Abnormal working condition detection method and system based on business state association

Abstract

The invention relates to the field of abnormal working condition detection, and provides an abnormal working condition detection method and system based on business state association, and the method comprises the steps: extracting business data, and constructing a historical data set; performing rule discrete mapping on the decision quantity in the historical data set, and performing clustering discrete mapping on the state quantity to form a feature item set; selecting a target decision quantity according to the detection task, and constructing a frequent pattern tree of the target decision quantity based on the priori correlation degree of each state quantity and the target decision quantity; determining an association rule of a target decision quantity through feature sequence traversal and minimum confidence index evaluation of the frequent pattern tree; and establishing a business state association detection model based on the association rule, carrying out real-time state monitoring on the industrial control system by using the business state association detection model, and carrying out emergency response and alarm on abnormal working conditions. The method can effectively solve the problem of abnormal working condition identification under the condition that a system model cannot be constructed due to complex services, and improves the monitoring capability of the service state of the industrial control system.

Description

Technical Field

[0001] The present invention relates to the field of industrial control, in particular to the technical field of abnormal operating condition detection, and in particular to a method and system for abnormal operating condition detection based on business status association. Background Art

[0002] With the continuous advancement of industrial automation, industrial control systems are becoming increasingly complex, and the data flow within them is becoming increasingly real-time, continuous, and large-scale. Therefore, the detection and analysis of industrial control system data is becoming increasingly important. By monitoring and analyzing the data generated by industrial control systems in real time, anomalies in the production process, such as equipment failures and abnormal energy consumption, can be promptly detected, allowing prompt action to prevent production accidents and quality issues. However, industrial control systems often have different operating conditions due to their specific production environments and process requirements. This diversity of operating conditions leads to differences in the characteristics, distribution, and patterns of the data generated by industrial control systems. Therefore, it is difficult to find a model that can accurately describe data changes under all operating conditions, making the detection of abnormal conditions difficult. Summary of the Invention

[0003] The present invention aims to solve at least one of the problems existing in the prior art and provide a method and system for detecting abnormal working conditions based on business status association.

[0004] One aspect of the present invention provides a method for detecting abnormal operating conditions based on business state association, the method comprising:

[0005] Utilize the industrial control protocol parsing engine to extract business data from the network traffic of the industrial control system and build a historical data set;

[0006] Performing rule discrete mapping on the decision quantities in the historical data set, and performing cluster discrete mapping on the state quantities in the historical data set to form a feature item set;

[0007] Selecting a target decision quantity according to the detection task, and constructing a frequent pattern tree of the target decision quantity based on the prior correlation degree between each state quantity and the target decision quantity;

[0008] Determining the association rules of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index;

[0009] A business status association detection model is established based on the association rules, and the business status association detection model is used to perform real-time status monitoring on the industrial control system, and to perform emergency response and alarm for abnormal working conditions.

[0010] Optionally, the extracting business data from the network traffic of the industrial control system and constructing a historical data set by using an industrial control protocol parsing engine may include:

[0011] Acquire mirrored traffic data of the core switch in the industrial control system, and call the industrial control protocol parsing engine to decode and convert the mirrored traffic data to obtain standard traffic data;

[0012] Determine the physical dimension, data type, and field position of the business data contained in the standard traffic data, extract the business data, and generate a business data dictionary in the form of key-value pairs;

[0013] A time tag is bound to the service data dictionary according to the traffic receiving time, redundant data with the same time tag in the service data dictionary is eliminated, and a historical data set is constructed in chronological order.

[0014] Optionally, performing rule discrete mapping on the decision quantities in the historical data set and performing cluster discrete mapping on the state quantities in the historical data set to form a feature item set includes:

[0015] Dividing the historical data set into a decision sub-set and a state sub-set according to different data types;

[0016] In the decision quantum set, the decision quantity data is represented as a decision quantity feature item in the form of 0-1 according to a unified rule;

[0017] In the state quantum concentration, each type of state quantity data is normalized according to different physical dimensions;

[0018] Clustering the state quantity data using a density clustering algorithm, and optimizing clustering parameters based on the evaluation results of the silhouette coefficient to obtain an optimal cluster distribution;

[0019] According to the optimal cluster distribution, the state quantity data are respectively mapped to discretized intervals to form state quantity feature items marked with discrete numbers;

[0020] The feature item set is constructed according to the decision quantity feature item and the state quantity feature item.

