Industrial control network anomaly detection method considering priori knowledge

Abstract

The invention discloses an industrial control network anomaly detection method considering priori knowledge, and the method comprises the steps: enabling a spatial feature extraction module to consider the function attributes, communication specifications and topological structure features of equipment in an industrial control network, introducing equipment role perception coding and topological perception position coding, improving the self-attention through protocol constraint, and achieving the detection of the anomaly of the industrial control network. The spatial dependency relationship of an industrial control scene can be better understood, and the recognition capability of the model on key spatial features is improved. Meanwhile, a periodic sensing door is arranged in the time sequence feature extraction module, historical state information is aggregated to obtain scene context vectors, so that an attention mechanism is updated, weighted features are obtained, features of different time scales are subjected to weighted fusion in combination with a multi-scale time window, and finally, the three features are spliced together, so that a scene is obtained. And final time feature representation is formed. According to the method, the prior knowledge can be effectively utilized, the interaction mode between devices is captured, the time sequence dependency relationship is analyzed, and the anomaly detection effect is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control network security, and particularly relates to an industrial control network anomaly detection method considering prior knowledge. Background Art

[0002] The deep integration of industrial control systems and the internet has led to increasingly severe cybersecurity threats. Industrial control networks, as the nervous system of industrial production, have a direct impact on the stable operation of the national economy and social production. Traditional industrial control network security primarily relies on perimeter protection measures such as firewalls and intrusion detection. However, these methods are no longer sufficient in the face of increasingly complex cyberattacks.

[0003] Currently, industrial control network traffic anomaly detection faces the following major challenges: First, existing detection methods often separate temporal and spatial features and treat them independently, ignoring the inherent correlation between the two, resulting in limited detection accuracy. Temporal features primarily reflect dynamic behavioral characteristics such as the periodicity and timing of device communications, while spatial features reflect static structural characteristics such as the topological relationships and communication patterns between devices. Second, existing models lack a deep understanding of the communication characteristics of industrial control networks and fail to fully utilize prior knowledge such as industrial control protocol specifications and device behavior patterns. This results in the detection model being unable to accurately identify anomalous behaviors that violate the inherent laws of industrial control systems, affecting detection accuracy and interpretability.

[0004] Therefore, it is urgent to propose an anomaly detection method that can effectively integrate spatiotemporal features and fully consider the prior knowledge of industrial control networks. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the technical problem that the present invention intends to solve is to provide an industrial control network anomaly detection method that takes prior knowledge into account. This detection method uses the Transformer-BiLSTM architecture to achieve efficient extraction of spatial and temporal features, and combines knowledge distillation technology to significantly reduce the model calculation complexity while ensuring detection accuracy, making it more suitable for the actual deployment needs of the industrial control network environment.

[0006] The technical solution adopted by the present invention to solve the technical problem is as follows:

[0007] A method for detecting anomalies in an industrial control network based on prior knowledge, the method comprising the following:

[0008] Obtain industrial control network traffic data and perform preprocessing to obtain preprocessed network traffic features, including preprocessed frequency domain features F freq , statistical features after preprocessing F stat And the preprocessed time series features F temp ;

[0009] Build a lightweight anomaly detection model based on spatiotemporal features, including spatial feature extraction module, temporal feature extraction module, fusion module, knowledge distillation module, and anomaly detection module;

[0010] The spatial feature extraction module is used to extract the pre-processed frequency domain features F freq and statistical characteristics F stat Processing is performed to obtain the spatial feature representation F s ;

[0011] The time series feature extraction module is used to extract the pre-processed time series features F temp and statistical characteristics F stat Processing is performed to obtain the time series feature representation F t ;

[0012] The fusion module is used to represent the time series feature F t and spatial feature representation F s Perform fusion to obtain the normalized fusion feature F norm ;

[0013] The knowledge distillation module includes a teacher model and a student model. The teacher model is based on the normalized fusion feature F norm As input, train the student model;

[0014] The anomaly detection module performs anomaly detection on the real-time industrial control network traffic data using the output of the trained student model to obtain the anomaly detection score Score(x) and the final anomaly determination result (normal / abnormal).

[0015] The fusion module includes an abnormal sensitive feature calculation module, a sensitive fusion module, a self-attention module and an adaptive normalization module. The abnormal sensitive feature calculation module is used to represent F according to the temporal feature. t and spatial feature representation F s Determine abnormal sensitive feature F using feature similarity function and feature difference vector a ;

[0016] The sensitive fusion module represents F with temporal features. t , spatial feature representation F s and abnormally sensitive features F a Perform weighted fusion on the input to obtain the sensitive fusion feature F fusion , then the sensitive fusion feature F fusion The calculation formula is:

[0017] F fusion =w s ·F s +w t ·F t +wa ·F a

[0018] Among them, w s 、w t 、w a is the weight of each feature, and the time series feature is represented by F t , spatial feature representation F s , abnormally sensitive feature F a The three perform attention calculation to determine;

[0019] After sensitive fusion, the feature F fusion Input the self-attention module, and perform residual connection on the input and output of the self-attention module, and then process it through the adaptive normalization module to obtain the normalized fusion feature F norm .

[0020] Furthermore, the abnormally sensitive feature F a Calculated as follows:

[0021] F a =γ(F s ,F t )·D(F s ,F t )

[0022] Here, γ(·) is the feature similarity function, and D(·) is the feature difference vector;

[0023] The feature similarity function is defined as:

[0024]

[0025] Where σ is the standard deviation parameter, ||F s -F t || is the Euclidean distance between eigenvectors;

[0026] The feature difference vector is calculated as:

[0027] D(F s ,F t )=ReLU(|F s -F t |-θ)

[0028] Where ReLU is the rectified linear unit activation function; θ is the difference threshold vector, which is used to filter out small feature differences.

[0029] Furthermore, for w s 、w t 、w a Perform smoothing and use the weights after smoothing to perform sensitive fusion of features

[0030] F fusion Calculation of w t The smoothing process is:

[0031] w′ t =γw t +(1-γ)w t -1

[0032] Where γ is the smoothing coefficient, which is used to control the speed of weight update, w' t is the weight after smoothing; w s 、w a The smoothing process is similar.

