Industrial process security anomaly analysis method and system based on GATRank score

Abstract

The invention provides an industrial process security anomaly analysis method and system based on GATRank scoring, and relates to the technical field of industrial control. According to the method and system, firstly, an initial abnormal score of a single node in the industrial control system is calculated; constructing a graph structure for each automatic element in the industrial control system; then initializing a GATRank value of the industrial control system by adopting the initial abnormal score of the single node; calculating a GATRank value of the industrial control system by using a transition probability matrix in combination with a graph attention mechanism; and finally, judging the convergence of the GATRank value of each node of the industrial control system, and if the GATRank value of each node is converged, taking the GATRank value of each node as a final anomaly score of each node to guide an operator to check a security anomaly root. Otherwise, recalculating the transition probability matrix, and calculating the GATRank value of each node of the industrial control system. According to the method, the capability of finding an abnormal root is higher than that of other reconstruction models.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technologies, and particularly to a method and system for industrial process safety anomaly analysis based on GATRank scoring. Background Art

[0002] The deep integration of industrial control systems and network technologies has greatly improved the automation level and efficiency of industrial production. By introducing advanced technologies such as the Internet of Things, big data analysis, and artificial intelligence, the production process has become more precise and efficient. However, with the popularization and application of industrial Internet platforms, the openness and interconnectivity of enterprise networks have been continuously enhanced, which makes industrial control systems face more and more network security threats.

[0003] With the emergence of artificial intelligence, various anomaly detection methods based on deep learning have emerged in an endless stream. However, most of the current anomaly handling methods have a common problem, that is, they focus on anomaly detection and rarely conduct further analysis of anomalies. And common anomaly analysis methods mainly focus on single-point anomalies, paying insufficient attention to the overall context and mutual relevance of anomalies, resulting in poor effects and being difficult to guide the investigation of anomalies.

[0004] The paper "Liu Y, Li Z, Zhou C, et al. Generative adversarial active learning for unsupervised outlier detection[J]. IEEE Transactions on Knowledge and Data Engineering, 2019, 32(8): 1517-1528." uses an error-based node anomaly scoring method to identify anomalies by establishing a model of normal data patterns. If a data is significantly different from the pattern predicted or reconstructed by the model, then it is very likely to be an outlier. Select the K nodes with the largest error anomaly scores as the root causes of the anomalies. This method is intuitive and easy to understand. Although this method can define anomaly scores based on the difference between the actual observed values of the data and the model predicted values, it has no way to quantitatively judge the uncertainty of the anomalies.

[0005] The paper "Su Y, Zhao Y, Niu C, et al. Robust anomaly detection formultivariate time series through stochastic recurrent neural network[C].Proceedings of the 25th ACM SIGKDD international conference on knowledgediscovery&data mining. 2019: 2828-2837." uses a probability-based node anomaly scoring method. If the probability of a data point is high, it means it is consistent with the normal data pattern, so it is likely to belong to the normal category. On the contrary, if the probability of a data point is low, it indicates that it is inconsistent with the normal data pattern, so it is likely to be an abnormal or deviated data point. Select the K nodes with the smallest probability anomaly scores as the root causes of the anomaly. This method can provide the probability or confidence of the anomaly occurrence and better quantify it. Although this method can better quantify the uncertainty of the anomaly, the calculation process is relatively complex.

[0006] Although the above anomaly analysis methods have preliminarily explained the anomalies to some extent, many methods mainly focus on single-point anomalies and ignore the overall context and mutual relevance of the anomalies. This leads to limitations in the analysis results and makes it difficult to help operators accurately locate the root causes of the anomalies. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to provide an industrial process safety anomaly analysis method and system based on GATRank scoring in view of the deficiencies of the above-mentioned prior art. By calculating the possibility scores of each node being the root cause of the anomaly and arranging the nodes in descending order of the scores, it provides a priority guidance for operators to investigate the root causes of safety anomalies.