[0021] Optionally, selecting a target decision quantity according to the detection task and constructing a frequent pattern tree of the target decision quantity based on a priori correlation between each state quantity and the target decision quantity includes:

[0022] Extracting the decision quantity feature item of the target decision quantity and all the state quantity feature items, and treating the feature items under the same time label as a feature sequence;

[0023] According to the a priori correlation degree between each type of state quantity and the target decision quantity, the feature items in all the feature sequences are reordered in the order of "strongly correlated state quantity - weakly correlated state quantity - target decision quantity";

[0024] Convert each feature sequence after position reordering into a corresponding feature tree, wherein the nodes of the feature tree include feature items in the feature sequence and their statistical times, and the initial statistical times of each feature item are set to 1;

[0025] The feature trees corresponding to all the feature sequences are merged to obtain the frequent pattern tree of the target decision quantity; wherein, when nodes with the same feature items at the same layer are merged, only the statistical number of feature items is accumulated; when nodes with different feature items at the same layer are merged, they are respectively used as branches of the upper layer nodes.

[0026] Optionally, determining the association rule of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index includes:

[0027] Using a depth-first traversal algorithm, all feature sequences from the root node to the leaf nodes in the frequent pattern tree of the target decision quantity are obtained as candidate preconditions;

[0028] Evaluate the confidence index of all the candidate preconditions, where the confidence index is the minimum value of the statistical number of feature items in the candidate preconditions;

[0029] If the confidence index of the candidate precondition is less than a preset threshold, the last feature item in the candidate precondition is removed, a new candidate precondition is generated, and the confidence index is re-evaluated;

[0030] If the confidence index of the candidate precondition is greater than or equal to the preset threshold, the association rule of the target decision quantity is constructed according to the candidate precondition.

[0031] Optionally, establishing a business status association detection model based on the association rules, and using the business status association detection model to perform real-time status monitoring on the industrial control system includes:

[0032] Establishing the business status association detection model based on the association rules of the plurality of target decision quantities;

[0033] Based on the business status association detection model, a rule matching engine is called to perform real-time analysis on the real state quantity data of the industrial control system, determine the data expected value of the target decision quantity in the association rule, and evaluate the real business status of the industrial control system based on the similarities and differences between the data expected value and the corresponding data real value.

[0034] Optionally, the emergency response and alarm for abnormal operating conditions include:

[0035] If the business status association detection model detects that the industrial control system has the abnormal working condition, a control instruction is issued according to a pre-set emergency response plan to correct the operation of the equipment or facilities corresponding to the abnormal working condition and issue an alarm.

[0036] Another aspect of the present invention provides an abnormal operating condition detection system based on business state association, the system comprising:

[0037] The data parsing module is used to extract business data from the network traffic of the industrial control system and build a historical data set using the industrial control protocol parsing engine;

[0038] A feature processing module is used to perform rule discrete mapping on the decision quantity in the historical data set and perform cluster discrete mapping on the state quantity in the historical data set to form a feature item set;

[0039] A frequent pattern tree construction module is used to select a target decision quantity according to the detection task, and to construct a frequent pattern tree of the target decision quantity based on the prior correlation degree between each state quantity and the target decision quantity;

[0040] An association rule mining module is used to determine the association rules of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index;

[0041] The anomaly detection module is used to establish a business status association detection model based on the association rules, use the business status association detection model to perform real-time status monitoring of the industrial control system, and perform emergency response and alarm for abnormal working conditions.

[0042] Another aspect of the present invention provides an electronic device, comprising:

[0043] at least one processor; and,

[0044] a memory communicatively connected to the at least one processor; wherein,

[0045] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal operating condition detection method based on business status association described above.

[0046] Another aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the abnormal operating condition detection method based on business status association described above.