[0033] Furthermore, the spatial feature extraction module considers the functional attributes, communication specifications and topological structure characteristics of devices in the industrial control network, including device role-aware coding, protocol constraint-based self-attention mechanism and topology-aware position coding;

[0034] The device role-aware encoding encodes the device role information into the feature space, enabling the model to perceive and utilize this prior knowledge. The specific process is:

[0035] First, the frequency domain feature F freq and statistical characteristics F stat Through the feature fusion function, the fusion feature F is obtained. combined1 :

[0036] F combined1 =αF freq +(1-α)F stat

[0037] Among them, α is an adjustable weight parameter used to balance the importance of frequency domain features and statistical features;

[0038] The fusion feature F combined1 For each device d in the industrial control network, its role coding is expressed as

[0039] E role (d) = W r ·R d +P d

[0040] Among them, E role (d) represents the k-dimensional role encoding vector of device d, where k is the number of dimensions of the role encoding, indicating that the device role information is encoded into a k-dimensional vector; W r is the role embedding matrix, R d is the device role vector, P d Indicates the location information of the device in the network;

[0041] The features are normalized by multiple dimensions, and the normalized device type features r type , functional characteristics r func , the importance characteristic that reflects the criticality of the equipment in the system imp and the hierarchical feature r that represents the position of the device in the control hierarchy level Construct the device role vector R according to the following formula d ;

[0042] R d =β1r type +β2r func +β3r imp +β4r level

[0043] Among them, β1, β2, β3, and β4 are weight coefficients, and they satisfy β1+β2+β3+β4=1;

[0044] The features after role encoding are subjected to topology-aware position encoding. The topology-aware position encoding considers the logical distance of the devices in the topology graph and combines it with the geometric distance of the physical space. It adopts a graph distance-based position encoding method for position encoding. The calculation formula of topology-aware position encoding TPE is:

[0045] TPE(i,j)=f(D ij )·cos(ω k ·d ij )

[0046] Among them, D ij is the shortest path distance between devices i and j in the topology graph, d ij is the Euclidean distance between devices i and j in physical space, f(·) is a monotonically decreasing distance mapping function, ω k is a learnable frequency parameter;

[0047] The features encoded by role and topology-aware position are processed by a self-attention mechanism based on protocol constraints. The process of the self-attention mechanism based on protocol constraints is: the protocol specification of industrial control network communication is introduced into the self-attention mechanism as prior knowledge. The self-attention A calculation formula is:

[0048]

[0049] Among them, M p is the protocol constraint matrix, d k is the key vector dimension, Q, K, and V are query, key, and value matrices respectively;

[0050] The protocol constraint matrix M p Comprehensively consider the communication permission constraint Mauth , protocol compatibility constraint M comp and the communication frequency constraint M freq Three aspects,

[0051] M p =wlM aut h+w2M comp +w3M freq

[0052] Among them, w l ,w2,w3 are weight coefficients, and satisfy w l +w2+w3=1;

[0053] The device role-aware encoding and topology-aware position encoding are embedded in the position encoding of the Transformer architecture. After that, the self-attention mechanism based on the protocol constraint is processed according to the Transformer architecture to obtain the final spatial feature representation F. s ;

[0054] The final spatial feature representation F s for

[0055] F s =Transformer(E role (d), TPE, M p , F freq , F stat )

[0056] Furthermore, the temporal feature extraction module adopts a Bi-LSTM architecture, including a periodic perception gating mechanism, an industrial control scenario attention mechanism, and multi-scale time window processing;

[0057] First, the time domain feature F temp and statistical characteristics F stat Through the feature fusion function, the fusion feature F is obtained. combined2 :

[0058] F combined2 =βF temp +(1-β)F stat

[0059] Among them, β is an adjustable weight parameter used to balance the importance of temporal features and statistical features;

[0060] The process of the periodic sensing gating mechanism is as follows:

[0061] Perform Fourier transform on historical data to extract periodic features p t :

[0062] p t =FFT(xt -w:t)

[0063] Where w is the sliding window size, x t is time series data, that is, fusion feature F combined2 ;

[0064] The periodic characteristic p t An adaptive gating unit is introduced, and the calculation formula of the adaptive gating unit is:

[0065] g t =σ(W g ·[h t ||p t ]+b g )

[0066] h′ t =g t ⊙h t

[0067] Among them, g t is the gate value, h t is the hidden state at the current moment, p t is the periodic feature, σ is the sigmoid activation function, ⊙ represents element-by-element multiplication, W g is the weight matrix, b g is the bias term, h' t is the updated hidden layer state;

[0068] Get the feature x' after gate processing t ;

[0069] The process of the industrial control scene attention mechanism is to aggregate historical state information to obtain the scene context vector c t , introducing the scene context vector c in the attention mechanism t The obtained attention weight and fusion feature F combined2 Multiply to get the weighted feature F weighted ;

[0070] The process of the multi-scale time window processing mechanism is: parallel processing of the features of multiple time windows to obtain the multi-scale feature F ms (t):

[0071] F ms (t)=∑(w n ·F n (t))

[0072] Among them, F n (t) is F combined2 The features of the nth time scale after multi-window segmentation; w n is the corresponding weight coefficient, through Fn (t) performing attention calculation;

[0073] The gated feature x' t , weighted feature F weighted And the multi-scale feature F ms (t) The three are concatenated to obtain the temporal feature representation F t .

[0074] The knowledge distillation module includes three levels of processing: spatial knowledge distillation, temporal knowledge distillation, and task-specific knowledge distillation to obtain the distilled spatial features, temporal features, and fusion features. Finally, the anomaly detection results are obtained through the anomaly detection module.

[0075] The present invention also protects a computer-readable storage medium having a computer program stored thereon, which can implement the steps of the method when the program is executed by a processor.

[0076] Compared with the prior art, the present invention has the following beneficial effects:

[0077] The spatial feature extraction module of the present invention innovatively considers the functional attributes, communication specifications and topological structure characteristics of the equipment in the industrial control network, introduces device role perception coding and topology perception position coding, and improves self-attention with protocol constraints, which can better understand the spatial dependencies of the industrial control scene and improve the model's recognition ability of key spatial features. At the same time, the temporal feature extraction module sets a periodic perception gate based on the Bi-LSTM architecture, which can better capture the periodicity in the time series. Compared with the traditional gating mechanism, it increases the display of periodic features and aggregates historical state information to obtain the scene context vector, thereby updating the attention mechanism and obtaining weighted features. Combined with the multi-scale time window, the features of different time scales are weightedly fused, and finally the features of different angles are spliced together to form the final temporal feature representation. Through the above-mentioned special improvements to the spatial feature extraction module and the temporal feature extraction module, it can effectively utilize prior knowledge, capture the interaction mode between devices, analyze the temporal dependency, improve the effect of feature extraction, and thus improve the accuracy of anomaly detection.

[0078] The fusion module of the present invention proposes abnormally sensitive features to perform feature fusion, thereby obtaining the final output of the fusion module, realizing adaptive fusion of spatiotemporal features, and using knowledge distillation technology to migrate the knowledge of complex models into lightweight models.

[0079] The present invention implements anomaly detection based on a multi-dimensional scoring mechanism and ensures detection accuracy through dynamic threshold updates. The present invention takes into account the characteristics of industrial control networks and achieves efficient and reliable anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 The present invention is a flowchart of the steps of an industrial control network anomaly detection method considering prior knowledge.

[0081] Figure 2 This is a structural diagram of a spatial feature extraction module according to an embodiment of the present invention.