[0008] To solve the above technical problems, the technical solutions adopted by the present invention are as follows: On the one hand, the present invention provides an industrial process safety anomaly analysis method based on GATRank scoring, including: Calculating the initial anomaly score of a single node in the industrial control system; Constructing a graph structure for each automation component in the industrial control system and saving the spatial relationships between all components; Initializing the GATRank value of the industrial control system with the initial anomaly score of a single node; Calculating the GATRank value of the industrial control system using the transition probability matrix combined with the graph attention mechanism; Judge the convergence of the GATRank values of each node in the industrial control system. If it converges, use the GATRank value of the node as the final anomaly score of the node to guide the operator to investigate the root cause of the security anomaly; otherwise, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

[0009] Furthermore, the method for calculating the initial security anomaly score of a single node in the industrial control system is as follows: Calculate the initial anomaly score of a single node by combining the predicted value and the reconstruction probability of the single node. The specific steps are as follows: At each time point, calculate the initial anomaly score of a single node by combining the predicted value and the reconstruction probability of the node, as shown in the following formula: ; Where, is the initial anomaly score of node at time , δ is a hyperparameter used to balance prediction and loss, is the reconstruction probability of the th node at time , is the predicted value of the short-term prediction of the th node at time , ; Where, is the single-point predicted value of node , is the predicted value of the time period of node ; Perform robust normalization on the initial anomaly score of each node, as shown in the following formula: ; Where, is the value after robust normalization, and are the median and interquartile range of the anomaly score of node at time

[0010] Furthermore, the method for constructing a graph structure for each automation component in the industrial control system is as follows: Define a binary tuple A = ( c , r ) for each automation component in the industrial control system, where cRepresents the type of automation component, which can take the value of 0 or 1. A value of 0 represents a sensor, and a value of 1 represents an actuator respectively; r Represents the sub - process label of the sub - process to which the automation component belongs in the whole process; a graph structure is constructed through this binary tuple to save the spatial relationship between all components, and the adjacency matrix is used to save the graph structure; The Pearson correlation coefficient and transfer entropy are used to correct the spatial relationship between the constructed components; when the Pearson correlation coefficient and transfer entropy meet the set conditions, the corresponding edges are retained.

[0011] Furthermore, the method takes the initial anomaly score after robust normalization of a single node in the industrial control system as the initial GATRank value of the industrial control system.

[0012] Furthermore, the method of calculating the GATRank value of the industrial control system using the transition probability matrix combined with the graph attention mechanism is as follows: The GAT is used to learn the attention coefficient as the transition probability; in order to make the sum of probabilities of each column of the transition matrix equal to 1, the attention coefficient needs to be normalized, and the processing formula is as follows: ; Among them, represents the node in the industrial control system to node the transition probability of, represents starting from node the set of all reachable nodes, represents the average value of the attention coefficients calculated by multiple attention heads ; The normalized attention coefficient is used as the weight to obtain the transition probability matrix ; The Teleportation mechanism is introduced. If a node has no out - degree, the same probability is assigned to each other node, and the transition probability matrix is shown in the following formula: ; Among them, is the matrix with all elements in the th row equal to 1 is the transpose of; Furthermore, the GATRank value of the industrial control system is obtained, as shown in the following formula: ; Among them, is the GATRank value of node i ;

[0013] Further, the method also normalizes the GATRank values of all nodes in the industrial control system to obtain normalized GATRank values, and then judges the convergence of the GATRank values.

[0014] Further, when the GATRank values of each node in the industrial control system do not converge, the transition probability matrix is recalculated while keeping the graph structure and initial scores formed by each automation component unchanged, and the GATRank value of each node in the industrial control system is calculated.

[0015] On the other hand, an industrial process safety anomaly analysis system based on GATRank scoring includes: Initial anomaly score calculation module: calculating the initial anomaly score of a single node in the industrial control system; Graph structure construction module: constructing a graph structure for each automation component in the industrial control system and saving the spatial relationship between all components; GATRank value initialization module: initializing the GATRank value of the industrial control system with the initial anomaly score of a single node; GATRank value calculation module: calculating the GATRank value of the industrial control system by using the transition probability matrix in combination with the graph attention mechanism; Anomaly score calculation module: judging the convergence of the GATRank values of each node in the industrial control system. If it converges, the GATRank value of the node is used as the final anomaly score of the node. Otherwise, the transition probability matrix is recalculated, and the GATRank value of each node in the industrial control system is calculated.