[0047] Compared with the existing technology, the present invention can utilize the correlation between various business states of the industrial control system under different working conditions to perform abnormal detection on the operation of key equipment and facilities, thereby solving the problem of identifying abnormal working conditions when the system model cannot be built due to complex business, and can effectively improve the monitoring ability of the business state of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] One or more embodiments are exemplarily illustrated by pictures in the corresponding drawings, and these exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0049] Figure 1 A flowchart of a method for detecting abnormal operating conditions based on business status association provided by one embodiment of the present invention;

[0050] Figure 2 A schematic diagram of a frequent pattern tree construction process provided by another embodiment of the present invention;

[0051] Figure 3 A schematic structural diagram of an abnormal operating condition detection system based on business status association provided by another embodiment of the present invention;

[0052] Figure 4 A schematic structural diagram of an electronic device provided in another embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, each embodiment of the present invention will be described in detail below with reference to the accompanying drawings. However, it will be understood by those skilled in the art that in each embodiment of the present invention, many technical details are provided to enable the reader to better understand the present invention. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions claimed in the present invention can be implemented. The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other under the premise that there is no contradiction.

[0054] One embodiment of the present invention relates to a method for detecting abnormal working conditions based on business status association, the process of which is as follows: Figure 1 As shown, it includes steps S110 to S150.

[0055] Step S110 , using the industrial control protocol parsing engine, extracting business data from the network traffic of the industrial control system and constructing a historical data set.

[0056] Specifically, an industrial control system can be any type of system used to automatically control an industrial production process. For example, an industrial control system can be a Supervisory Control and Data Acquisition (SCADA) system, a Distributed Control System (DCS), etc.

[0057] Exemplarily, step S110 includes: obtaining mirrored traffic data of a core switch in an industrial control system, calling an industrial control protocol parsing engine to decode and convert the mirrored traffic data to obtain standard traffic data; determining the physical dimension, data type, and field position of the business data contained in the standard traffic data, extracting the business data, and generating a business data dictionary in the form of key-value pairs; binding a time tag to the business data dictionary according to the traffic reception time, eliminating redundant data with the same time tag in the business data dictionary, and constructing a historical data set in chronological order.

[0058] For example, if the industrial control system is selected as the boiler combustion system in the thermal power generation system, step S110 can obtain the mirrored flow data between the DCS controller and the operator station human-machine interface (HMI) in the boiler combustion system, extract the business data through industrial control protocol analysis, generate a business data dictionary in the form of key-value pairs, and construct a historical data set in chronological order by binding time tags and eliminating redundant data. Among them, the data type and physical dimension of the business data can include furnace oxygen content (%), furnace negative pressure (Pa), furnace temperature (℃), and air supply duct valve switch. The open state of the air supply duct valve switch can be represented by the data "ON", and the closed state of the air supply duct valve switch can be represented by the data "OFF". At this time, the constructed historical data set is shown in Table 1 below.

[0059] Table 1 Historical dataset

[0060]

[0061] Step S120 , performing rule discrete mapping on the decision quantities in the historical data set, and performing cluster discrete mapping on the state quantities in the historical data set, to form a feature item set.

[0062] Specifically, state variables refer to physical quantities that describe the operating state of the industrial control system under various operating conditions. These data can be obtained through corresponding types of sensors, such as the furnace oxygen content, furnace negative pressure, and furnace temperature in the above embodiment. Decision variables refer to variables that describe the industrial control system under various operating conditions and can be adjusted to achieve optimal system performance, such as the air duct valve switch in the above embodiment.

[0063] Exemplarily, step S120 includes: dividing the historical data set into decision quantum sets and state quantum sets according to different data types; in the decision quantum sets, representing the decision quantity data as decision quantity feature items in the form of 0-1 according to a unified specification; in the state quantum sets, normalizing each type of state quantity data according to different physical dimensions; clustering the state quantity data using a density clustering algorithm, and optimizing the clustering parameters based on the evaluation results of the silhouette coefficient to obtain the optimal cluster distribution; based on the optimal cluster distribution, mapping the state quantity data to discretized intervals to form state quantity feature items with discrete digital labels; and constructing a feature item set based on the decision quantity feature items and the state quantity feature items.