[0082] Figure 3 Schematic diagram of the structure of a temporal feature extraction module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0083] The technical solution of the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments, but is not intended to limit the scope of protection of the present application.

[0084] The present invention considers the industrial control network anomaly detection method based on prior knowledge, such as Figure 1 As shown in the figure, the industrial control network traffic data is first preprocessed, and then the spatial feature extraction module and the temporal feature extraction module are used to extract the spatial and temporal features of the preprocessed network traffic features. Then, the abnormality-sensitive features are combined in the fusion module for feature fusion. Then, the knowledge distillation technology is used to compress the spatial, temporal and specific task models respectively, and finally, multi-dimensional scoring anomaly detection is performed.

[0085] In industrial control network environments, "real-time" is a key technical requirement, meaning the system must respond to events within a specified time limit. Anomaly detection requires the ability to quickly discover and report network anomalies so that timely action can be taken. Mainstream deep learning models, due to their high computational complexity and resource consumption, cannot guarantee detection times within milliseconds, failing to meet the requirements of industrial control system applications, which typically require a control cycle of 1-100ms.

[0086] The "prior knowledge" here refers to the inherent characteristics and patterns of industrial control network systems, such as the communication specifications of industrial control protocols, normal equipment operation modes, typical operating procedures, and behavioral patterns. This prior knowledge is crucial for improving the accuracy and interpretability of anomaly detection. Prior knowledge of industrial control networks primarily includes the communication specifications and message characteristics of industrial control protocols (such as Modbus TCP and Profinet), and the cyclical behavioral characteristics of equipment operation (such as PLC scan cycles and sensor sampling characteristics).

[0087] Example 1

[0088] The industrial control network anomaly detection method considering prior knowledge in this embodiment includes the following steps:

[0089] Step 1: Preprocessing Industrial Control Network Traffic Data

[0090] The data preprocessing module is primarily responsible for cleaning, standardizing, and extracting preliminary features from raw industrial control network data. Industrial control network data is characterized by multi-source heterogeneity, noise interference, and time-dependent nature, requiring systematic preprocessing to provide a reliable data foundation for subsequent analysis.

[0091] Data cleaning includes three steps: outlier detection, missing value processing and noise filtering.

[0092] For the collected industrial control network traffic data X={x1,x2,...,x n}Perform the following data preprocessing, where n is the number of samples.

[0093] Use the improved Z-score method for preliminary cleaning:

[0094] Z(x)=(x-μ rolling ) / σ rolling

[0095] Where x is the original data, μ rolling and σ rolling is the mean and standard deviation within the sliding window, Z(x) is the data value after cleaning, and the window size is dynamically adjusted according to the temporal characteristics of the data:

[0096] w=min(w max ,max(w min ,T cycle ))

[0097] Here w is the size of the final window, w max is the maximum allowed window size, w min is the minimum allowed window size. cycle is the estimated period of the data, obtained through autocorrelation analysis.

[0098] For outliers detected during the initial cleaning process, the system applies different processing strategies based on the importance of the data: key data points are manually reviewed and confirmed, while non-critical data points are corrected using statistical interpolation methods. Missing value processing and noise filtering can be implemented using existing technologies and will not be detailed here.

[0099] Considering the dimensional differences of different types of data in industrial control networks, a multi-modal normalization strategy is adopted for the cleaned data:

[0100] For continuous data, use the modified MinMax normalization:

[0101] x′=(xx min ) / (x max -x min +ε)

[0102] Where ε is the smoothing factor used to deal with the influence of extreme values, x is the original data, x min 、x max are the minimum and maximum values in the data set, and x' is the standardized data value.

[0103] For periodic data, phase normalization is used:

[0104] x′=2π*(xx start ) / T period

[0105] Where x is the original data, x start is the starting value, T period is the period length of the data, and x' is the data value after standardization (converted to the [0,2π] interval).

[0106] For discrete data, use one-hot encoding conversion:

[0107] x′=OneHot(x)

[0108] Where x is the original data, x' is the normalized data value, and the converted data will become a vector containing only 0 and 1, with only one position in the vector being 1.

[0109] The standardized parameters are updated online:

[0110]

[0111] in is the updated minimum and maximum value, x current is the current data value, x min 、x max The original minimum and maximum values

[0112] After standardization, preliminary feature extraction is performed, which mainly includes:

[0113] Statistical characteristics:

[0114] F stat =[mean(x),std(x),skew(x),kurt(x)]

[0115] Among them, mean(x) represents the mean of the data value, std(x) represents the variance of the data value, skew(x) represents the skewness, which describes the symmetry of the data distribution, kurt(x) represents the degree of skewness, which describes the degree of sharpness of the data distribution, and F stat are the extracted statistical features.

[0116] Timing characteristics:

[0117] F temp=[diff(x), rolling mean(x) ,rolling std(x) ]

[0118] Among them, diff(x) represents the difference of data, reflecting the rate of change; rolling mean(x) and rolling std(x) represents the mean and standard deviation of the sliding window, F temp is the extracted time domain feature.

[0119] The frequency domain features take the top-k frequency components:

[0120] F freq =FFT(x)[1:k]

[0121] Where FFT(x) is the fast Fourier transform, k represents the first k frequency components selected, F freq is the extracted frequency domain feature. These three types of features are screened by the feature importance score Sc:

[0122] Sc(f)=MI(f,y)*(1-max(|corr(f,f i )|))

[0123] Among them, f represents the feature to be evaluated, y is the target variable, MI(f,y) is the mutual information between feature f and target variable y, corr(f,f i ) is the correlation coefficient matrix between features, Sc(f) represents the final score of the feature, and redundant features are removed in this way.

[0124] Through the processing of the above three links, the data preprocessing module can effectively handle various quality issues of industrial control network data, provide a high-quality data foundation for subsequent feature extraction and anomaly detection, and dynamically adjust the processing strategy according to the characteristics of the data. At the same time, it improves the overall efficiency of the system through preliminary feature extraction.

[0125] In the data preprocessing of the present invention, the window size is adaptive, the parameters after standardization can be adaptively adjusted, and the appropriate standardization method can be selected according to different data types. The Sc(f) function dynamically evaluates the importance of features to determine the final three types of features, namely the statistical features, time series features, and frequency domain features after preprocessing.

[0126] Step 2: Spatial feature extraction

[0127] The spatial feature extraction module of the present invention (see Figure 2) adopts an improved Transformer architecture and incorporates prior knowledge specific to industrial control networks to enhance the model's ability to model spatial relationships between devices. Compared to traditional Transformers, this model incorporates three innovations tailored to the characteristics of industrial control networks: device role-aware encoding, a protocol-constrained self-attention mechanism, and topology-aware position encoding. This fully considers the functional attributes, communication specifications, and topological characteristics of devices in industrial control networks, thereby improving the accuracy and interpretability of anomaly detection.

