A method and system for analyzing industrial process safety anomalies based on GATRank scoring

Abstract

The present invention provides a method and system for analyzing industrial process safety anomalies based on GATRank scoring, relating to the field of industrial control technology. The method and system first calculate the initial anomaly score of a single node in an industrial control system; then construct a graph structure for each automation component in the industrial control system; then use the initial anomaly score of the single node to initialize the GATRank value of the industrial control system; and use a transition probability matrix combined with a graph attention mechanism to calculate the GATRank value of the industrial control system; finally, determine the convergence of the GATRank values ​​of each node in the industrial control system. If converged, the GATRank value of the node is used as the final anomaly score of the node to guide operators to investigate the root cause of the safety anomaly; otherwise, the transition probability matrix is ​​recalculated to calculate the GATRank value of each node in the industrial control system. This method is more capable of finding the root cause of anomalies than other reconstruction models.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to a method and system for analyzing industrial process safety anomalies based on GATRank scoring. Background Art

[0002] The deep integration of industrial control systems and network technologies has significantly enhanced the automation and efficiency of industrial production. The introduction of advanced technologies such as the Internet of Things, big data analytics, and artificial intelligence has made production processes more precise and efficient. However, with the promotion and application of industrial Internet platforms, the openness and connectivity of enterprise networks are increasing, exposing industrial control systems to a growing number of cybersecurity threats.

[0003] With the advent of artificial intelligence, various deep learning-based anomaly detection methods have emerged. However, most current anomaly handling methods share a common problem: they focus on anomaly detection while rarely conducting further analysis. Common anomaly analysis methods often focus on single-point anomalies, paying insufficient attention to the overall context and interrelationships of the anomaly. This results in poor results and makes it difficult to guide anomaly troubleshooting.

[0004] The paper "Liu Y, Li Z, Zhou C, et al. Generative adversarial active learning for unsupervised outlier detection[J]. IEEE Transactions on Knowledge and Data Engineering, 2019, 32(8): 1517-1528." uses an error-based node anomaly scoring method to identify anomalies by building a model of normal data patterns. If a data point is significantly different from the model's predicted or reconstructed pattern, it is likely an anomaly. The K nodes with the largest error anomaly scores are selected as the root cause of the anomaly. This method is intuitive and easy to understand. Although this method can define anomaly scores based on the difference between the actual observed values ​​of the data and the model's predicted values, it has no way to quantitatively judge the uncertainty of the anomaly.

[0005] The paper "Su Y, Zhao Y, Niu C, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]. Proceedings of the 25th ACM SIGKDD international conference on knowledgediscovery&data mining. 2019: 2828-2837." uses a probability-based node anomaly scoring approach. If a data point has a high probability of occurrence, it means it is consistent with the normal data pattern and is therefore likely to belong to the normal category. Conversely, if a data point has a low probability of occurrence, it indicates that it is inconsistent with the normal data pattern and is therefore likely an anomaly or a deviation from the norm. K nodes with the smallest probability anomaly scores are selected as the root cause of the anomaly. This approach provides the probability or confidence level of the anomaly, providing better quantification. While this method can better quantify the uncertainty of anomalies, the computational process is relatively complex.

[0006] While these anomaly analysis methods have provided some preliminary explanations for anomalies, many focus primarily on single-point anomalies while ignoring the overall context and interdependencies of the anomaly. This limits the analysis results and makes it difficult for operators to accurately identify the root cause of the anomaly. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to address the deficiencies of the above-mentioned existing technologies and provide an industrial process safety anomaly analysis method and system based on GATRank scoring. By calculating the probability score of each node being the root cause of the anomaly, the nodes are arranged in descending order according to the scores, providing priority guidance for operators to identify the root causes of safety anomalies.

