Industrial communication anomaly detection method based on personalized federal learning
Through personalized federated learning and private blockchain technology, an adaptive variational autoencoder model is built, which solves the problem of insufficient data privacy and generalization capabilities in traditional methods, and realizes efficient detection of industrial communication anomalies and data privacy protection.
Patent Information
- Application Number
- CN202510551519.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-29
- Publication Date
- 2025-08-15
AI Technical Summary
In the face of a big data environment, data privacy is difficult to guarantee, and the global model of traditional federated learning has poor generalization ability under heterogeneous data, making it difficult to effectively detect abnormal behaviors in industrial communications.
Using a personalized federated learning method, the industrial control host is used as a node to build a personalized variational autoencoder model, and store weight information through a private blockchain, and use the optimal variational autoencoder model to perform reconstruction probability calculations to detect abnormal communication.
It realizes efficient detection of industrial communication abnormalities in heterogeneous data environments, ensures data privacy and authenticity of detection models, adapts to known and unknown attacks, and improves detection capabilities.
Smart Images
Figure CN120498725A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of industrial control system network security, and more particularly to an industrial communication anomaly detection method based on personalized federated learning. Background Art
[0002] With the integration and development of new-generation information technologies such as the Internet of Things, cloud computing, and big data with traditional industrial operation technologies, the original inherent closedness of traditional industrial control systems has been broken, and industrial control networks have gradually been interconnected with the Internet, third-party networks, etc. However, industrial control systems were mainly designed with reliability and availability in mind, and lacked relevant information security designs, sacrificing security in exchange for real-time performance. Therefore, the gradually exposed vulnerabilities of industrial control systems have exposed them to many information security issues such as viruses, Trojans, and backdoor attacks. In particular, in recent years, industrial information security incidents have shown an overall upward trend, which has caused huge economic losses and serious social impacts.
[0003] Security threats to industrial control systems include not only known attacks with signature labels but also unknown attacks exploiting potential "zero-day" vulnerabilities. The advantage of anomaly detection lies in its ability to detect new intrusions without requiring much prior knowledge. Therefore, industrial anomaly detection has become a research hotspot in industrial control system information security. Currently, typical industrial anomaly detection methods include statistical-based anomaly detection, model-based anomaly detection, machine learning-based anomaly detection, and deep learning-based anomaly detection. These methods share the ability to perform multi-dimensional, fine-grained analysis of network traffic and behavior, establish a normalized behavioral model for industrial production processes, and detect behaviors that deviate from business processes by establishing behavioral baselines. This provides early warning of anomalous behavior before security incidents occur, thereby minimizing security risks to industrial control systems.
[0004] In recent years, with the expansion of traffic data in industrial control networks, data privacy and security have received increasing attention. While statistical, model-based, and machine learning-based anomaly detection methods can provide good anomaly detection capabilities from a specific perspective in industrial network communications, their applicability to big data remains questionable. Traditional deep learning anomaly detection methods require the centralization of traffic data from multiple terminal devices to a central server for training, which can easily lead to data leakage and compromise data privacy. Therefore, how to leverage network traffic data from different sources to jointly train network anomaly traffic detection models while protecting data privacy is an urgent problem. Among the many deep learning methods, federated learning is an effective approach to addressing the problem of jointly training models using multi-source data. Its purpose is to perform collaborative training without sharing private data. Instead of centrally computing the data required for model training, encrypted gradient-related data is transmitted, allowing the collaborative training of the same model using data from multiple sources. However, traditional federated learning uses an aggregation algorithm to generate a global model for all nodes in the federated network. This approach makes the global model poorly convergent for heterogeneous data. In the presence of heterogeneous local data distribution, it will reduce the performance of the global model on a single node, making the generalization ability of the global model worse. Therefore, it is necessary to generate a personalized model for each federated network node to improve performance. Summary of the Invention
[0005] A further object of the present invention is to provide an industrial communication anomaly detection method based on personalized federated learning. This method is based on the idea of federated learning, takes the industrial control host in the industrial control network as a node of the federated network, and constructs a personalized variational autoencoder model as an anomaly detection engine for the communication data of different process flows or links that each industrial control host is responsible for. The weight information of each model is generated by a trained super network, and the weight information is stored in a shared chain using a private blockchain. Finally, the optimal variational autoencoder model is used to reconstruct the real-time communication data and compare it with the set threshold to discover abnormal communication conditions in the industrial control network. Through the above method, the present invention can, on the one hand, construct an adaptive personalized variational autoencoder model for the communication data characteristics of different process flows or links, detect industrial communication anomalies caused by malicious attacks or misoperations and generate alarms, and on the other hand, it can utilize the data privacy protection characteristics of the blockchain to ensure the authenticity of the anomaly detection engine in each node.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: a method for detecting anomalies in industrial communications based on personalized federated learning, comprising the following steps:
[0007] Step 1) Initialization preprocessing: Capture real-time transmitted data packets from the industrial control system network; perform deep packet parsing at the protocol level on the captured data packets to extract fields related to industrial communication anomaly detection; construct the extracted field information into data samples in a unified format, and then obtain the final data samples after data standardization or normalization.