[0128] First, the frequency domain feature F freq and statistical characteristics F stat Through the feature fusion function, the fusion feature F is obtained. combined1 :

[0129] F combined1 =αF freq +(1-α)F stat

[0130] Among them, α is an adjustable weight parameter used to balance the importance of frequency domain features and statistical features;

[0131] In industrial control networks, different devices have distinct roles and functional attributes, such as PLC controllers responsible for logic control, sensors for data acquisition, and actuators for control execution. This division of labor plays an important role in anomaly detection. For example, a sensor directly sending control commands to an actuator often indicates a potential anomaly. Therefore, this invention provides specialized device role-aware encoding that encodes device role information into a feature space, enabling the model to perceive and utilize this prior knowledge.

[0132] The fusion feature F combined1 For each device d in the industrial control network, its role coding is expressed as

[0133] E role (d) = W r ·R d +P d

[0134] Among them, E role (d) represents the k-dimensional role encoding vector of device d, where k is the number of dimensions of the role encoding and k is a hyperparameter that represents the encoding of the device role information into a k-dimensional vector; W r is the role embedding matrix, R d is the device role vector, P d Represents the location information of the device in the network. This encoding method can convert the role information of the device into a continuous feature representation, which facilitates subsequent feature extraction and fusion.

[0135] Device role vector R d Characterized by multiple dimensions, including device type features type (such as controllers, actuators, etc.), functional characteristics r func (such as data collection, control execution, etc.), importance characteristics r imp (reflecting the criticality of the device in the system) and the hierarchical characteristics r level (Indicates the position of the device in the control hierarchy.) This multi-dimensional characterization method can comprehensively characterize the role attributes of the device.

[0136] R d =β1r type +β2r func +β3r imp +β4r level

[0137] Among them, β1, β2, β3, and β4 are weight coefficients, and they satisfy β1+β2+β3+β4=1;

[0138] The components r that make up the device role vector type 、r func 、r imp 、r level All are normalized features, which can ensure the comparability of features in different dimensions. The specific normalization process is:

[0139] r norm =(r-μ r ) / σ r

[0140] where μ r and σ r are the mean and standard deviation of the corresponding feature dimensions, r is the original feature value, r norm is the normalized feature value. Normalization can eliminate the scale differences between different feature dimensions and improve the effect of feature fusion.

[0141] Industrial control networks have a relatively fixed topology, and the physical and logical distances between devices significantly influence communication behavior. This paper employs a graph-distance-based location encoding approach that not only considers the logical distances between devices in the topology graph but also incorporates geometric distances in physical space. This fixed topological structure information is encoded into the feature representation, providing more comprehensive location information.

[0142] The features after role encoding are subjected to topology-aware position encoding. The calculation formula of topology-aware position encoding TPE is:

[0143] TPE(i,j)=f(D ij )·cos(ωk ·d ij )

[0144] Among them, D ij is the shortest path distance between devices i and j in the topology graph, d ij is the Euclidean distance between devices i and j in physical space, f(·) is a monotonically decreasing distance mapping function, ω k is a learnable frequency parameter;

[0145] The distance mapping function adopts an exponential decay form:

[0146]

[0147] Where τ is an adjustable temperature parameter used to control the rate of distance attenuation.

[0148] The topology-aware position coding method in this invention can reflect the topological distance between devices. Long-distance communication has a lower weight than short-distance communication. By introducing physical distance information, abnormal communication behaviors that violate physical constraints can be identified. Finally, the learnable frequency parameter enables the model to adaptively adjust the granularity of distance coding.

[0149] Industrial control network communications have strict protocol specifications that define the permitted communication methods and frequencies between devices. Communication behaviors that violate these specifications often represent potential security threats. Based on this understanding, this paper designs an attention calculation method based on protocol constraints, incorporating protocol specifications as prior knowledge into the self-attention mechanism.

[0150] The features encoded by role and topology-aware position are processed by the self-attention mechanism based on protocol constraints. The process of the self-attention mechanism based on protocol constraints is: the protocol specification of industrial control network communication is introduced into the self-attention mechanism as prior knowledge. The self-attention A calculation formula is:

[0151]

[0152] Among them, M p is the protocol constraint matrix, d k is the key vector dimension, Q, K, V are query, key, and value matrices respectively. The protocol constraint matrix M p The three aspects of communication permission constraints, protocol compatibility constraints and communication frequency constraints are comprehensively considered.

[0153] Communication permission constraint M auth Reflects whether direct communication is allowed between devices. For device pair (i, j), if communication is allowed, then M auth(i, j) = 1, otherwise 0. This constraint can effectively identify unauthorized communication behavior. Protocol compatibility constraint M comp The protocol types supported by the devices are considered and quantified by calculating the similarity of the protocol sets between devices:

[0154] M comp(i,j) =sim(P i ,P j )

[0155] Communication frequency constraint M freq It reflects the standard communication frequency requirements between devices:

[0156] M freq (i,j)=min(1,f ij / f max )

[0157] where f ij is the standard communication frequency between devices i and j, f max is the maximum communication frequency in the system.

[0158] The final protocol constraint matrix is obtained through weighted fusion:

[0159] M p =w l M auth +w2M comp +w3M freq

[0160] where w l ,w2,w3 are weight coefficients, and satisfy w l +w2+w3=1. This fusion method allows the importance of different constraints to be adjusted according to specific application scenarios.

[0161] The device role-aware encoding and topology-aware position encoding are embedded in the position encoding of the Transformer architecture. After that, the self-attention mechanism based on the protocol constraint is processed according to the Transformer architecture to obtain the final spatial feature representation F. s ;

[0162] The final spatial feature representation F s for:

[0163] F s =Transformer(E role (d), TPE,M p ,F freq , F stat )

[0164] The spatial feature extraction module of this invention effectively captures the complex interactions between devices in industrial control networks, providing a reliable spatial feature representation for anomaly detection. This module not only considers the device's role attributes, communication specifications, and topology, combining both role and topology awareness, but also achieves adaptive fusion of different features through learnable parameters, thereby improving the accuracy and interpretability of anomaly detection. Experimental results demonstrate that compared to traditional methods, this module achieves significant improvements in both detection accuracy and false alarm rate.

[0165] Step 3: Temporal feature extraction

[0166] The temporal feature extraction module of the present invention is based on the Bi-LSTM architecture and is specifically optimized for the timing characteristics of industrial control network communications. Industrial control network communications have significant periodicity, regularity, and timing dependence, which are important indicators for anomaly detection. The temporal feature extraction module of this embodiment introduces: a periodicity-aware gating mechanism, an industrial control scene attention mechanism, and a multi-scale time window processing (see Figure 3 ) to improve the ability to detect abnormal timing patterns.