[0008] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0009] In one aspect, the present invention provides an industrial process safety anomaly analysis method based on GATRank scoring, comprising:

[0010] Calculate the initial anomaly score for a single node in an industrial control system;

[0011] Construct a graph structure for each automation component in an industrial control system and save the spatial relationship between all components;

[0012] The GATRank value of the industrial control system is initialized using the initial anomaly score of a single node;

[0013] Use the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system;

[0014] Determine the convergence of the GATRank value of each node in the industrial control system. If converged, the GATRank value of the node is used as the final anomaly score of the node to guide operators to investigate the root cause of the security anomaly; otherwise, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

[0015] Furthermore, the method for calculating the initial security anomaly score of a single node in the industrial control system is:

[0016] Combine the predicted value and reconstruction probability of a single node to calculate the initial anomaly score of a single node. The specific steps are:

[0017] At each time point, the initial anomaly score of a single node is calculated by combining the predicted value and reconstruction probability of the node, as shown in the following formula: ;

[0018] in, for Time Node The initial anomaly score of , δ is a hyperparameter to balance prediction and loss, for Moment The reconstruction probability of a node, for Moment The predicted value of the short-term prediction of each node, Represents short-term and long-term forecasts Moment The average value of the predicted values ​​of the nodes is shown in the following formula: ;

[0019] in, For nodes The single point forecast value of For nodes The predicted value for the time period;

[0020] The initial anomaly score of each node is robustly normalized as shown in the following formula: ;

[0021] in, for The value after robust normalization, and They are Time Node The median and interquartile range of abnormality scores.

[0022] Furthermore, the method for constructing a graph structure for each automation element in the industrial control system is:

[0023] Define a binary group for each automation element in an industrial control system A = ( c , r ) in c Represents the type of automation component, which can be 0 or 1. The value 0 represents a sensor, and 1 represents an actuator. r The sub-process to which the automation component belongs is the sub-process number in the entire process; a graph structure is constructed through this binary tuple to save the spatial relationship between all components, and the adjacency matrix is ​​used to save the graph structure;

[0024] The spatial relationship between the constructed components is modified using the Pearson correlation coefficient and transfer entropy; when the Pearson correlation coefficient and transfer entropy meet the set conditions, the corresponding edges are retained.

[0025] Furthermore, the method uses the robustly normalized initial anomaly score of a single node in the industrial control system as the initial GATRank value of the industrial control system.

[0026] Furthermore, the method of using the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system is:

[0027] GAT is used to learn the attention coefficient as the transfer probability. In order to make the sum of the probabilities of each column of the transfer matrix equal to 1, the attention coefficient needs to be normalized. The processing formula is as follows: ;

[0028] in, Represents a node in an industrial control system To Node The transition probability, Represents a node The set of all arrival nodes of the departure, Represents the attention coefficient calculated by multiple attention heads The average value of

[0029] The normalized attention coefficient is used as the weight to obtain the transfer probability matrix ;

[0030] Introducing the Teleportation mechanism, if a node has no out-degree, the same probability is assigned to each other node, and the transition probability matrix is ​​shown in the following formula: ;

[0031] in, For the A matrix with all rows set to 1 for The transpose of

[0032] Then the GATRank value of the industrial control system is obtained as shown in the following formula: ;

[0033] in, For nodes i GATRank value.

[0034] Furthermore, the method also normalizes the GATRank values ​​of all nodes in the industrial control system to obtain a normalized GATRank value, and then determines the convergence of the GATRank value.

[0035] Furthermore, when the GATRank values ​​of the nodes in the industrial control system do not converge, the method recalculates the transition probability matrix and calculates the GATRank value of each node in the industrial control system while keeping the graph structure and initial score of each automation element unchanged.

[0036] On the other hand, an industrial process safety anomaly analysis system based on GATRank scoring includes:

[0037] Initial anomaly score calculation module: calculates the initial anomaly score of a single node in the industrial control system;

[0038] Graph structure construction module: Builds graph structures for each automation component in the industrial control system and saves the spatial relationships between all components;

[0039] GATRank value initialization module: uses the initial anomaly score of a single node to initialize the GATRank value of the industrial control system;

[0040] GATRank value calculation module: uses the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system;

[0041] Anomaly score calculation module: judge the convergence of the GATRank value of each node in the industrial control system. If converged, the GATRank value of the node is used as the final anomaly score of the node. Otherwise, the transition probability matrix is ​​recalculated and the GATRank value of each node in the industrial control system is calculated.

[0042] In a third aspect, the present application proposes an electronic device comprising: one or more processors, and a memory, wherein the memory is used to store instructions, and when the instructions are executed by the one or more processors, the one or more processors execute the industrial process safety anomaly analysis method based on GATRank scoring.

[0043] In a fourth aspect, the present application proposes a computer-readable storage medium storing executable instructions, which, when executed, enable a processor to execute the industrial process safety anomaly analysis method based on GATRank scoring.