[0008] Step 2) Selection and training of personalized anomaly detection models;
[0009] Step 2.1) Personalized selection of the variational autoencoder model: Using the industrial control host in the industrial control network as the node of the federated network, using the communication data of the process flow or link under each node's responsibility, preliminarily select the most suitable variational autoencoder for the corresponding node for anomaly detection.
[0010] Step 2.1.1) In the offline meta-learning phase, a meta-learning method is used to generate an evaluation function, and the labeled historical dataset is used to train the evaluation function. The specific definition of the evaluation function is as follows:
[0011] f val :X i ,λ j ,O i,j →P i,j ,i∈{1,...,N},j∈{1,...,m}
[0012] Among them, f val is the evaluation function, X i is the i-th historical dataset with labels removed, λ j is the hyperparameter of the jth candidate model, O i,j is the outlier score output by the j-th candidate model on the i-th historical dataset, P i,j is the performance of the j-th candidate model on the i-th historical dataset;
[0013] Step 2.1.2) In the online model selection phase, the trained evaluation function is used to select the optimal variational autoencoder model for each node. The ultimate goal of the selection is to find the initial optimal model hyperparameters:
[0014]
[0015] Among them, λ * is the initial optimal model hyperparameter, S is the search space of hyperparameter, f val is the evaluation function after training, X test is the unlabeled test dataset, i.e. the data sample finally obtained in step 1), λ is a hyperparameter, For the model with hyperparameter λ in X test The outlier score of the above output.
[0016] Step 2.2) Hypernetwork training and node model weight generation: The node's variational autoencoder model is trained locally using the data sample finally obtained in step 1). A hypernetwork is established in all nodes. The hypernetwork is trained based on the weight changes generated by the local training of each node's variational autoencoder model. The hypernetwork is used to update the weight of each node model until the model converges or meets the performance requirements, resulting in the final variational autoencoder model. A private blockchain is established in all nodes to store the weight information of each node model.
[0017] The hypernetwork is a deep neural network that updates the weights of the target model. Its input is the node representation vector of the variational autoencoder model, and its output is the weight information of the variational autoencoder model of the node.
[0018] The node representation vector is a node descriptor, which is a trainable embedding vector or a fixed vector;
[0019] The hypernetwork is a node in the private blockchain, and the gradient information and weight information generated by the hypernetwork during the node model weight update process are synchronously stored in the private blockchain.
[0020] Step 3) Real-time anomaly detection: Each node captures and analyzes industrial communication data in real time. After data preprocessing, it uses the variational autoencoder model as an anomaly detection engine to calculate the reconstruction probability, compare the reconstruction probability with the set threshold, determine whether an anomaly occurs, and issue an alarm.