[0064] For example, if the data corresponding to the three data types (furnace oxygen content, furnace negative pressure, and furnace temperature) in the above embodiment are used as state quantity data obtained by the sensor, and the data corresponding to the air duct valve switch in the above embodiment are used as decision quantity data for the controlled execution, then the historical data set shown in Table 1 can be divided into state sub-sets corresponding to the furnace oxygen content, furnace negative pressure, and furnace temperature, respectively, and decision sub-sets corresponding to the air duct valve switch. For the decision sub-set corresponding to the air duct valve switch, the data "ON" and "OFF" corresponding to the air duct valve switch are represented as feature items 1 and 0, respectively, as decision quantity feature items. For the state sub-sets corresponding to the furnace oxygen content, furnace negative pressure, and furnace temperature, respectively, after clustering processing, the data corresponding to the furnace oxygen content, furnace negative pressure, and furnace temperature are mapped to discretized feature items 1 and 2, respectively, as state quantity feature items. For convenience, A, B, C, and D are used to represent the furnace oxygen content, furnace negative pressure, furnace temperature, and air duct valve switch, respectively. The feature item set constructed based on the decision-making feature items and state feature items can be expressed as follows: Table 2. Among them, T1 to T10 represent the 1st to 10th time nodes, A1 and A2 represent the state feature items corresponding to the furnace oxygen content, B1 and B2 represent the state feature items corresponding to the furnace negative pressure, C1 and C2 represent the state feature items corresponding to the furnace temperature, and D0 and D1 represent the decision-making feature items corresponding to the air duct valve switch.

[0065] Table 2 Feature item sets

[0066] time Furnace oxygen content Furnace negative pressure Furnace temperature Air supply duct valve switch T1 A1 B1 C1 D0 T2 A1 B2 C1 D0 T3 A1 B2 C2 D1 T4 A2 B2 C2 D1 T5 A2 B1 C2 D0 T6 A1 B1 C2 D0 T7 A1 B1 C1 D0 T8 A2 B2 C1 D0 T9 A1 B2 C2 D1 T10 A2 B1 C2 D0

[0067] Step S130 , selecting a target decision quantity according to the detection task, and constructing a frequent pattern tree of the target decision quantity based on the a priori correlation degree between each state quantity and the target decision quantity.

[0068] Specifically, the target decision quantity refers to the decision quantity that serves as the detection target in the detection task. For example, the target decision quantity may be the switch of the air supply duct valve in the above-mentioned embodiment. In this case, step S130 may construct a frequent pattern tree of the target decision quantity, i.e., the switch of the air supply duct valve, based on the a priori correlation between the various state quantities, i.e., the furnace oxygen content, the furnace negative pressure, and the furnace temperature, and the decision quantity, i.e., the switch of the air supply duct valve.

[0069] Exemplarily, step S130 includes: extracting the decision quantity feature items of the target decision quantity and all state quantity feature items, and treating the feature items under the same time label as a feature sequence; according to the a priori correlation degree between each type of state quantity and the target decision quantity, the feature items in all feature sequences are reordered in the order of "strongly correlated state quantity-weakly correlated state quantity-target decision quantity"; converting each feature sequence after the position reordering into a corresponding feature tree, the nodes of the feature tree contain the feature items in the feature sequence and their statistical times, and the initial statistical times of each feature item are set to 1; merging the feature trees corresponding to all feature sequences to obtain a frequent pattern tree of the target decision quantity; wherein, nodes with the same feature items at the same layer only accumulate the statistical times of the feature items when merging, and nodes with different feature items at the same layer are respectively used as branches of the upper-level nodes when merging.

[0070] Specifically, the feature items in the feature sequence are reordered in the order of "strongly correlated state quantity-weakly correlated state quantity-target decision quantity", which means that the various state quantities related to the target decision quantity are first sorted according to the strength of their correlation with the target decision quantity, and then the target decision quantity is placed after the sorted state quantities, thereby obtaining the reordered feature sequence.

[0071] For example, when it is determined based on prior experience that the state quantities associated with the target decision quantity, i.e., the switch of the air supply duct valve, are ranked in order of the degree of association as furnace temperature, furnace negative pressure, and furnace oxygen content, then the position of the feature items of each feature sequence in the feature item set shown in Table 2 above is reordered, and the sorted feature item set composed of the feature sequences after the position reordering can be expressed as Table 3 below.