[0044] The beneficial effects of adopting the above technical solution are as follows: the present invention provides an industrial process safety anomaly analysis method based on GATRank scoring, (1) the prediction error and reconstruction probability are integrated to perform initial safety anomaly scoring on a single node in the industrial control system, and robust normalization is performed to avoid extreme value interference, and the time series prediction and data distribution characteristics are integrated to enhance the robustness of the safety anomaly scoring. (2) By integrating GAT and PageRank to score node anomalies, the analysis not only depends on the specific characteristics and context of the node, but also combines global link information to provide a more comprehensive network analysis. By combining the local feature extraction capability of the graph attention network (GAT) with the global structure analysis capability of the PageRank algorithm, the limitations of a single method are overcome, and local and global information are fully utilized, thereby improving the accuracy and robustness of the importance of nodes in the graph. Compared with the traditional PageRank that assigns the same probability weight to each arrival node, GATRank uses the attention coefficient learned by GAT as the edge weight, which can better explain the behavior and status of the node in the graph. (3) The Teleportation mechanism is used to assign uniform transfer probabilities to nodes with no out-degree, thus enhancing the stability of the method in complex scenarios such as single-point attack (SSSP) and multi-point attack (SSMP / MSMP). BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A flowchart of a method for analyzing industrial process safety anomalies based on GATRank scoring provided in Example 1 of the present invention;

[0046] Figure 2 A schematic diagram of the transition probabilities of four nodes in the industrial control system provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0047] The following embodiments of the present invention are described in further detail with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not intended to limit the scope of the present invention.

[0048] Example 1:

[0049] In this embodiment, a method for analyzing industrial process safety anomalies based on GATRank scoring is provided. Figure 1 As shown, the following steps are included:

[0050] Step 1: Calculate the initial anomaly score of a single node in the industrial control system; combine the predicted value and reconstruction probability of a single node to calculate the initial anomaly score of a single node. The specific steps are as follows:

[0051] At each time point, the initial anomaly score of a single node is calculated by combining the predicted value and reconstruction probability of the node, as shown in the following formula: ;

[0052] in, for Time Node The initial anomaly score of , δ is a hyperparameter to balance prediction and loss, for Moment The reconstruction probability of a node, for Moment The predicted value of the short-term prediction of each node, Represents short-term and long-term forecasts Moment The average value of the predicted values ​​of the nodes is shown in the following formula: ;

[0053] in, For nodes The single point forecast value of For nodes The predicted value for the time period;

[0054] The initial anomaly score of each node is robustly normalized as shown in the following formula: ;

[0055] in, for The value after robust normalization, and They are Time Node The median and interquartile range of the anomaly score are set to change dynamically.

[0056] Step 2: Build a graph structure for each automation component in the industrial control system and save the spatial relationship between all components;

[0057] Define a binary group for each automation element in an industrial control system A = ( c , r ) in c Represents the type of automation component, which can be 0 or 1. The value 0 represents a sensor, and 1 represents an actuator. rThe sub-process to which the automation component belongs is the sub-process number in the entire process; a graph structure is constructed through this binary tuple to save the spatial relationship between all components, and the adjacency matrix is ​​used to save the graph structure;

[0058] The spatial relationship between constructed components is modified using the Pearson correlation coefficient and transfer entropy. When the Pearson correlation coefficient and transfer entropy meet the conditions, the corresponding edge is retained. The judgment formula is as follows: , ;

[0059] in, X and Y These are two different components in an industrial control system, used to construct edges in the graph structure; For components X and Y The Pearson correlation coefficient is used to measure X and Y the strength and direction of the linear correlation between For components X and Y The transfer entropy of 、 are the thresholds of Pearson correlation coefficient and transfer entropy respectively; when elements X and Y meet the conditions, the elements X and Y The edges between them are preserved;

[0060] Step 3: Initialize the GATRank value of the industrial control system and score the node anomaly by integrating GAT and PageRank; the initial anomaly score of a single node in the industrial control system after robust normalization is used as the initial GATRank value of the industrial control system, denoted as , where n is the number of nodes in the industrial control system, At time t, n The initial GATRank value of each node;

[0061] Step 4: Use the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system;

[0062] The traditional transition probability matrix assigns the same weight probability to all the arrival nodes of a departure node. Figure 2 For example, its transition probability matrix can be defined as the following formula: ;

[0063] The first OK Elements of a column Representatives from Node to The transition probability of the node;