[0021] Step 3.1) Each node captures the communication data of the process or link it is responsible for in real time, analyzes and extracts key information according to the industrial communication protocol, and forms the input data sample;
[0022] Step 3.2) Use the encoder part of the variational autoencoder model to generate the distribution of the latent variable corresponding to the sample; the latent variable distribution is generated as follows:
[0023]
[0024] Among them, f θ is the encoder, z is the latent variable, x (i) is the i-th sample in the data sample, z (i) is x (i) The corresponding hidden variable, z (i) The distribution of and are z (i) the mean and variance of the distribution;
[0025] 3.3) Extract L samples from the distribution of latent variables. Based on the L extracted latent variables, use the decoder part of the variational autoencoder model to generate the corresponding distribution of reconstructed samples. The reconstructed sample distribution is generated as follows:
[0026]
[0027] Among them, g φ is the decoder, x is the reconstructed sample, z (i,l) For z (i) The lth sample drawn from the distribution of Based on z (i,l) The generated reconstruction samples, The distribution of and They are the mean and variance of the distribution;
[0028] 3.4) Calculate the reconstruction probability of the sample based on the mean and variance of the reconstructed sample distribution and compare it with the set threshold. If the reconstruction probability is less than the set threshold, it is judged as an anomaly. The reconstruction probability calculation method is as follows:
[0029]
[0030] Among them, L is the (i) The number of latent variable samples drawn from the distribution, p θ is the reconstruction probability, x (i) is the i-th sample in the data sample, and They are The mean and variance of the distribution.
[0031] The beneficial effects of the present invention are:
[0032] 1. Compared with the existing technology, the present invention discloses an industrial communication anomaly detection method based on personalized federated learning. This method makes up for the shortcomings of traditional federated learning in anomaly detection applications. It not only takes into account the heterogeneity between communication data in different process flows or links, but also can construct adaptive optimal variational autoencoders for industrial control hosts in different process flows or links, thereby improving the anomaly detection capability.
[0033] 2. This method uses meta-learning to generate an evaluation function, solving the problem of personalized selection of variational autoencoder models for different process flows or links. At the same time, the initial optimal model hyperparameters obtained through the evaluation function can save the time overhead of model pre-training.
[0034] 3. This method uses a personalized variational autoencoder model as the anomaly detection engine and employs a central hypernetwork to update weight information for different anomaly detection engines. This not only allows different anomaly detection engines to share parameters but also maintains the flexibility of the personalized model to a certain extent.
[0035] 4. During the node model weight update process, this method synchronously stores the gradient information and weight information generated by the super network in the private blockchain, which not only ensures the privacy and immutability of the data, but also prevents malicious nodes from uploading incorrect parameters, ensuring the authenticity of the anomaly detection engine in each node.
[0036] 5. Compared with traditional autoencoders, the variational autoencoder model used in this method is more robust to the noise in the data, can learn the potential representation of the data, and thus generate data that is close to the real data distribution, with better performance.
[0037] 6. This method can not only detect and alarm known intrusion behaviors and unauthorized behaviors in industrial control networks, but also detect unknown attacks that exploit zero-day vulnerabilities in industrial control networks to a certain extent, adapting to the hidden and unpredictable characteristics of unknown industrial control network attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] Figure 1 This is a schematic diagram of an embodiment of the method of the present invention being deployed in an industrial control network.
[0039] Figure 2 Schematic diagram of the basic model of the method of the present invention.
[0040] Figure 3 Schematic diagram of the main execution process of offline meta-learning in the model selection process of the method of the present invention.
[0041] Figure 4 Schematic diagram of the main execution process of online model selection in the model selection process of the method of the present invention. DETAILED DESCRIPTION
[0042] A personalized federated learning-based industrial communication anomaly detection method includes three key steps:
[0043] 1) Personalized selection of variational autoencoder models: Using industrial control hosts in an industrial control network as nodes in the federated network, we use the communication data from the process flow or link that each node is responsible for to preliminarily select the most suitable variational autoencoder for that node for anomaly detection.
[0044] The selection process of the variational autoencoder model for each node is as follows:
[0045] 1.1) In the preprocessing stage, a meta-learning method is used to generate an evaluation function, and the evaluation function is trained using offline data. The specific definition of the evaluation function is as follows:
[0046] f val :X i ,λ j ,O i,j →P i,j ,i∈{1,...,N},j∈{1,...,m}
[0047] Among them, f val is the evaluation function, X i is the i-th historical dataset with labels removed, λ j is the hyperparameter of the jth candidate model, O i,j is the outlier score output by the j-th candidate model on the i-th training dataset, P i,j is the performance of the j-th candidate model on the i-th training dataset.