[0016] In a third aspect, the present application proposes an electronic device, including: one or more processors, and a memory for storing instructions, which when executed by the one or more processors, cause the one or more processors to execute the industrial process safety anomaly analysis method based on GATRank scoring.

[0017] In a fourth aspect, the present application proposes a computer-readable storage medium storing executable instructions, which when executed cause a processor to execute the industrial process safety anomaly analysis method based on GATRank scoring.

[0018] The beneficial effects of adopting the above technical solutions are as follows: An industrial process safety anomaly analysis method based on GATRank scoring provided by the present invention: (1) Integrate prediction error and reconstruction probability to perform initial safety anomaly scoring on individual nodes in the industrial control system, and perform robust normalization to avoid extreme value interference, comprehensively considering time series prediction and data distribution characteristics, and enhancing the robustness of safety anomaly scoring. (2) Score node anomalies through the fusion of GAT and PageRank, enabling the analysis to not only depend on the specific characteristics and context of the nodes, but also combine global link information, providing a more comprehensive network analysis. By combining the local feature extraction ability of the graph attention network (GAT) and the global structure analysis ability of the PageRank algorithm, overcome the limitations of a single method, make full use of local and global information, thereby improving the accuracy and robustness of the importance of nodes in the graph. Compared with the traditional PageRank that assigns the same probability weight to each arriving node, GATRank uses the attention coefficients learned by GAT as edge weights, which can better explain the behavior and state of nodes in the graph. (3) Assign uniform transition probabilities to nodes with no out-degree through the Teleportation mechanism, enhancing the stability of the method in complex scenarios such as single-point attack (SSSP), multi-point attack (SSMP / MSMP), etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 FIG. 6 is a flowchart of an industrial process safety anomaly analysis method based on GATRank scoring provided by Embodiment 1 of the present invention; Figure 2 FIG. 9 is a schematic diagram of the transition probabilities of four nodes in the industrial control system provided by Embodiment 1 of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] The following will further describe in detail the specific embodiments of the present invention with reference to the drawings and embodiments. The following embodiments are used to illustrate the present invention, but are not used to limit the scope of the present invention.

[0021] Embodiment 1: In this embodiment, an industrial process safety anomaly analysis method based on GATRank scoring, as Figure 1 shown, includes the following steps: Step 1: Calculate the initial anomaly score of an individual node in the industrial control system; Combine the predicted value and reconstruction probability of an individual node to calculate the initial anomaly score of the individual node. The specific steps are as follows: At each time point, combine the predicted value and reconstruction probability of the node to calculate the initial anomaly score of the individual node, as shown in the following formula: ; where is the node at The initial anomaly score, where δ is a hyperparameter used to balance prediction and loss, is the reconstruction probability of the -th node at time is the predicted value of the -th node for short-term prediction at time represents the average of the predicted values of short-term and long-term predictions for the -th node at time , as shown in the following formula: ; where is the single-point predicted value of node , is the predicted value of node for the time period prediction; Robust normalization is performed on the initial anomaly score of each node, as shown in the following formula: ; where is the value after robust normalization, and are respectively the median and interquartile range of the anomaly score of node at time, and these two values are set to change dynamically.

