process, but not changing the core design of the algorithm or process, are also within the scope of protection of this application.

[0088] Correspondingly, another embodiment of the present application proposes a generative adversarial deduction system for security incidents for industrial production. The details of the generative adversarial deduction system for security incidents for industrial production proposed in this embodiment are described in detail below. The following content is only the implementation details provided for easy understanding and is not necessary for implementing this example.

[0089] Figure 6 This is a structural diagram of a generative adversarial deduction system for security incidents in industrial production proposed in this embodiment, which specifically includes: a target determination module 201, a model construction module 202, a constraint generation module 203, a sample generation module 204, a training deployment module 205 and a security incident deduction execution module 206.

[0090] The target determination module 201 is used to determine the target device that needs to be deduced for security events.

[0091] The model building module 202 is used to build a deduction model based on a generative adversarial network that is adapted to the target device. The constructed deduction model consists of a dual-channel generator and a multimodal discriminator. The dual-channel generator consists of a physical scene generation engine and a language behavior generation engine.

[0092] The constraint generation module 203 is used to obtain the device fault tree of the target device and the human behavior decision tree corresponding to the device fault tree, and encode the obtained device fault tree and human behavior decision tree into a directed acyclic graph as the causal graph constraint of the constructed deduction model.

[0093] The sample generation module 204 is used to instruct the physical generation engine to generate physical parameters of the target device under extreme working conditions that follow the basic laws of physics based on the causal graph constraints as a physical scene, and then instruct the language behavior generation engine to use the pre-trained language model to generate an operator behavior sequence that matches the physical scene and conforms to the standard operating process logic based on the causal graph constraints. Finally, it instructs the multimodal discriminator to perform data consistency verification on the physical scene and the operator behavior sequence based on the cross-modal attention mechanism. If the verification is passed, the generation of the dual-channel generator is approved.

[0094] The training and deployment module 205 is used to iteratively train the constructed deduction model until convergence, obtain a trained deduction model, and deploy the trained deduction model.

[0095] The security event deduction execution module 206 is used to synchronize the real digital twin model of the target device to the deployed deduction model, and obtain the deduction results of security events within a preset future time output by the deduction model.

[0096] It is worth mentioning that all modules involved in this embodiment are logical modules. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, to highlight the innovation of this application, this embodiment does not include units that are not closely related to solving the technical problem proposed by this application. However, this does not mean that other units do not exist in this embodiment.

[0097] It is not difficult to find that this embodiment is a system embodiment corresponding to the above-mentioned method embodiment, and this embodiment can be implemented in conjunction with the above-mentioned method embodiment. The relevant technical details and technical effects mentioned in the above-mentioned method embodiment are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above-mentioned method embodiment.

[0098] Another embodiment of the present application provides an electronic device, the specific structure of which can be as follows: Figure 7 As shown, it includes: at least one processor 301; and a memory 302 communicatively connected to the at least one processor 301; wherein the memory 302 stores instructions that can be executed by the at least one processor 301, and the instructions are executed by the at least one processor 301 to enable the at least one processor 301 to execute a generative adversarial deduction method for security incidents for industrial production as described in the above method embodiment.

[0099] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and therefore will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0100] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0101] Another embodiment of the present application proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement a generative adversarial deduction method for security incidents for industrial production as described in the above method embodiment.

[0102] That is, those skilled in the art will understand that all or part of the steps in the above-described method embodiments can be implemented by instructing the relevant hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (such as a microcontroller or chip) or a processor to execute all or part of the steps of the generative adversarial deduction method for industrial security incidents described in the method embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0103] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and that in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A generative adversarial deduction method for security incidents in industrial production, characterized by: include: Identify the target devices for security incident simulations and build a generative adversarial network-based simulation model adapted to the target devices. The simulation model consists of a dual-channel generator and a multimodal discriminator. The dual-channel generator consists of a physical scene generation engine and a language behavior generation engine. Obtain the equipment fault tree of the target equipment and the personnel behavior decision tree corresponding to the equipment fault tree, and encode the equipment fault tree and the personnel behavior decision tree into a directed acyclic graph as the causal graph constraint of the deduction model; The physics generation engine generates physical parameters of the target equipment under extreme operating conditions that follow the laws of basic physics based on the causal graph constraints as physical scenarios. The language behavior generation engine then uses the causal graph constraints and pre-trained language models to generate operator behavior sequences that match the physical scenarios and conform to standard operating process logic. The multimodal discriminator verifies the data consistency of the physical scene and the operator's behavior sequence based on the cross-modal attention mechanism. If the verification passes, the generation of the dual-channel generator is approved; Iteratively train the deduction model until convergence, deploy the trained deduction model, synchronize the real digital twin model of the target device to the deployed deduction model, and obtain the deduction results of security events within a preset future time output by the deduction model.

2. A generative adversarial deduction method for security incidents in industrial production according to claim 1, characterized in that: Obtain the target device's equipment fault tree and the corresponding human behavior decision tree. Encode the equipment fault tree and human behavior decision tree into a directed acyclic graph as the causal graph constraint of the deduction model, including: Obtain a device fault tree for the target device and a human behavior decision tree corresponding to the device fault tree. The device fault tree records several possible faults of the target device, and the human behavior decision tree records several possible behavioral decisions that technicians may make regarding the target device. Traverse each fault recorded in the equipment fault tree and match the current fault with each behavioral decision recorded in the personnel behavior decision tree to determine the causal relationship between each fault and each behavioral decision; Add mandatory constraints and prohibited constraints to the equipment fault tree and the human behavior decision tree respectively. Mandatory constraints are used to indicate that there is a necessary connection between two faults or two behavior decisions, while prohibited constraints are used to indicate that there should be no connection between two faults or two behavior decisions. Based on the causal relationship between various faults and various behavioral decisions, the equipment fault tree and personnel behavior decision tree with mandatory and prohibited constraints are connected with possible safety incidents and encoded into a directed acyclic graph as the causal graph constraint of the deduction model.