[0167] First, the time domain feature F temp and statistical characteristics F stat Through the feature fusion function, the fusion feature F is obtained. combined2 :

[0168] F combined2 =βF temp +(1-β)F stat

[0169] Among them, β is an adjustable weight parameter used to balance the importance of temporal features and statistical features.

[0170] Device communications in industrial control networks typically follow fixed time cycles, such as regular data collection by sensors and periodic command issuance by controllers. Deviations from these periodic patterns may indicate system anomalies or security threats. Based on this characteristic, the present invention employs a periodicity-aware gating mechanism to highlight the impact of periodicity.

[0171] The core of this mechanism is an adaptive gating unit, whose calculation formula is

[0172] g t =σ(W g ·[h t ||p t ]+b g )

[0173] h′ t =g t ⊙h t

[0174] Among them, g t is the gate value, h t is the hidden state at the current moment, p t is the periodic feature vector, σ is the sigmoid activation function, ⊙ represents element-by-element multiplication, W g is the weight matrix, b g is the bias term, h' t is the updated hidden state.

[0175] Periodic characteristic p t By performing Fourier transform on historical data:

[0176] p t =FFT(x t -w:t)

[0177] Where w is the sliding window size, x t is the time series data F combined2 .

[0178] In order to adapt to the communication cycles of different devices, the present invention adopts an adaptive window mechanism to dynamically adjust the w value:

[0179] w=max(w min ,min(w max ,T comm ))

[0180] Where T comm is the nominal communication cycle of the device, w min and w max are the lower and upper limits of the window size respectively. This adaptive mechanism ensures the effective capture of periodic patterns at different time scales, and obtains the gated feature x' t .

[0181] Industrial control systems exhibit different timing characteristics in different operating stages. For example, the communication modes in the startup stage, normal operation stage, and maintenance stage are significantly different. In order to accurately model such scenario-related timing dependencies, the present invention adopts an industrial control scenario attention mechanism. The process of the industrial control scenario attention mechanism is to aggregate historical state information to obtain the scenario context vector c. t , introducing the scene context vector c in the attention mechanism t Get the attention weight considering the industrial control scene, and then combine it with the fusion feature F combined2 Multiply to get the weighted feature F weighted ;

[0182] α t The calculation is based on the following formula

[0183] αt =softmax(v T tanh(W h h t +W c c t-1 ))

[0184] where h t is the hidden layer state at time t, c t-1 is the industrial control scene context vector at time t-1, W h 、W c and v are learnable parameters. The scene context vector c at time t t By aggregating historical status information, we can obtain:

[0185] c t =∑(α t ·h′ t ).

[0186] Abnormal behavior in industrial control networks can manifest at different time scales, ranging from millisecond-level communication delays to hour-level behavioral pattern deviations. To comprehensively capture these multi-scale features, this embodiment proposes a multi-scale time window processing mechanism.

[0187] This mechanism processes features from multiple time windows in parallel:

[0188] F ms (t)=∑(w n ·F n (t))

[0189] Among them, F n (t) is F combined2 The feature of the nth time scale after multi-window segmentation, w n is the corresponding weight coefficient; the weight coefficient is dynamically calculated by the following formula:

[0190] w n =softmax(v T tanh(W f F n (t)))

[0191] Where W f and v are learnable parameters, which enable the model to adaptively adjust the importance of different time scales according to the current state.

[0192] The gated feature x' t , weighted feature F weighted And the multi-scale feature F ms (t) The three are concatenated to obtain the temporal feature representation F t ; The final time feature represents F tfor

[0193] F t =Bi-LSTM(g t , F weighted ,F ms (t)).

[0194] The temporal feature extraction module of this invention effectively captures various temporal patterns in industrial control network communications, providing a reliable temporal feature representation for anomaly detection. This module not only considers the periodic nature of communications but also enhances its ability to model complex temporal patterns through scene perception and multi-scale processing, significantly improving the accuracy and real-time performance of anomaly detection.

[0195] Step 4: Feature Fusion

[0196] The fusion module of this invention is designed to effectively integrate the outputs of the spatial and temporal feature extraction modules, achieving adaptive fusion of spatiotemporal features. In industrial control network anomaly detection, the importance of temporal and spatial features changes dynamically with changes in system state and anomaly type. For example, spatial features may be more important when detecting unauthorized communications, while temporal features play a key role in detecting communication timing anomalies. Dynamic weight calculation and anomaly-sensitive features are used to enhance fusion effectiveness.

[0197] Considering the particularity of anomaly detection, the present invention has high sensitivity to abnormal patterns, and the sensitive fusion feature F fusion The calculation formula is:

[0198] F fusion =w s ·F s +w t ·F t +w a ·F a

[0199] where w s 、w t 、w a is the weight of each feature, F a is an abnormally sensitive feature and is calculated as follows:

[0200] F a =γ(F s ,F t )·D(F s ,F t ).

[0201] Here, γ(·) is the feature similarity function and D(·) is the feature difference vector. The feature similarity function is defined as:

[0202]

[0203] Where σ is the standard deviation parameter, ||F s -F t || is the Euclidean distance between eigenvectors.

[0204] The feature difference vector is calculated as:

[0205] D(F s ,F t )=ReLU(|F s -F t |-θ)

[0206] Where ReLU is the rectified linear unit activation function, and θ is the difference threshold vector, which is used to filter out small feature differences.

[0207] Sensitive fusion feature F fusion The weight w in the calculation formula s 、w t 、w a By expressing the time series feature F t , spatial feature representation F s , abnormally sensitive feature F a The three are determined by attention calculation, which adopts dynamic weight calculation method, and can adaptively adjust the importance weights of different features according to the current network status.

[0208] The self-attention mechanism is introduced to capture the interactive relationship between features, which can further improve the fusion effect:

[0209] A(F)=softmax(FW q (FW k ) T )FW v

[0210] Where F is the input feature, W q 、W k 、W v is the learnable transformation matrix.

[0211] The final fusion feature F final Through residual connection, we get:

[0212] F final =F fusion +A(F fusion )

[0213] The final fusion feature F final After processing by the adaptive normalization module, the normalized fusion feature F is obtained norm , ensuring the numerical stability of the final fusion feature:

[0214] F norm =LayerNorm(F final ,γ,β)

[0215] Where γ and β are learnable scaling and offset parameters. The normalization parameters are dynamically updated through batch statistics:

[0216] μ t =αμ t-1 +(1-α)μ batch

[0217] σ t =ασ t-1 +(1-α)σ batch

[0218] where μ t is the mean, σ t is the standard deviation, α is the momentum coefficient, μ batch , σ batch The statistical value of the current batch.

[0219] This adaptive normalization layer can effectively handle the dynamic changes of feature distribution and improve the generalization ability of the model.