[0072] Table 3. Feature item sets after sorting

[0073] time Furnace temperature Furnace negative pressure Furnace oxygen content Air supply duct valve switch T1 C1 B1 A1 D0 T2 C1 B2 A1 D0 T3 C2 B2 A1 D1 T4 C2 B2 A2 D1 T5 C2 B1 A2 D0 T6 C2 B1 A1 D0 T7 C1 B1 A1 D0 T8 C1 B2 A2 D0 T9 C2 B2 A1 D1 T10 C2 B1 A2 D0

[0074] Take each row of data corresponding to each time node T1 to T10 in Table 3 above as a feature sequence after position reordering, and then get 10 feature sequences after position reordering, which can be represented as T1 sequence to T10 sequence respectively. Convert T1 sequence to T10 sequence into corresponding feature trees, where the nodes of the feature tree contain the feature items and their statistical times in the corresponding sequence, and the initial statistical times of each feature item are set to 1. Then, combine them together Figure 2 The feature trees corresponding to sequences T1 through T10 are merged. For nodes with the same feature item at the same level in the feature trees corresponding to sequences T1 through T10, only the count of the feature item is accumulated during the merging process. Nodes with different feature items at the same level in the feature trees corresponding to sequences T1 through T10 are used as branches of the upper-level nodes during the merging process. This results in a frequent pattern tree for the target decision variable, i.e., the switch of the air duct valve, i.e., the frequent pattern tree composed of sequences T1 through T10. The root nodes in the feature trees corresponding to sequences T1 through T10 and the frequent pattern tree composed of sequences T1 through T10 can be represented by "Null."

[0075] Step S140 , determining the association rules of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index.

[0076] For example, step S140 may be for Figure 2 The frequent pattern tree composed of the T1 sequence to the T10 sequence shown is subjected to feature sequence traversal and minimum confidence index evaluation to determine the target decision quantity, i.e., the association rule of the air supply duct valve switch.

[0077] Exemplarily, step S140 includes: using a depth-first traversal algorithm to obtain all feature sequences from the root node to the leaf node in the frequent pattern tree of the target decision quantity as candidate preconditions; evaluating the confidence index of all candidate preconditions, where the confidence index is the minimum value of the statistical number of feature items in the candidate preconditions; if the confidence index of the candidate precondition is less than a preset threshold, removing the feature item at the end of the candidate precondition, generating a new candidate precondition and re-evaluating the confidence index; if the confidence index of the candidate precondition is greater than or equal to the preset threshold, constructing the association rule of the target decision quantity based on the candidate precondition.

[0078] For example, for Figure 2The frequent pattern tree composed of the T1 to T10 sequences shown in the figure uses the symbol I to represent its confidence index. The preset threshold of the confidence index I is set to 3 to evaluate each candidate precondition. Then, the specific values ​​of the candidate preconditions and their confidence indexes of the decision-making feature item D0 corresponding to the air supply duct valve switch are {C1B1A1, I=1}, {C1B2A1, I=1}, {C1B2A2, I=1}, {C2B1A1, I=1}, and {C2B1A2, I=1}, respectively. Since the values ​​of the confidence index I of the above candidate preconditions of the decision quantity feature item D0 are all less than 3, the last feature item in each candidate precondition is removed to generate new candidate preconditions for the decision quantity feature item D0 and their specific values ​​of confidence index, respectively {C1B1, I=2}, {C1B2, I=2} and {C2B1, I=3}. At this time, since the value of the confidence index I of the new candidate precondition C2B1 is equal to 3, an association rule for the target decision quantity, i.e., the switch of the air supply duct valve, can be constructed as {C2B1}→{D0}. Since the confidence index I values ​​for the new candidate preconditions C1B1 and C1B2 are both less than 3, we continue to generate new candidate preconditions for the decision-making feature item D0 and their specific confidence index values, {C1, I=4}. At this point, since the confidence index I value for the new candidate precondition C1 is greater than 3, we can construct another association rule for the target decision-making feature, namely, the air duct valve switch: {C1}→{D0}. Similarly, based on the decision-making feature item D1, we can construct an association rule for the target decision-making feature, namely, the air duct valve switch: {C2B2}→{D1}. The association rule for the air duct valve switch shows that the furnace temperature and negative furnace pressure are closely related to the state of the air duct valve switch. When the furnace temperature is too high or the furnace pressure is negative, the air duct valve switch will be closed.