[0048] 1.2) In the model selection phase, the trained evaluation function is used to select the optimal variational autoencoder model for each node. The ultimate goal of the selection is to find the initial optimal model hyperparameters:
[0049]
[0050] Among them, λ * is the initial optimal model hyperparameter, S is the search space of hyperparameter, f val is the evaluation function after training, X test is the test data set, λ is the hyperparameter, For the model with hyperparameter λ in X test The outlier score of the above output.
[0051] 2) Hypernetwork training and node model weight generation: A hypernetwork is established across all nodes. The hypernetwork is trained based on each node's variational autoencoder model and the weights of each node model are updated using the hypernetwork until the model converges or meets performance requirements. In addition, a private blockchain is established across all nodes to store the weight information of each node model.
[0052] The hypernetwork is a deep neural network whose main function is to update the weights of the target model. Its input is the node representation vector of the variational autoencoder model, and its output is the weight information of the node's variational autoencoder model.
[0053] The representation vector of a node is a node descriptor, which can be a trainable embedding vector or a fixed vector.
[0054] The hypernetwork is a node in the private blockchain, and the gradient information and weight information generated by the hypernetwork during the node model weight update process are synchronously stored in the private blockchain.
[0055] 3) Anomaly detection with real-time reconstruction probability calculation: Each node captures and analyzes industrial communication data in real time, uses a variational autoencoder model as an anomaly detection engine, calculates the reconstruction probability, compares the reconstruction probability with the set threshold, determines whether an anomaly occurs, and issues an alarm.
[0056] The anomaly detection process based on real-time reconstruction probability calculation is as follows:
[0057] 3.1) Each node captures the communication data of the process or link it is responsible for in real time, analyzes and extracts key information according to the industrial communication protocol, and forms the input data sample;
[0058] 3.2) Use the encoder part of the variational autoencoder model to generate the distribution of latent variables corresponding to the sample;
[0059] 3.3) Extract L samples from the distribution of latent variables, and use the decoder part of the variational autoencoder model to generate the corresponding distribution of reconstructed samples based on the L extracted latent variables;
[0060] 3.4) Calculate the reconstruction probability of the sample based on the mean and variance of the reconstructed sample distribution and compare it with the set threshold. If the reconstruction probability is less than the set threshold, it is judged as an anomaly.
[0061] The latent variable distribution is generated as follows:
[0062]
[0063] Among them, f θ is the encoder, z is the latent variable, x (i) is the i-th sample in the data sample, z (i) is x (i) The corresponding hidden variable, z (i) The distribution of and are z (i) The mean and variance of the distribution.
[0064] The reconstructed sample distribution is generated as follows:
[0065]
[0066] Among them, g φ is the decoder, x is the reconstructed sample, z (i,l) For z (i) The lth sample drawn from the distribution of Based on z (i,l) The generated reconstruction samples, The distribution of and They are The mean and variance of the distribution.
[0067] The reconstruction probability is calculated as follows:
[0068]
[0069] Among them, L is the (i) The number of latent variable samples drawn from the distribution, p θ is the reconstruction probability, x (i) is the i-th sample in the data sample, and They are The mean and variance of the distribution.
[0070] Example 1: The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.
[0071] The method of the present invention belongs to the category of information security detection and protection of industrial control systems. Figure 1 A schematic diagram illustrates an embodiment of the method of the present invention deployed in an industrial control network. As shown, the method establishes a federated network between different terminal devices in the industrial control network. Each terminal device serves as a node in the federated network, responsible for collecting control communication data for its own communication segment. An evaluation function, derived through an offline meta-learning method, is deployed on the terminal devices. Based on the collected communication data, each terminal device uses the evaluation function to generate the best-performing personalized anomaly detection model for model training. The gradient and weight information generated during training is uploaded to the blockchain. Blockchain nodes can be selected from either terminal devices in the federated network or edge devices. A central supernetwork can be deployed on edge devices with high computing power. The supernetwork is used to generate weights for each anomaly detection model, and the trained personalized anomaly detection model is finally deployed on the terminal devices. Terminal devices implementing the method capture and analyze communication data in real time, identifying intrusions, unauthorized activities, or misoperations interspersed with normal process operations in the industrial control system and generating alarms.