[0064] This paper uses GAT (Graph Attention Networks) to learn the attention coefficient as the transition probability. In order to make the sum of the probabilities of each column of the transition probability matrix equal to 1, the attention coefficient needs to be normalized. The processing formula is as follows: ;

[0065] in, Represents a node in an industrial control system To Node The transition probability, Represents a node The set of all arrival nodes of the departure, Represents the attention coefficient calculated by multiple attention heads The average value of is the attention coefficient learned in the Graph Attention Network (GAT), which is the original weight learned by the multi-head attention mechanism in GAT, indicating the node j For Node i the importance of

[0066] The normalized attention coefficient is used as the weight to obtain the transfer probability matrix , as shown in the following formula: ;

[0067] in, Representation node C To Node A The transition probability, Representation node C To Node A The transition probability, Representation node C To Node A The transition probability, Representation node C To Node A The transition probability, Representation node C To Node A The transition probability, Representation node C To Node D The transition probability of

[0068] Since some nodes have no out-degree, which will lead to the DeadEnds problem, the Teleportation mechanism is introduced. If a node has no out-degree, the same probability is assigned to each other node. The transition probability matrix is ​​modified as shown in the following formula: ;

[0069] in, For the A matrix with all rows set to 1, for The transpose of

[0070] In this embodiment, after the Teleportation conversion, the final transfer probability matrix combined with the graph attention is The value of is given by the following formula: ;

[0071] With the transfer probability transfer matrix combined with graph attention, the GATRank value of the industrial control system is calculated as follows: ;

[0072] in, For nodes i GATRank value;

[0073] Step 5: Normalization: Normalize the GATRank values ​​of all nodes in the industrial control system to obtain the normalized GATRank value;

[0074] node i The normalized GATRank value processing formula is as follows: ;

[0075] in, The normalized node i GATRank value;

[0076] Step 6: Determine the convergence of the GATRank values ​​for each node in the industrial control system. If converged, use the GATRank value of each node as the final anomaly score for the node and sort these scores in descending order to obtain a descending set. This set can guide operators to identify the root causes of security anomalies one by one. Otherwise, execute Step 4. While keeping the graph structure and initial scores of each automation component unchanged, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

[0077] This example uses the Secure Water Treatment (SWaT) dataset and the Water Distribution (WADI) dataset to comprehensively evaluate the proposed method. The SWaT dataset contains 51 sensors and actuators, comprising 496,800 samples from seven days of normal operation and 449,919 samples from four days of attack. WADI, a scaled-down version of a modern water distribution facility, is an extension of SWaT. It includes data from 123 sensors and actuators in the water distribution system, totaling 1,048,571 samples collected from 14 days of normal operation and 172,081 samples from the next two days of attack.

[0078] To validate the effectiveness of our proposed method, we conducted a series of experiments comparing it with four state-of-the-art baseline models: DAGMM, LSTM-VAE, BeatGAN, and OmniAnomaly. These five models were compared on the SWaT and WADI datasets. The results are shown in Tables 1 and 2, respectively.

[0079] Table 1 Comparison of detection effects of five models on the SWaT dataset;

[0080] method HitRate@150% RC-top-3 DAGMM 0.4295 0.4967 LSTM-VAE 0.4737 0.5771 BeatGAN 0.4263 0.5543 OmniAnomaly 0.2232 0.3772 GATRank 0.5536 0.6357

[0081] Table 2 Comparison of detection effects of five models on the SWaT dataset;

[0082] method HitRate@150% RC-top-3 DAGMM 0.4267 0.4985 LSTM-VAE 0.4583 0.5000 BeatGAN 0.3833 0.4571 OmniAnomaly 0.3528 0.4857 GATRank 0.5062 0.5639

[0083] As can be seen from Tables 1 and 2, on the SWaT dataset, the HitRate@P% and RC-top-3 of the industrial process safety anomaly analysis method based on the GATRank score of the present invention reached 55.36% and 63.57%, respectively. On the WADI dataset, the HitRate@P% and RC-top-3 of the industrial process safety anomaly analysis method based on the GATRank score of the present invention reached 50.62% and 56.39%, respectively. This shows that the industrial process safety anomaly analysis method based on the GATRank score of the present invention has excellent results on different datasets and is more capable of finding the root cause of safety anomalies than other reconstruction models such as DAGMM, LSTM-VAE, OmniAnomaly, and the prediction model GDN.