[0079] Step S150 , establishing a business status association detection model based on the association rules, using the business status association detection model to perform real-time status monitoring on the industrial control system, and performing emergency response and alarm for abnormal working conditions.

[0080] Specifically, the business status association detection model can match the real-time status of the industrial control system with the existing association rules. If the expected value of the target decision quantity corresponding to the real-time status is different from the actual value of the target decision quantity corresponding to the real-time status, it indicates that the industrial control system is in an abnormal working condition. Emergency response and alarm can be performed for the abnormal working condition to reduce the impact of the abnormal working condition on the industrial control system and ensure the safety and stability of the industrial control system.

[0081] Exemplarily, in step S150, a business status association detection model is established based on association rules, and the business status association detection model is used to perform real-time status monitoring of the industrial control system, including: establishing a business status association detection model based on association rules of multiple target decision quantities; based on the business status association detection model, calling a rule matching engine to perform real-time analysis on the real status quantity data of the industrial control system to determine the data expected value of the target decision quantity in the association rule; and evaluating the real business status of the industrial control system based on the similarities and differences between the data expected value and the corresponding data real value.

[0082] For example, a business state association detection model is constructed based on the target decision variable, the association rules {C2B1}→{D0}, {C1}→{D0}, and {C2B2}→{D1}, for the air duct valve switch. Based on this business state association detection model, a rule matching engine is invoked to perform real-time analysis on the industrial control system's actual state data, namely, the furnace oxygen content, furnace negative pressure, and furnace temperature. Association rule matching yields the analysis results for the actual state data. If the analysis results indicate that the furnace temperature is too high or the furnace negative pressure is too large, the association rule {C2B2}→{D1} for the air duct valve switch determines that the expected value of the air duct valve switch is closed. If the actual value of the air duct valve switch is closed, this indicates that the expected value and the actual value are the same, indicating that the industrial control system is operating normally. However, if the actual value of the air duct valve switch is open, this indicates that the expected value and the actual value are different, indicating that the industrial control system is operating abnormally.

[0083] Exemplarily, in step S150, emergency response and alarm are performed for abnormal working conditions, including: if the business status association detection model detects that an abnormal working condition occurs in the industrial control system, control instructions are issued according to a pre-set emergency response plan to correct the operating conditions of the equipment or facilities corresponding to the abnormal working condition, and an alarm is issued at the same time.

[0084] For example, if the business status association detection model detects an abnormal operating condition in the industrial control system, the expected data value of the air supply duct valve switch is closed, but the actual data value of the air supply duct valve switch is open, then a control instruction can be issued according to the pre-set emergency response plan to close the air supply duct valve switch and issue an alarm at the same time.

[0085] Compared with the existing technology, the abnormal operating condition detection method based on business status association provided by the embodiment of the present invention can utilize the association relationship between various business states of the industrial control system under different working conditions to perform abnormal detection on the operation status of key equipment and facilities, thereby solving the problem of abnormal operating condition identification when the system model cannot be built due to complex business, and can effectively improve the monitoring capability of the business status of the industrial control system.

[0086] Another embodiment of the present invention relates to an abnormal operating condition detection system based on business status association, such as Figure 3 As shown, it includes a data parsing module 310 , a feature processing module 320 , a frequent pattern tree construction module 330 , an association rule mining module 340 , and an anomaly detection module 350 .

[0087] The data analysis module 310 is used to extract business data from the network traffic of the industrial control system and construct a historical data set using the industrial control protocol analysis engine.

[0088] The feature processing module 320 is used to perform rule discrete mapping on the decision quantities in the historical data set and perform cluster discrete mapping on the state quantities in the historical data set to form a feature item set.