3. The method for generating adversarial deduction of security events for industrial production according to claim 1 is characterized in that: The physical scene generated by the physical generation engine is recorded as , let the operator behavior sequence generated by the language behavior generation engine be , , , for The elements, for The elements, for The total number of elements in , The total number of elements in The total number of elements in is the same; The multimodal discriminator verifies the data consistency of the physical scene and the operator's behavior sequence based on the cross-modal attention mechanism. If the verification passes, the generation of the dual-channel generator is approved, including: Calculate the physical scene using the following formula Operator behavior sequence The consistency score between: ； ； ； ； ； ； ； ； ； in, is the calculated consistency score, represents the similarity attention score, represents the content attention score, represents the structural attention score, 、 、 They are 、 、 The corresponding balance weight, represents the cosine similarity score, represents the Euclidean distance similarity score, represents the Pearson correlation coefficient similarity score, 、 、 They are 、 、 The corresponding balance weight, express The mean of the elements in , express The mean of the elements in , represents a numerical feature extractor, Indicates word embedding, represents the graph attention network, represents a recursive attention network; Determining whether the calculated consistency score is greater than a preset consistency score threshold; If it is determined that the calculated consistency score is greater than the consistency score threshold, the generation of the dual-channel generator is approved, otherwise the generation of the dual-channel generator is rejected.

4. A generative adversarial deduction method for security incidents in industrial production according to claim 1, characterized in that: The loss function used in iterative training of the inference model is expressed as follows: ； in, Represents the physical scene generation engine, represents the language behavior generation engine, represents the multimodal discriminator, Represents real data expectations, Represents real data The distribution of Represents the multimodal discriminator on real data The judgment results given are Indicates noise expectations, Represents noise The potential distribution of Indicates that the physical scene generation engine is based on noise Generated physical scene, Represents the multimodal discriminator pair The judgment results given are Indicates noise expectations, Represents noise The potential distribution of The language behavior generation engine is based on noise The generated operator behavior sequence, Represents the multimodal discriminator pair The judgment results given.

5. A generative adversarial deduction method for security incidents in industrial production according to claim 4, characterized in that: When iteratively training the deduction model, the multimodal discriminator also needs to calculate the risk severity score of the physical scenario generated by the physical scenario generation engine based on the causal graph constraints, and assign different dynamic weights in the loss function to different physical scenarios based on the calculated risk severity score, where the physical scenario with a higher risk severity score is assigned a greater dynamic weight.

6. A generative adversarial deduction method for security incidents in industrial production according to any one of claims 1 to 5, characterized in that: Synchronize the real digital twin model of the target device to the deployed simulation model, and obtain the simulation results of security events within a preset future time output by the simulation model, including: Conduct digital twin modeling of the target device to obtain a true digital twin model of the target device, or directly call the true digital twin model of the target device from the factory digital twin model corresponding to the factory where the target device is located; Synchronize the real digital twin model of the target device with the physical scene generation engine in the deduction model to ensure that the physical scene generated by the physical scene generation engine is aligned with the real digital twin model of the target device; Start the deduction model, perform security event deduction based on the real digital twin model of the target device, and obtain the deduction results of security events within a preset future time output by the deduction model.

7. A generative adversarial deduction method for security incidents in industrial production according to any one of claims 1 to 5, characterized in that: After obtaining the deduction results of security events within a preset future time output by the deduction model, the method further includes: The deduction results are sequentially verified for physical rationality, logical consistency, and expert knowledge. If all three verifications are passed, targeted analysis of the deduction results is allowed. Otherwise, the deduction model is used to re-deduct. Among them, physical rationality verification is to reversely verify whether the deduction results comply with the law of conservation of energy, the law of conservation of mass, and the law of conservation of momentum through numerical simulation; logical consistency verification is to check whether the deduction results comply with industry safety regulations based on the rule engine; expert knowledge verification is to allow industry experts to check whether there are logical errors in the visualized deduction results through the interactive interface.

8. A generative adversarial deduction system for industrial production security incidents, characterized by: include: Target determination module, used to determine the target device for security event simulation; The model building module is used to build a generative adversarial network-based deduction model adapted to the target device. The constructed deduction model consists of a dual-channel generator and a multimodal discriminator. The dual-channel generator consists of a physical scene generation engine and a language behavior generation engine. A constraint generation module is used to obtain the device fault tree of the target device and the corresponding human behavior decision tree, and encode the obtained device fault tree and human behavior decision tree into a directed acyclic graph as the causal graph constraint of the constructed deduction model; The sample generation module is used to instruct the physical generation engine to generate physical parameters of the target device under extreme working conditions that follow the laws of basic physics based on the causal graph constraints as a physical scenario. It then instructs the language behavior generation engine to use the pre-trained language model based on the causal graph constraints to generate operator behavior sequences that match the physical scenario and conform to the standard operating process logic. Finally, it instructs the multimodal discriminator to verify the data consistency of the physical scenario and the operator behavior sequence based on the cross-modal attention mechanism. If the verification passes, the generation of the dual-channel generator is approved. The training and deployment module is used to iteratively train the constructed deduction model until convergence, obtain the trained deduction model, and deploy the trained deduction model; The security incident simulation execution module is used to synchronize the real digital twin model of the target device with the deployed simulation model, and obtain the simulation results of security incidents within a preset future time output by the simulation model.

9. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; In which, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a generative adversarial deduction method for security incidents for industrial production as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement a generative adversarial deduction method for security incidents for industrial production as described in any one of claims 1 to 7.

Images