[0022] Step 2: Construct a graph structure for each automation component in the industrial control system to save the spatial relationship between all components; Define a binary tuple A = ( c , r ) for each automation component in the industrial control system, where c represents the type of the automation component, which can take 0 or 1. A value of 0 represents a sensor, and a value of 1 represents an actuator respectively; r represents the sub-process label of the sub-process to which the automation component belongs; construct a graph structure through this binary tuple to save the spatial relationship between all components, and use an adjacency matrix to save the graph structure; Use the Pearson correlation coefficient and transfer entropy to correct the spatial relationship between the constructed components; when the Pearson correlation coefficient and transfer entropy meet the conditions, retain the corresponding edge, and the judgment formula is as follows: , ; where X and Y are two different components in the industrial control system used to construct the edge of the graph structure; is the component X andY The Pearson correlation coefficient, used to measure X and Y the strength and direction of the linear correlation between is the transfer entropy of components X and Y ; , are the thresholds of the Pearson correlation coefficient and transfer entropy respectively; when components X and Y meet the conditions, the edge between components X and Y is retained; Step 3: Initialize the GATRank value of the industrial control system, and score node anomalies through the fusion of GAT and PageRank; take the initial anomaly score after robust normalization of a single node in the industrial control system as the initial GATRank value of the industrial control system, denoted as , where n is the number of nodes in the industrial control system, is the t-th moment, and n is the initial GATRank value of the th node; The traditional transition probability matrix assigns the same weight probability to all reachable nodes of a departure node. Taking Figure 2 as an example, its transition probability matrix can be defined by the following formula: ; The element in the th row and th column of the matrix represents the transition probability from the node to the node; In the present invention, GAT (Graph Attention Networks, i.e., graph attention model) is used to learn the attention coefficient as the transition probability; in order to make the sum of probabilities of each column of the transition probability matrix equal to 1, it is necessary to normalize the attention coefficient, and the processing formula is as follows: Among them, represents the transition probability from node to node in the industrial control system, represents the set of all reachable nodes starting from node , represents the average value of the attention coefficients calculated by multiple attention heads; is the attention coefficient learned in the graph attention network (GAT), which is the original weight learned through the multi-head attention mechanism in GAT and represents the nodej The importance of nodes i ; The normalized attention coefficients are used as weights to obtain the transition probability matrix , as shown in the following formula: ; Among them, represents the transition probability from node C to node A , represents the transition probability from node C to node A , represents the transition probability from node C to node A , represents the transition probability from node C to node A , represents the transition probability from node C to node A , represents the transition probability from node C to node D ; Since the DeadEnds problem may occur because some nodes have no out-degree, a Teleportation mechanism is introduced. If a node has no out-degree, the same probability is assigned to each other node, and the transition probability matrix is modified as shown in the following formula: ; Among them, is a matrix with all elements in the th row equal to 1, is the transpose of ; In this embodiment, after the Teleportation transformation, the value of the final transition probability matrix combining graph attention is shown in the following formula: ; With the transition probability transfer matrix combining graph attention, the calculation of the GATRank value of the industrial control system is shown in the following formula: ; Among them, is the GATRank value of node i ; Step 5: Normalization; Normalize the GATRank values of all nodes in the industrial control system to obtain the normalized GATRank values; The processing formula for the normalized GATRank value of node i is as follows: ; Among them, The node after normalization i of the GATRank value; Step 6: Determine the convergence of the GATRank values of each node in the industrial control system. If it converges, use the GATRank values of each node as the final anomaly scores of the nodes, and sort these scores in descending order to obtain a descending set, which can guide the operator to check the root causes of security anomalies one by one. Otherwise, execute Step 4. Without changing the graph structure and initial scores composed of each automation component, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

[0023] In this embodiment, the safety water treatment (SWaT) dataset and the water distribution (WADI) dataset are used to comprehensively evaluate the method proposed by the present invention. The SWaT dataset contains 51 sensors and actuators, including 496,800 samples of 7 days of normal operation and 449,919 samples of 4 days of subsequent attacks. WADI is a scaled-down version of a modern water distribution facility and an extension of SWaT. It contains data from 123 sensors and actuators in the water distribution system, including a total of 1,048,571 samples collected under 14 days of normal operation and a total of 172,081 samples collected under attack scenarios in the subsequent 2 days.

[0024] To verify the effectiveness of the method proposed by the present invention, a comparative experiment of this method of the present invention with 4 relatively advanced baseline models, including DAGMM, LSTM-VAE, BeatGAN, and OmniAnomaly, was carried out through a group of experiments. The five models were compared on the SWaT dataset and the WADI dataset respectively. The detection effects are shown in Table 1 and Table 2 respectively.