[0072] The present invention provides an industrial communication anomaly detection method based on personalized federated learning. Figure 2, shows a basic model of an industrial communication anomaly detection method based on personalized federated learning. The model is mainly divided into three parts: initialization preprocessing, selection and training of personalized anomaly detection model, and real-time anomaly detection. In the initialization preprocessing part, for each communication data in the network, deep packet parsing technology is used to extract relevant field information according to the protocol format specified by the industrial communication protocol, and construct data samples for model training. In the selection and training part of personalized anomaly detection model, the model is selected first, which is divided into two steps. The first step is to generate an evaluation function through offline meta-learning, see Figure 3 , which shows a schematic diagram of the main execution process of offline meta-learning during the model selection process in the method of the present invention. The hypernetwork generates weights for candidate models based on their hyperparameters. The candidate models then generate outlier scores based on the unlabeled historical dataset. This score is evaluated against the historical dataset labels to determine the candidate model's performance on the dataset. Finally, an evaluation function is generated that maps the model parameters, the input unlabeled dataset, and the outlier scores to model performance.
[0073] The formula for the evaluation function is as follows:
[0074] f val :X i ,λ j ,O i,j →P i,j ,i∈{1,...,N},j∈{1,...,m} (1)
[0075] Among them, f val is the evaluation function, X i is the i-th historical dataset with labels removed, λ j is the hyperparameter of the jth candidate model, O i,j is the outlier score output by the j-th candidate model on the i-th historical dataset, P i,j is the performance of the j-th candidate model on the i-th historical dataset.
[0076] The second step is online model selection, see Figure 4 Figure 1 shows the main execution process of online model selection in the model selection method of the present invention. It mainly consists of two parts: hypernetwork training and candidate model hyperparameter update, which are performed alternately. The hypernetwork training part updates the hypernetwork weights by minimizing the hypernetwork loss function, while the candidate model hyperparameter update part uses an evaluation function to find the optimal hyperparameters.
[0077] The formula for finding the optimal model hyperparameters is as follows:
[0078]
[0079] Among them, λ* is the optimal model hyperparameter, S is the search space of hyperparameter, f val is the evaluation function obtained in the offline meta-learning stage, X test is an unlabeled test dataset, λ is a hyperparameter, For the model with hyperparameter λ in X test The outlier score of the above output.
[0080] In the training part of the model, the super network first generates initial weights for the model of the terminal device based on the representation vector of the terminal device. Then, the weight changes are transmitted to the super network through local training of the model. The super network is trained according to the weight changes and generates parameters for the model. The two stages are alternated until the model converges or meets the performance requirements.
[0081] In the real-time anomaly detection part, the terminal device captures the transmission data in the industrial communication network online in real time, selects and extracts features from the data, and then uses a personalized anomaly detection model to generate reconstruction samples and calculate the reconstruction probability of the sample. If the reconstruction probability is less than the set threshold, it is judged as an anomaly and an alarm is issued. (i) The reconstruction probability is:
[0082]
[0083] Among them, L is the (i) The number of latent variable samples drawn from the distribution, p θ is the reconstruction probability, x (i) is the i-th sample of the abnormal data set, To reconstruct the sample, and They are The mean and variance of the distribution.