[0220] The fusion module of this invention achieves intelligent fusion of spatiotemporal features, maintaining the expressive power of various features while enhancing sensitivity to abnormal patterns. It can flexibly adjust fusion strategies based on different scenarios and anomaly types, significantly improving the accuracy and reliability of anomaly detection. Experimental results show that compared with simple feature concatenation or fixed-weight fusion, the fusion module of this embodiment achieves significant improvements in both detection performance and generalization capabilities.

[0221] Step 5: Knowledge Distillation

[0222] The knowledge distillation module aims to effectively transfer the knowledge of the complex teacher model to the lightweight student model to achieve efficient deployment of the model. norm As input in the knowledge distillation process, the teacher model can obtain the complete context at the same time, thereby making more accurate judgments and predictions.

[0223] Step 6: Anomaly Detection

[0224] Real-time industrial control network traffic data is input into the lightweight student model to perform real-time anomaly detection of industrial control network traffic.

[0225] Example 2

[0226] In this embodiment, a time series feature importance scoring function is also introduced into the attention mechanism of the industrial control scene, so as to consider the attention weight of the industrial control scene multiplied by the importance scoring function as the final weight, and the final weight is used as the basis for the F combined2 Perform weighted summation on the vector after feature change according to the dimension of the final weight to obtain the weighted feature F weighted ,This approach can enhance the sensitivity to abnormal patterns and pay more attention to ,state changes in industrial control scenarios.

[0227] Importance scoring function:

[0228]

[0229] where μ s and σ s are the mean and standard deviation of the normal state respectively.

[0230] In the fusion module, w s 、w t 、w a The core formula for weight calculation is:

[0231]

[0232] Here, F s 、F t and F a Represent spatial features, temporal features and abnormal sensitivity features respectively, C is the context information vector, W ss 、W st 、W sc 、W ts 、W tt 、W tc 、W as 、W at 、W ac 、W aa 、W ta 、W sa is the learnable parameter matrix. V s 、V t 、V a are the attention vectors of temporal, spatial, and abnormally sensitive features, respectively. The context information vector C contains global information such as system operation status and device type distribution, which helps to more accurately evaluate feature importance.

[0233] C=σ(W d D+W n N+W h H+b c ))

[0234] Where D is the device status feature, which is collected periodically through device monitoring, N is the network topology feature, which is constructed in real time through network analysis, H is the historical behavior feature, which is extracted through time series analysis, and W d 、W n 、W h is the corresponding weight matrix, b c This multi-source fusion method enables the context information vector to fully reflect the operating status of the system and the status of each device, providing a global perspective for dynamic weight calculation.

[0235] to w s 、w t 、w a Perform smoothing and use the weights after smoothing to perform sensitive fusion of features F fusion Calculation, enhance the stability of weight calculation, w t The smoothing process is:

[0236] w′ t =γw t +(1-γ)w t -1

[0237] Where γ is the smoothing coefficient, which is used to control the speed of weight update, w t is the current weight, w' t is the smoothed weight. This smoothing process can avoid drastic fluctuations in weights and improve the stability of detection results. s 、w a Similarly, a smoothing mechanism is introduced.

[0238] Example 3

[0239] In this embodiment, knowledge distillation adopts a hierarchical knowledge distillation framework, including spatial knowledge distillation, temporal knowledge distillation, and task-specific knowledge distillation. This framework not only considers general feature representation and prediction output, but also pays special attention to the specialized knowledge and constraints of industrial control systems.

[0240] Spatial knowledge distillation focuses on the migration of interaction relationships and topological structure information between devices, including feature-level distillation loss, relationship consistency loss, and topology preservation loss. The feature-level distillation loss is:

[0241]

[0242] Among them, T s and S s Represent the spatial feature representations of the teacher model and the student model respectively;

[0243] In order to maintain the structural relationship of features, the relationship consistency loss is introduced, which is:

[0244] L relation =||G t (T s )-G s (S s )||1

[0245] Among them, G t (·) and G s (·) represents the construction function of the feature relationship graph between the teacher model and the student model, which is obtained by calculating the similarity matrix between the feature vectors.

[0246] At the same time, considering the topological constraints of the industrial control network, a topology preservation loss is introduced, which is:

[0247] L topo =KL(P t ||P s )+λ t ·R topo (S s )

[0248] Among them, P t and P s are the topological prediction distributions of the teacher model and the student model, R topo is the topological regularization term, KL is the Kullback-Leibler divergence, λ t is the weight coefficient.

[0249] Temporal knowledge distillation focuses on transferring time series patterns and dynamic behavior characteristics, including hidden state distillation loss, temporal relationship loss, and periodicity preservation loss. It is a multi-scale temporal knowledge transfer mechanism.

[0250] Hidden state distillation loss:

[0251] L hidden =MSE(h t ,h s )+λ h ·KL(P(h t )||P(h s ))

[0252] Among them, h t and h s are the hidden states of the teacher model and the student model, P(·) represents the state distribution, MSE is the mean square error, and λ h is the weight coefficient;

[0253] In order to maintain the temporal dependency, a temporal relationship loss is introduced, which is:

[0254] L temporal =∑|rt (i,j)-r s (i,j)|

[0255] Among them, r t (i,j) and r s (i, j) represents the strength of the relationship between the teacher model and the student model at time steps i and j.

[0256] The periodic hold loss is:

[0257]

[0258] Among them, T seq and S seq represents the time series segments of the teacher and student models, and FFT(·) represents the fast Fourier transform, which is used to capture the periodic characteristics of the signal.

[0259] Aiming at the special needs of anomaly detection in industrial control networks, a task-specific knowledge transfer mechanism is adopted. Task-specific knowledge distillation includes anomaly discrimination knowledge distillation loss and boundary perception loss.

[0260] The abnormality discrimination knowledge distillation loss is:

[0261] L anomaly =CE(y t ,y s )+λ a ·KL(q t ||q s )

[0262] where y t 、y s is the abnormality discrimination result, q t ,q s is the abnormal probability distribution, CE is the cross entropy, λ a is the weight coefficient.

[0263] In order to improve the recognition ability of boundary samples, boundary perception loss is introduced:

[0264]

[0265] Among them, w i is the sample weight, giving higher weight to boundary samples, f t (.) and f s (.) represent the feature extraction functions of the teacher model and the student model respectively, f t (x i ) and f s (x i ) is the boundary sample x of the teacher model and the student model i Extracted feature representation

[0266] Then the comprehensive loss function is:

[0267] L total =α s (L feature +L relation +L topo )+α t (L hidden +L temporal +L periodic )+α a (L anomaly +L boundary )

[0268] where α s , α t , α a is the weight coefficient of each level loss, which is dynamically adjusted through the validation set:

[0269] α m =softmax(v m performance m )

[0270] performance m Represents the effect measurement of knowledge transfer at each level, v m is a weight vector parameter, which is a learnable parameter used to adjust the importance of knowledge transfer at different levels.