[0025] Table 1 Comparison of the detection effects of five models on the SWaT dataset; Method HitRate@150% RC-top-3 DAGMM 0.4295 0.4967 LSTM-VAE 0.4737 0.5771 BeatGAN 0.4263 0.5543 OmniAnomaly 0.2232 0.3772 GATRank 0.5536 0.6357 Table 2 Comparison of the detection effects of five models on the SWaT dataset; Method HitRate@150% RC-top-3 DAGMM 0.4267 0.4985 LSTM-VAE 0.4583 0.5000 BeatGAN 0.3833 0.4571 OmniAnomaly 0.3528 0.4857 GATRank 0.5062 0.5639 As can be seen from Table 1 and Table 2, on the SWaT dataset, the HitRate@P% and RC-top-3 of the industrial process safety anomaly analysis method based on GATRank scoring of the present invention reached 55.36% and 63.57% respectively. On the WADI dataset, the HitRate@P% and RC-top-3 of the industrial process safety anomaly analysis method based on GATRank scoring of the present invention reached 50.62% and 56.39% respectively, which indicates that the industrial process safety anomaly analysis method based on GATRank scoring of the present invention shows excellent effects on different datasets, and its ability to find the root cause of safety anomalies is stronger than other reconstruction models DAGMM, LSTM-VAE, OmniAnomaly and prediction model GDN.

[0026] Example 2:

[0027] This embodiment provides an industrial process safety anomaly analysis system based on GATRank scoring, including: Initial anomaly score calculation module: Calculate the initial anomaly score of a single node in the industrial control system; Graph structure construction module: Construct a graph structure for each automation component in the industrial control system and save the spatial relationship between all components; GATRank value initialization module: Initialize the GATRank value of the industrial control system with the initial anomaly score of a single node; GATRank value calculation module: Calculate the GATRank value of the industrial control system using the transition probability matrix combined with the graph attention mechanism; Anomaly score calculation module: Judge the convergence of the GATRank values of each node in the industrial control system. If it converges, use the GATRank value of the node as the final anomaly score of the node. Otherwise, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

[0028] Example 3:

[0029] This embodiment proposes an electronic device, including: one or more processors, and a memory for storing instructions. When the instructions are executed by the one or more processors, the one or more processors execute the industrial process safety anomaly analysis method based on GATRank scoring.

[0030] The electronic device can be a mobile phone, a computer, a tablet computer, etc., including a memory and a processor. A computer program is stored on the memory, and when the computer program is executed by the processor, it implements the industrial process safety anomaly analysis method based on GATRank scoring as described in the embodiments. It can be understood that the electronic device can also include an input / output (I / O) interface and a communication component.

[0031] Among them, the processor is used to execute all or part of the steps in the industrial process safety anomaly analysis method based on GATRank scoring as described in the above embodiments. The memory is used to store various types of data, which may include, for example, instructions for any application program or method in the electronic device, as well as application program-related data.

[0032] The processor can be implemented by an application specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor, or other electronic components, and is used to execute the industrial process safety anomaly analysis method based on GATRank scoring as described in the above embodiments.

[0033] Embodiment 4:

[0034] This embodiment provides a computer-readable storage medium that stores executable instructions. When the instructions are executed and implemented in the form of a software functional unit and sold or used as an independent product, they can be stored in a computer-readable storage medium.

[0035] The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the industrial process safety anomaly analysis method based on GATRank scoring described in various embodiments of the present application.

[0036] The foregoing storage medium includes: flash memory, hard disk, multimedia card, card-type memory (e.g., SD (Secure Digital Memory Card) or DX (abbreviation for Memory Data Register, MDR), memory data register, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, server, APP (abbreviation for Application, application software) application mall, and other various media that can store program verification codes. A computer program is stored thereon, and when the computer program is executed by a processor, each step of the above-mentioned industrial process safety anomaly analysis method based on GATRank scoring can be implemented.

[0037] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope defined by the claims of the present invention.

Claims

1. An industrial process safety anomaly analysis method based on GATRank scoring, characterized in that: Including: Calculating the initial anomaly score of a single node in the industrial control system; Constructing a graph structure for each automation component in the industrial control system and storing the spatial relationships between all components; Initializing the GATRank value of the industrial control system with the initial anomaly score of a single node; Calculating the GATRank value of the industrial control system using the transition probability matrix combined with the graph attention mechanism; Judging the convergence of the GATRank values of each node in the industrial control system. If it converges, use the GATRank value of the node as the final anomaly score of the node to guide the operator to investigate the root cause of the security anomaly; otherwise, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

2. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 1, wherein: The method for calculating the initial anomaly score of a single node in the industrial control system is as follows: Combining the predicted value and the reconstruction probability of a single node to calculate the initial anomaly score of the single node. The specific steps are as follows: At each time point, the initial anomaly score of a single node is calculated by combining the predicted value and the reconstruction probability of the node, as shown in the following formula: ; Among them, is the initial anomaly score at the time node , δ is a hyperparameter used to balance prediction and loss, is the reconstruction probability of the -th node at time is the predicted value of the -th node's short-term prediction at time represents the average of the predicted values of the short-term prediction and the long-term prediction for the -th node at time , as shown in the following formula: ; Among them, is the single-point prediction value of node , is the time period prediction value of node . Robust normalization is performed on the initial anomaly scores for each node, as shown in the following formula: ; Among them, is the value after robust normalization, and are respectively the median and interquartile range of the anomaly score at the time node.

3. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 2, wherein: The method for constructing a graph structure for each automation component in the industrial control system is as follows: Define a binary tuple for each automation component in the industrial control system A = ( c , r ) where c represents the type of the automation component, which can take the value of 0 or 1. The value of 0 represents a sensor, and the value of 1 represents an actuator respectively; r represents the sub-process label of the sub-process to which the automation component belongs; a graph structure is constructed through this binary tuple to save the spatial relationship between all components, and an adjacency matrix is used to save the graph structure; Using the Pearson correlation coefficient and transfer entropy to correct the spatial relationships between the constructed components; retaining the corresponding edges when the Pearson correlation coefficient and transfer entropy meet the set conditions.

4. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 3, wherein: The method uses the initially abnormally scored value of a single node in the industrial control system after robust normalization as the initial GATRank value of the industrial control system.

5. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 4, characterized in that: The method for calculating the GATRank value of the industrial control system using the transition probability matrix combined with the graph attention mechanism is as follows: Use GAT to learn the attention coefficient as the transition probability; in order to make the probability sum of each column of the transition matrix equal to 1, it is necessary to normalize the attention coefficient, and the processing formula is as follows: ; Among them, represents the transition probability from node to node ; represents the set of all reachable nodes starting from node ; represents the average of the attention coefficients calculated by multiple attention heads ; The normalized attention coefficients are used as weights to obtain the transition probability matrix ; Introduce the Teleportation mechanism. If a node has no out-degree, assign the same probability to each other node. Then the transition probability matrix is shown in the following formula: ; Among them, is the matrix with all elements in the row being 1, and is the transpose of Furthermore, the GATRank value of the industrial control system is obtained as shown in the following formula: ; Among them, is the GATRank value of the node i .

6. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 5, wherein: The method also normalizes the GATRank values of all nodes in the industrial control system to obtain the normalized GATRank values, and then judges the convergence of the GATRank values.

7. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 6, wherein: When the GATRank values of each node in the industrial control system do not converge, the method recalculates the transition probability matrix and calculates the GATRank value of each node in the industrial control system under the condition that the graph structure and the initial score composed of each automation component remain unchanged.

8. An industrial process safety anomaly analysis system based on GATRank scoring, implemented based on the method described in claim 1, characterized in that: Including: Initial anomaly score calculation module: calculating the initial anomaly score of a single node in the industrial control system; Graph structure construction module: constructing a graph structure for each automation component in the industrial control system and storing the spatial relationships between all components; GATRank value initialization module: initializing the GATRank value of the industrial control system with the initial anomaly score of a single node; GATRank value calculation module: calculating the GATRank value of the industrial control system using the transition probability matrix combined with the graph attention mechanism; Anomaly score calculation module: judging the convergence of the GATRank values of each node in the industrial control system. If it converges, use the GATRank value of the node as the final anomaly score of the node; otherwise, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

9. An electronic device that executes the industrial process safety anomaly analysis method based on GATRank scoring according to any one of claims 1 to 7, characterized in that: Including: One or more processors and a memory. The memory is used to store instructions. When the instructions are executed by the one or more processors, the one or more processors execute the industrial process security anomaly analysis method based on GATRank scoring.

10. A computer-readable storage medium stores executable instructions for performing the industrial process safety anomaly analysis method based on GATRank scoring according to any one of claims 1 to 7, characterized in that: The instruction, when executed, causes the processor to execute the industrial process safety anomaly analysis method based on GATRank scoring as described above.

Images