[0084] Example 2:

[0085] This embodiment provides an industrial process safety anomaly analysis system based on GATRank scoring, including:

[0086] Initial anomaly score calculation module: calculates the initial anomaly score of a single node in the industrial control system;

[0087] Graph structure construction module: Builds graph structures for each automation component in the industrial control system and saves the spatial relationships between all components;

[0088] GATRank value initialization module: uses the initial anomaly score of a single node to initialize the GATRank value of the industrial control system;

[0089] GATRank value calculation module: uses the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system;

[0090] Anomaly score calculation module: judge the convergence of the GATRank value of each node in the industrial control system. If converged, the GATRank value of the node is used as the final anomaly score of the node. Otherwise, the transition probability matrix is ​​recalculated and the GATRank value of each node in the industrial control system is calculated.

[0091] Example 3:

[0092] This embodiment proposes an electronic device, comprising: one or more processors, and a memory, wherein the memory is used to store instructions, and when the instructions are executed by the one or more processors, the one or more processors execute the industrial process safety anomaly analysis method based on GATRank scoring.

[0093] The electronic device can be a mobile phone, computer, or tablet computer, and includes a memory and a processor. The memory stores a computer program that, when executed by the processor, implements the GATRank-based industrial process safety anomaly analysis method described in the embodiments. It is understood that the electronic device may also include an input / output (I / O) interface and a communication component.

[0094] The processor is configured to execute all or part of the steps of the GATRank-based industrial process safety anomaly analysis method described in the above embodiment. The memory is configured to store various types of data, such as instructions for any application or method in the electronic device, as well as application-related data.

[0095] The processor can be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor or other electronic components, and is used to execute the industrial process safety anomaly analysis method based on GATRank scoring described in the above embodiment.

[0096] Example 4:

[0097] This embodiment provides a computer-readable storage medium storing executable instructions. When the instructions are executed, if they are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0098] The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the industrial process safety anomaly analysis method based on GATRank scoring described in each embodiment of this application.

[0099] The aforementioned storage media include: flash memory, hard disk, multimedia card, card-type memory (for example, SD (Secure Digital Memory Card) or DX (Memory Data Register, MDR abbreviation, memory data register) memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, CD, server, APP (Application, abbreviation of application software) application store and other media that can store program verification codes, on which computer programs are stored. When the computer program is executed by the processor, it can implement the above-mentioned steps of the industrial process safety anomaly analysis method based on GATRank scoring.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A method for analyzing industrial process safety anomalies based on GATRank scoring, characterized by: include: Calculate the initial anomaly score for a single node in an industrial control system; Construct a graph structure for each automation component in an industrial control system and save the spatial relationship between all components; For each automation component in an industrial control system, a binary tuple A = (c, r) is defined, where c represents the type of the automation component and takes the value 0 or 1, with 0 representing a sensor and 1 representing an actuator. r represents the sub-process number within the entire process to which the automation component belongs. This binary tuple is used to construct a graph structure that preserves the spatial relationships between all components. The graph structure is preserved using an adjacency matrix. Use Pearson correlation coefficient and transfer entropy to modify the spatial relationship between constructed components; when the Pearson correlation coefficient and transfer entropy meet the set conditions, the corresponding edges are retained; The GATRank value of the industrial control system is initialized using the initial anomaly score of a single node; Use the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system; GAT is used to learn the attention coefficient as the transfer probability. In order to make the sum of the probabilities of each column of the transfer matrix equal to 1, the attention coefficient needs to be normalized. The processing formula is as follows: ,in, Represents a node in an industrial control system To Node The transition probability, Represents a node The set of all arrival nodes of the departure, Represents the attention coefficient calculated by multiple attention heads The average value of The normalized attention coefficient is used as the weight to obtain the transfer probability matrix ; Introducing the Teleportation mechanism, if a node has no out-degree, the same probability is assigned to each other node, and the transition probability matrix is ​​shown in the following formula; ,in, For the A matrix with all rows set to 1 for The transpose of Then the GATRank value of the industrial control system is obtained as shown in the following formula: ,in, is the GATRank value of node i, n is the number of nodes in the industrial control system; Determine the convergence of the GATRank value of each node in the industrial control system. If converged, the GATRank value of the node is used as the final anomaly score of the node to guide operators to investigate the root cause of the security anomaly; otherwise, recalculate the transition probability matrix and calculate the GATRank value of each node in the industrial control system.

2. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 1 is characterized by: The method for calculating the initial anomaly score of a single node in the industrial control system is: Combine the predicted value and reconstruction probability of a single node to calculate the initial anomaly score of a single node. The specific steps are: At each time point, the initial anomaly score of a single node is calculated by combining the predicted value and reconstruction probability of the node, as shown in the following formula: ,in, is the initial anomaly score of node i at time t, δ is a hyperparameter used to balance prediction and loss, for Moment The reconstruction probability of a node, for Moment The predicted value of the short-term prediction of each node, Represents short-term and long-term forecasts Moment The average value of the predicted values ​​of the nodes is shown in the following formula: ,in, is the single point prediction value of node i, is the predicted value of the time period of node i; The initial anomaly score of each node is robustly normalized as shown in the following formula: ,in, for The value after robust normalization, and They are Time Node The median and interquartile range of abnormality scores.

3. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 2 is characterized by: The method uses the robustly normalized initial anomaly score of a single node in the industrial control system as the initial GATRank value of the industrial control system.

4. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 3 is characterized by: The method also normalizes the GATRank values ​​of all nodes in the industrial control system to obtain a normalized GATRank value, and then determines the convergence of the GATRank value.

5. The industrial process safety anomaly analysis method based on GATRank scoring according to claim 4 is characterized in that: When the GATRank values ​​of the nodes in the industrial control system do not converge, the method recalculates the transition probability matrix and calculates the GATRank value of each node in the industrial control system while keeping the graph structure and initial scores of the automation components unchanged.

6. A GATRank-based industrial process safety anomaly analysis system, implemented based on the method of claim 1, characterized in that: include: Initial anomaly score calculation module: calculates the initial anomaly score of a single node in the industrial control system; Graph structure construction module: Builds a graph structure for each automation component in the industrial control system and saves the spatial relationship between all components; For each automation component in an industrial control system, a binary tuple A = (c, r) is defined, where c represents the type of the automation component and takes the value 0 or 1, with 0 representing a sensor and 1 representing an actuator. r represents the sub-process number within the entire process to which the automation component belongs. This binary tuple is used to construct a graph structure that preserves the spatial relationships between all components. The graph structure is preserved using an adjacency matrix. Use Pearson correlation coefficient and transfer entropy to modify the spatial relationship between constructed components; when the Pearson correlation coefficient and transfer entropy meet the set conditions, the corresponding edges are retained; GATRank value initialization module: uses the initial anomaly score of a single node to initialize the GATRank value of the industrial control system; GATRank value calculation module: uses the transition probability matrix combined with the graph attention mechanism to calculate the GATRank value of the industrial control system; GAT is used to learn the attention coefficient as the transfer probability. In order to make the sum of the probabilities of each column of the transfer matrix equal to 1, the attention coefficient needs to be normalized. The processing formula is as follows: ,in, Represents a node in an industrial control system To Node The transition probability, Represents a node The set of all arrival nodes of the departure, Represents the attention coefficient calculated by multiple attention heads The average value of The normalized attention coefficient is used as the weight to obtain the transfer probability matrix ; Introducing the Teleportation mechanism, if a node has no out-degree, the same probability is assigned to each other node, and the transition probability matrix is ​​shown in the following formula; ,in, For the A matrix with all rows set to 1 for The transpose of Then the GATRank value of the industrial control system is obtained as shown in the following formula: ,in, is the GATRank value of node i; Anomaly score calculation module: judge the convergence of the GATRank value of each node in the industrial control system. If converged, the GATRank value of the node is used as the final anomaly score of the node. Otherwise, the transition probability matrix is ​​recalculated and the GATRank value of each node in the industrial control system is calculated.

7. An electronic device, configured to execute the industrial process safety anomaly analysis method based on GATRank scoring according to any one of claims 1 to 5, characterized in that: include: One or more processors, and a memory, wherein the memory is used to store instructions, and when the instructions are executed by the one or more processors, the one or more processors execute the industrial process safety anomaly analysis method based on GATRank scoring.

8. A computer-readable storage medium storing executable instructions for executing the industrial process safety anomaly analysis method based on GATRank scoring according to any one of claims 1 to 5, characterized in that: When the instructions are executed, the processor executes the industrial process safety anomaly analysis method based on GATRank scoring.

Images