[0271] A temperature-regulated soft labeling mechanism is used to constrain the probability of abnormal distribution and ensure the stability of knowledge transfer:

[0272] q i =softmax(z i / T)

[0273] where z i is the logits output, q i is the temperature-adjusted probability distribution, where i is the i-th element of the input vector and T is the temperature parameter used to control the smoothness of the soft label. The temperature parameter is dynamically adjusted according to the training progress:

[0274]

[0275] Where T max is the initial temperature, γ is the decay rate, epoch is the current round, total epochs For the total rounds.

[0276] The above three layers use the soft label mechanism respectively, and the topology preservation loss in spatial knowledge distillation is P t and P sIt is a soft label form, and the hidden state distillation P(h t ) and P(h s ) are the soft labels of the teacher and student models, respectively, and q t ,q s A soft label mechanism is used to represent the anomaly probability distribution of the teacher and student models.

[0277] Through multi-level knowledge distillation, efficient transfer of teacher model knowledge is achieved, so that the lightweight student model significantly reduces the computational complexity and storage requirements while maintaining high detection performance.

[0278] Example 4

[0279] In this embodiment, the anomaly detection process adopts a multi-dimensional scoring mechanism, which comprehensively considers the degree of anomaly of spatial characteristics, temporal characteristics, and specific task characteristics. The calculation formula of the total anomaly score Score(x) is:

[0280] Score(x)=β1S s (x)+β2S t (x)+β3S a (x)

[0281] Among them, S s 、S t and S a They represent the abnormal scores of spatial features, temporal features, and specific task features, respectively. β1, β2, and β3 are adaptive weight coefficients. m Dynamic updates via:

[0282]

[0283] m, i∈{s,t,a},v s Represents the importance score of spatial features, v t Represents the importance score of the time series feature, v a The importance score of a specific task feature is dynamically adjusted based on historical detection results.

[0284] The calculation of anomaly scores for spatial feature representation, temporal features, and task-specific features all uses a scoring method based on Mahalanobis distance:

[0285]

[0286] Among them, m∈{s,t,a}, μ m and Σ m are the mean vector and covariance matrix of the corresponding features respectively.

[0287] The covariance matrix is maintained through incremental updates to improve computational efficiency:

[0288]

[0289] Where η is the learning rate, is the updated covariance matrix;

[0290] The detection decision rule is:

[0291] if

[0292] Score(x)>θ dynamic

[0293] Return exception

[0294] otherwise:

[0295] Return to normal

[0296] Dynamic threshold θ dynamic Update via:

[0297] θ dynamic =μ score +r·σ score

[0298] Among them, μ score and σ score are the mean and standard deviation of historical scores respectively. r is an adjustable sensitivity parameter that controls the looseness or strictness of the threshold and determines the sensitivity of anomaly detection. The larger the r value, the more conservative the detection, and the smaller the r value, the more sensitive the detection. It needs to be adjusted according to the specific application scenario.

[0299] This invention uses a sliding window mechanism to smooth decision results and improve detection stability. An anomaly alarm is triggered only when the prediction results of Q consecutive samples exceed the dynamic threshold. Q = 10 is suitable for more stringent judgment criteria, Q = 15 is suitable for scenarios with high reliability requirements, and Q = 20 is suitable for scenarios with extremely high reliability requirements. The selection of the Q value needs to consider the system's tolerance for false alarms. Generally, the larger the Q, the lower the false alarm rate, and the smaller the Q, the more timely the response. The sampling frequency of the data should also be considered. For high-frequency sampling, a larger Q can be selected.

[0300] At the same time, an exponential decay factor is introduced to update historical statistics:

[0301]

[0302]

[0303] Among them, α is the smoothing coefficient, which is used to control the influence of historical information. and Indicates the updated mean and standard deviation, Score current is the total anomaly score of the current sample.

[0304] In addition, the present invention adopts an adaptive alarm suppression mechanism, which avoids duplicate alarms and improves the practicality of detection by recording the time and type of the most recently triggered alarm, setting the minimum warning interval according to the recorded alarm time, and merging the same alarm type according to the alarm type.

[0305] Any matters not described in the present invention are applicable to the prior art.

Claims

1. A method for detecting anomalies in industrial control networks considering prior knowledge, characterized in that: The method includes the following: Obtain industrial control network traffic data and perform preprocessing to obtain preprocessed network traffic features, including preprocessed frequency domain features F freq , statistical features after preprocessing F stat And the preprocessed time series features F temp ; Build a lightweight anomaly detection model based on spatiotemporal features, including spatial feature extraction module, temporal feature extraction module, fusion module, knowledge distillation module, and anomaly detection module; The spatial feature extraction module is used to extract the pre-processed frequency domain features F freq and statistical characteristics F stat Processing is performed to obtain the spatial feature representation F s The spatial feature extraction module considers the functional attributes, communication specifications and topological structure characteristics of the equipment in the industrial control network, including device role-aware coding, self-attention mechanism based on protocol constraints and topological-aware position coding; The device role perception coding encodes the device role information into the feature space. The specific process is: frequency domain feature F freq and statistical characteristics F stat Through feature fusion, we obtain the fusion feature F combined1 ; The fusion feature F combined1 For each device d in the industrial control network, its role coding is expressed as E role (d)=W r ·R d +P d Among them, E role (d) represents the k-dimensional role encoding vector of device d, where k is the number of dimensions of the role encoding, indicating that the device role information is encoded into a k-dimensional vector; W r is the role embedding matrix, R d is the device role vector, P d Indicates the location information of the device in the network; The features are normalized by multiple dimensions, and the normalized device type features r type , functional characteristics r func , the importance characteristic that reflects the criticality of the equipment in the system imp and the hierarchical feature r that represents the position of the device in the control hierarchy level Construct the device role vector R according to the following formula d ; R d ＝β1r type +β2r func +β3r imp +β4r level Among them, β1, β2, β3, and β4 are weight coefficients, and they satisfy β1+β2+β3+β4=1; The features after role encoding are subjected to topology-aware position encoding. The topology-aware position encoding considers the logical distance of the devices in the topology graph and combines it with the geometric distance of the physical space. It adopts a graph distance-based position encoding method for position encoding. The calculation formula of topology-aware position encoding TPE is: TPE(i,j)=f(D ij )·cos(ω k ·d ij ) Among them, D ij is the shortest path distance between devices i and j in the topology graph, d ij is the Euclidean distance between devices i and j in physical space, f(·) is a monotonically decreasing distance mapping function, ω k is a learnable frequency parameter; The features encoded by role and topology-aware position are processed by the self-attention mechanism based on protocol constraints. The self-attention mechanism based on protocol constraints introduces the protocol specifications of industrial control network communication as prior knowledge into the self-attention mechanism. The protocol constraint matrix M p Comprehensively consider the communication permission constraint M auth , protocol compatibility constraint M comp and communication frequency constraint M freq Three aspects, M p =w l M auth +w2M comp +w3M freq Among them, w l ,w2,w3 are weight coefficients, and satisfy w l +w2+w3=1; The device role-aware encoding and topology-aware position encoding are embedded in the position encoding of the Transformer architecture. After that, the self-attention mechanism based on the protocol constraint is processed according to the Transformer architecture to obtain the final spatial feature representation F. s ; The time series feature extraction module is used to extract the pre-processed time series features F temp and statistical characteristics F stat Processing is performed to obtain the time series feature representation F t ; The temporal feature extraction module adopts Bi-LSTM architecture; The fusion module is used to represent the time series feature F t and spatial feature representation F s Perform fusion to obtain the normalized fusion feature F norm ; The knowledge distillation module includes a teacher model and a student model. The teacher model is based on the normalized fusion feature F norm As input, train the student model; The anomaly detection module performs anomaly detection on real-time industrial control network traffic data using the output of the trained student model.