[0089] The frequent pattern tree construction module 330 is used to select a target decision quantity according to the detection task, and construct a frequent pattern tree of the target decision quantity based on the a priori correlation degree between each state quantity and the target decision quantity.

[0090] The association rule mining module 340 is used to determine the association rules of the target decision quantity through feature sequence traversal of the frequent pattern tree and minimum confidence index evaluation.

[0091] The anomaly detection module 350 is used to establish a business status association detection model based on association rules, use the business status association detection model to monitor the real-time status of the industrial control system, and perform emergency response and alarm for abnormal working conditions.

[0092] The specific implementation method of the abnormal operating condition detection system based on business status association provided in the embodiment of the present invention can be found in the abnormal operating condition detection method based on business status association provided in the embodiment of the present invention, which will not be repeated here.

[0093] Compared with the existing technology, the abnormal operating condition detection system based on business status association provided by the embodiment of the present invention can utilize the association relationship between various business states of the industrial control system under different working conditions to perform abnormal detection on the operation of key equipment and facilities, thereby solving the problem of abnormal operating condition identification when the system model cannot be built due to complex business, and can effectively improve the monitoring capability of the business status of the industrial control system.

[0094] Another embodiment of the present invention relates to an electronic device, such as Figure 4 Shown, including:

[0095] at least one processor 401; and,

[0096] A memory 402 in communication with at least one processor 401; wherein,

[0097] The memory 402 stores instructions that can be executed by at least one processor 401. The instructions are executed by at least one processor 401 so that the at least one processor 401 can execute the abnormal operating condition detection method based on business status association described in the above embodiment.

[0098] The memory and processor are connected using a bus, which can include any number of interconnected buses and bridges. The bus connects various circuits of one or more processors and memories. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and are therefore not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor.

[0099] The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory can be used to store data used by the processor when performing operations.

[0100] Another embodiment of the present invention relates to a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the abnormal operating condition detection method based on business status association described in the above embodiment.

[0101] That is, those skilled in the art will understand that all or part of the steps in the methods described in the above embodiments can be implemented by instructing related hardware through a program, which is stored in a storage medium and includes a number of instructions for causing a device (which may be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps in the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, ROM (Read-Only Memory), RAM (Random Access Memory), a magnetic disk, or an optical disk.

[0102] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and that in actual applications, various changes may be made in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A method for detecting abnormal working conditions based on business status association, characterized in that: The method comprises: Utilize the industrial control protocol parsing engine to extract business data from the network traffic of the industrial control system and build a historical data set; Performing rule discrete mapping on the decision quantities in the historical data set, and performing cluster discrete mapping on the state quantities in the historical data set to form a feature item set; Selecting a target decision quantity according to the detection task, and constructing a frequent pattern tree of the target decision quantity based on the prior correlation degree between each state quantity and the target decision quantity; Determining the association rules of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index; A business status association detection model is established based on the association rules, and the business status association detection model is used to perform real-time status monitoring on the industrial control system, and to perform emergency response and alarm for abnormal working conditions.

2. The abnormal operating condition detection method based on business status association according to claim 1 is characterized in that: The industrial control protocol parsing engine is used to extract business data from the network traffic of the industrial control system and construct a historical data set, including: Acquire mirrored traffic data of the core switch in the industrial control system, and call the industrial control protocol parsing engine to decode and convert the mirrored traffic data to obtain standard traffic data; Determine the physical dimension, data type, and field position of the business data contained in the standard traffic data, extract the business data, and generate a business data dictionary in the form of key-value pairs; A time tag is bound to the service data dictionary according to the traffic receiving time, redundant data with the same time tag in the service data dictionary is eliminated, and a historical data set is constructed in chronological order.

3. The abnormal operating condition detection method based on business status association according to claim 1 is characterized in that: The step of performing rule discrete mapping on the decision quantities in the historical data set and performing cluster discrete mapping on the state quantities in the historical data set to form a feature item set includes: Dividing the historical data set into a decision sub-set and a state sub-set according to different data types; In the decision quantum set, the decision quantity data is represented as a decision quantity feature item in the form of 0-1 according to a unified rule; In the state quantum concentration, each type of state quantity data is normalized according to different physical dimensions; Clustering the state quantity data using a density clustering algorithm, and optimizing clustering parameters based on the evaluation results of the silhouette coefficient to obtain an optimal cluster distribution; According to the optimal cluster distribution, the state quantity data are respectively mapped to discretized intervals to form state quantity feature items marked with discrete numbers; The feature item set is constructed according to the decision quantity feature item and the state quantity feature item.