Claims
1. A method for detecting anomalies in industrial communications based on personalized federated learning, characterized in that: Here are the steps: Step 1) Initialization preprocessing: Capture real-time transmitted data packets from the industrial control system network; perform deep packet parsing at the protocol level on the captured data packets to extract fields related to industrial communication anomaly detection; construct the extracted field information into data samples in a unified format, and then obtain the final data samples after data standardization or normalization; Step 2) Selection and training of personalized anomaly detection models; Step 2.1) Personalized selection of a variational autoencoder model: Using the industrial control hosts in the industrial control network as nodes in the federated network, we use the communication data from the process flow or link that each node is responsible for to preliminarily select the most suitable variational autoencoder for that node for anomaly detection. Step 2.2) Hypernetwork training and node model weight generation: The node's variational autoencoder model is trained locally using the data samples obtained in step 1). A hypernetwork is established in all nodes. The hypernetwork is trained based on the weight changes generated by the local training of each node's variational autoencoder model. The hypernetwork is used to update the weights of each node model until the model converges or meets the performance requirements, resulting in the final variational autoencoder model. A private blockchain is established in all nodes to store the weight information of each node model. Step 3) Real-time anomaly detection: Each node captures and analyzes industrial communication data in real time. After data preprocessing, it uses the variational autoencoder model as an anomaly detection engine to calculate the reconstruction probability, compare the reconstruction probability with the set threshold, determine whether an anomaly occurs, and issue an alarm.
2. The method for detecting anomalies in industrial communication based on personalized federated learning according to claim 1, characterized in that: The specific steps in the step 2.1) are: Step 2.1.1) In the offline meta-learning phase, a meta-learning method is used to generate an evaluation function, and the labeled historical dataset is used to train the evaluation function. The specific definition of the evaluation function is as follows: f val :X i ,λ j ,O i,j →P i,j ,i∈{1,...,N},j∈{1,...,m} Among them, f val is the evaluation function, X i is the i-th historical dataset with labels removed, λ j is the hyperparameter of the jth candidate model, O i,j is the outlier score output by the j-th candidate model on the i-th historical dataset, P i,j is the performance of the j-th candidate model on the i-th historical dataset; Step 2.1.2) In the online model selection phase, the trained evaluation function is used to select the optimal variational autoencoder model for each node. The ultimate goal of the selection is to find the initial optimal model hyperparameters: Among them, λ * is the initial optimal model hyperparameter, S is the search space of hyperparameter, f val is the evaluation function after training, X test is the unlabeled test dataset, i.e. the data sample finally obtained in step 1), λ is a hyperparameter, For the model with hyperparameter λ in X test The outlier score of the above output.
3. The method for detecting anomalies in industrial communication based on personalized federated learning according to claim 1, characterized in that: The specific steps in the step 2.2) are: The hypernetwork is a deep neural network that updates the weights of the target model. Its input is the node representation vector of the variational autoencoder model, and its output is the weight information of the variational autoencoder model of the node. The node representation vector is a node descriptor, which is a trainable embedding vector or a fixed vector; The hypernetwork is a node in the private blockchain, and the gradient information and weight information generated by the hypernetwork during the node model weight update process are synchronously stored in the private blockchain.
4. The method for detecting anomalies in industrial communication based on personalized federated learning according to claim 1, characterized in that: The specific steps in step 3) are: Step 3.1) Each node captures the communication data of the process or link it is responsible for in real time, analyzes and extracts key information according to the industrial communication protocol, and forms the input data sample; Step 3.2) Use the encoder part of the variational autoencoder model to generate the distribution of the latent variable corresponding to the sample; the latent variable distribution is generated as follows: Among them, f θ is the encoder, z is the latent variable, x (i) is the i-th sample in the data sample, z (i) is x (i) The corresponding hidden variable, z (i) The distribution of and are z (i) the mean and variance of the distribution; 3.3) Extract L samples from the distribution of latent variables. Based on the L extracted latent variables, use the decoder part of the variational autoencoder model to generate the corresponding distribution of reconstructed samples. The reconstructed sample distribution is generated as follows: Among them, g φ is the decoder, x is the reconstructed sample, z (i,l) For z (i) The lth sample drawn from the distribution of Based on z (i,l) The generated reconstruction samples, The distribution of and They are the mean and variance of the distribution; 3.4) Calculate the reconstruction probability of the sample based on the mean and variance of the reconstructed sample distribution and compare it with the set threshold. If the reconstruction probability is less than the set threshold, it is judged as an anomaly. The reconstruction probability calculation method is as follows: Among them, L is the (i) The number of latent variable samples drawn from the distribution, p θ is the reconstruction probability, x (i) is the i-th sample in the data sample, and They are The mean and variance of the distribution.