2. The method according to claim 1, characterized in that The temporal feature extraction module includes a periodic perception gating mechanism, an industrial control scene attention mechanism, and multi-scale time window processing; The time domain feature F temp and statistical characteristics F stat The fusion feature F is obtained by integration combined2 The process of the periodic sensing gating mechanism is as follows: Perform Fourier transform on historical data to extract periodic features p t : p t =FFT(x t -w:t) Where w is the sliding window size; x t is time series data, that is, fusion feature F combined2 ; The periodic characteristic p t An adaptive gating unit is introduced, and the calculation formula of the adaptive gating unit is: g t =σ(W g ·[h t ||p t ]+b g ) h′ t =g t ⊙h t Among them, g t is the gate value, h t is the hidden state at the current moment, p t is the periodic feature, σ is the sigmoid activation function, ⊙ represents element-by-element multiplication, W g is the weight matrix, b g is the bias term, h' t is the updated hidden layer state; Get the feature x' after gate processing t ; The process of the industrial control scene attention mechanism is to aggregate historical state information to obtain the scene context vector c t , introducing the scene context vector c in the attention mechanism t Get the attention weight considering the industrial control scene, and then combine it with the fusion feature F combined2 Multiply to get the weighted feature F weighted ; The process of the multi-scale time window processing mechanism is: parallel processing of the features of multiple time windows to obtain the multi-scale feature F ms (t): F ms (t)=∑(w n ·F n (t)) Among them, F n (t) is F combined2 The features of the nth time scale after multi-window segmentation; w n is the corresponding weight coefficient, through F n (t) performing attention calculation; The gated feature x' t , weighted feature F weighted And the multi-scale feature F ms (t) The three are concatenated to obtain the temporal feature representation F t。 3. The method according to claim 2, characterized in that Scene context vector c t The determination process is: Set the initial scene context vector to c0, and the previous moment's industrial control scene context vector c t-1 and the current hidden state h t Perform attention weight calculation to obtain the attention weight α of the current industrial control scenario t , and then update the hidden state of all different moments not greater than the time t and the attention weight α of the industrial control scene at the corresponding moment t Multiply and accumulate the sum to get the scene context vector c at the current moment t .

4. The method according to claim 1, wherein The size of the sliding window w in the periodic perception gating mechanism uses an adaptive window mechanism to dynamically adjust the w value: w=max(w min ,min(w max ,T comm )) Among them, T comm is the nominal communication cycle of the device, w min and w max They are the lower and upper limits of the window size respectively.

5. The method according to claim 1, characterized in that Communication permission constraint M auth Reflects whether direct communication is allowed between devices. For device pair (i, j), if communication is allowed, M auth (i, j) = 1, otherwise 0, effectively identifying unauthorized communication behavior; Protocol compatibility constraint M comp Considering the protocol types supported by the device, we quantify it by calculating the similarity sim of the protocol set between devices: M comp(i,j) =sim(P i ,P j ) Among them, P i ,P j Represents the respective protocol set of device pair (i, j); Communication frequency constraint M freq Reflects the standard communication frequency requirements between devices: M freq (i,j)=min(1,f ij / f max ) Among them, f ij is the standard communication frequency between devices i and j, f max is the maximum communication frequency in the system.

6. The method according to claim 1, characterized in that The distance mapping function adopts an exponential decay form: Where τ is an adjustable temperature parameter used to control the rate of distance attenuation; x is a variable.

7. A method for detecting anomalies in industrial control networks taking into account prior knowledge, characterized in that: The method includes the following: Obtain industrial control network traffic data and perform preprocessing to obtain preprocessed network traffic features, including preprocessed frequency domain features F freq , statistical features after preprocessing F stat And the preprocessed time series features F temp ; Build a lightweight anomaly detection model based on spatiotemporal features, including spatial feature extraction module, temporal feature extraction module, fusion module, knowledge distillation module, and anomaly detection module; The spatial feature extraction module is used to extract the pre-processed frequency domain features F freq and statistical characteristics F stat Processing is performed to obtain the spatial feature representation F s The spatial feature extraction module considers the functional attributes, communication specifications and topological structure characteristics of the equipment in the industrial control network; the temporal feature extraction module is used to extract the preprocessed temporal features F temp and statistical characteristics F stat Processing is performed to obtain the time series feature representation F t ; The processing process of the fusion module is: the time series feature representation F t and spatial feature representation F s The abnormal sensitive feature F is obtained by multiplying the results of the feature similarity function and the feature difference vector respectively. a ; Then the sensitive fusion feature F fusion The calculation formula is: F fusion =w s ·F s +w t ·F t +w a ·F a Among them, w s 、w t 、w a is the weight of each feature, and the time series feature is represented by F t , spatial feature representation F s , abnormally sensitive feature F a The three perform attention calculation to determine; The anomaly detection module is used to perform anomaly detection on real-time industrial control network traffic data.

8. The method according to claim 7, characterized in that The feature similarity function is defined as: Where σ is the standard deviation parameter, ||F s -F t || is the Euclidean distance between feature vectors; γ(·) is the feature similarity function; The calculation formula of the feature difference vector is: D(F s ,F t )=ReLU(|F s -F t |-θ) Where ReLU is the rectified linear unit activation function; θ is the difference threshold vector used to filter small feature differences; D(·) is the feature difference vector.

9. The detection method according to claim 7, characterized in that to w s 、w t 、w a Perform smoothing and use the weights after smoothing to perform sensitive fusion of features F fusion Calculation of w t The smoothing process is: w′ t =γw t +(1-γ)w t -1 Where γ is the smoothing coefficient, which is used to control the speed of weight update, w' t is the weight after smoothing; After sensitive fusion, the feature F fusion Input the self-attention module, and perform residual connection on the input and output of the self-attention module, and then process it through the adaptive normalization module to obtain the normalized fusion feature F norm .

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 9 can be implemented.

Images