4. The abnormal operating condition detection method based on business status association according to claim 3 is characterized in that: The step of selecting a target decision quantity according to the detection task and constructing a frequent pattern tree of the target decision quantity based on a priori correlation between each state quantity and the target decision quantity includes: Extracting the decision quantity feature item of the target decision quantity and all the state quantity feature items, and treating the feature items under the same time label as a feature sequence; According to the a priori correlation degree between each type of state quantity and the target decision quantity, the feature items in all the feature sequences are reordered in the order of "strongly correlated state quantity - weakly correlated state quantity - target decision quantity"; Convert each feature sequence after position reordering into a corresponding feature tree, wherein the nodes of the feature tree include feature items in the feature sequence and their statistical times, and the initial statistical times of each feature item are set to 1; The feature trees corresponding to all the feature sequences are merged to obtain the frequent pattern tree of the target decision quantity; wherein, when nodes with the same feature items at the same layer are merged, only the statistical number of feature items is accumulated; when nodes with different feature items at the same layer are merged, they are respectively used as branches of the upper layer nodes.

5. The abnormal operating condition detection method based on business status association according to claim 1 is characterized in that: The determining of the association rule of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index includes: Using a depth-first traversal algorithm, all feature sequences from the root node to the leaf nodes in the frequent pattern tree of the target decision quantity are obtained as candidate preconditions; Evaluate the confidence index of all the candidate preconditions, where the confidence index is the minimum value of the statistical number of feature items in the candidate preconditions; If the confidence index of the candidate precondition is less than a preset threshold, the last feature item in the candidate precondition is removed, a new candidate precondition is generated, and the confidence index is re-evaluated; If the confidence index of the candidate precondition is greater than or equal to the preset threshold, the association rule of the target decision quantity is constructed according to the candidate precondition.

6. The abnormal operating condition detection method based on business status association according to claim 1 is characterized in that: The establishing of a business status association detection model based on the association rules, and using the business status association detection model to perform real-time status monitoring on the industrial control system, includes: Establishing the business status association detection model based on the association rules of the plurality of target decision quantities; Based on the business status association detection model, a rule matching engine is called to perform real-time analysis on the real state quantity data of the industrial control system, determine the data expected value of the target decision quantity in the association rule, and evaluate the real business status of the industrial control system based on the similarities and differences between the data expected value and the corresponding data real value.

7. The abnormal operating condition detection method based on business status association according to any one of claims 1 to 6, characterized in that: The emergency response and alarm for abnormal operating conditions include: If the business status association detection model detects that the industrial control system has the abnormal working condition, a control instruction is issued according to a pre-set emergency response plan to correct the operation of the equipment or facilities corresponding to the abnormal working condition and issue an alarm.

8. An abnormal operating condition detection system based on business status association, characterized in that: The system comprises: The data parsing module is used to extract business data from the network traffic of the industrial control system and build a historical data set using the industrial control protocol parsing engine; A feature processing module is used to perform rule discrete mapping on the decision quantity in the historical data set and perform cluster discrete mapping on the state quantity in the historical data set to form a feature item set; A frequent pattern tree construction module is used to select a target decision quantity according to the detection task, and to construct a frequent pattern tree of the target decision quantity based on the prior correlation degree between each state quantity and the target decision quantity; An association rule mining module is used to determine the association rules of the target decision quantity by traversing the feature sequence of the frequent pattern tree and evaluating the minimum confidence index; The anomaly detection module is used to establish a business status association detection model based on the association rules, use the business status association detection model to perform real-time status monitoring of the industrial control system, and perform emergency response and alarm for abnormal working conditions.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the abnormal operating condition detection method based on business status association according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormal operating condition detection method based on business status association according to any one of claims 1 to 7 is implemented.

Images