Industrial network data anomaly detection method and related device

Abstract

The method and related equipment for detecting the anomaly of industrial network data provided by the embodiments of the present application comprise the following steps: firstly, obtaining the industrial network data and generating a physical model corresponding to the industrial network data; next, inputting the industrial network data into a time sequence feature extraction network to perform feature prediction, obtaining a residual prediction value, and obtaining a hybrid physical model based on the physical model and the residual prediction value; then, obtaining a hybrid prediction value of the industrial network data based on the hybrid physical model, and obtaining a residual sequence based on the difference between the hybrid prediction value and the actual observation value of the industrial network data; finally, calculating the cumulative statistical value of the industrial network data based on the residual sequence, and obtaining the anomaly detection result of the industrial network data based on the cumulative statistical value, thereby significantly improving the accuracy and robustness of the anomaly detection of the industrial network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network data processing, and in particular to an industrial network data anomaly detection method and related equipment. BACKGROUND

[0002] For anomaly detection of an industrial control network (industrial internet), the existing technology is usually a method based on a physical model or expert rules. In an industrial control system, a physical process must follow certain domain-specific engineering constraints and natural laws, and these constraint relationships become an important basis for anomaly detection. Therefore, an anomaly detection method based on physical model constraints is an effective protection path in the field of industrial internet security protection.

[0003] However, although this anomaly detection method based on physical model constraints has certain interpretability, the model construction process is highly dependent on professional knowledge, and it is difficult to accurately depict the nonlinear dynamic characteristics of complex industrial systems, and the adaptability to system operating condition changes and equipment aging is poor, resulting in low detection accuracy of the model for industrial network data. SUMMARY

[0004] The anomaly detection method and related equipment for industrial network data provided by the embodiments of the present application can improve the detection accuracy of anomaly detection of industrial network data.

[0005] To achieve the above-mentioned purpose, a first aspect of the embodiments of the present application provides an anomaly detection method for industrial network data, which comprises:

[0006] obtaining industrial network data, and generating a physical model corresponding to the industrial network data;

[0007] inputting the industrial network data into a time series feature extraction network to perform feature prediction, obtaining a residual prediction value, and based on the physical model and the residual prediction value, obtaining a hybrid physical model;

[0008] obtaining a hybrid prediction value of the industrial network data based on the hybrid physical model, and obtaining a residual sequence based on the difference between the hybrid prediction value and the actual observation value of the industrial network data;

[0009] calculating a cumulative statistical value of the industrial network data based on the residual sequence, and obtaining an anomaly detection result of the industrial network data based on the cumulative statistical value.

[0010] In some embodiments, the generating a physical model corresponding to the industrial network data comprises:

[0011] obtaining a plurality of initial physical models of the industrial network data;

[0012] a fitness corresponding to each of the initial physical models is calculated based on a prediction accuracy and a complexity of each of the initial physical models;

[0013] a target physical model is selected from the plurality of initial physical models based on the fitness of each of the initial physical models, and a cross mutation process is performed on the plurality of initial physical models to obtain an updated physical model, and the updated physical model is taken as a new initial physical model for multiple cross mutation updates, and the target physical model is updated in the process of the cross mutation updates;

[0014] the target physical model after the last cross mutation update is taken as the physical model.

[0015] In some embodiments, the fitness corresponding to each of the initial physical models is calculated based on a prediction accuracy and a complexity of each of the initial physical models, comprising:

[0016] the industrial network data is substituted into each of the initial physical models to obtain an initial physical prediction value;

[0017] the prediction accuracy of each of the initial physical models is obtained based on a difference between the initial physical prediction value and an actual observation value of the industrial network data;

[0018] the complexity corresponding to each of the initial physical models is determined based on an expression component parameter of each of the initial physical models, and the expression component parameter comprises at least one of a symbol node number, a tree depth, and an operator type;

[0019] the fitness of each of the initial physical models is obtained based on a weighted sum of the prediction accuracy and the complexity.

[0020] In some embodiments, the training process of the time series feature extraction network comprises:

[0021] a training physical model obtained from training industrial network data is obtained, and a training prediction residual of the training physical model is determined;

[0022] the training industrial network data is input into the time series feature extraction network for feature extraction to obtain multi-scale features, and the multi-scale features are integrated to obtain a training residual prediction value;

[0023] the training prediction residual is taken as a learning target of the training residual prediction value, and network parameters of the time series feature extraction network are adjusted.

[0024] In some embodiments, the hybrid physical model is obtained based on the physical model and the residual prediction value, comprising:

[0025] a first weight and a second weight are obtained;

[0026] The hybrid physical model is obtained by summing the product of the first weight and the physical model, the second weight and the residual prediction value.

[0027] In some embodiments, the residual sequence includes residual values ​​corresponding to multiple detection times, and the calculation of the cumulative statistical value of the industrial network data based on the residual sequence includes:

[0028] Determine the mean and standard deviation of the residual sequence;

[0029] The current residual ratio is obtained by dividing the difference between the residual value at the current detection time and the mean of the residual sequence by the standard deviation of the residual sequence.

[0030] The cumulative statistical value of the industrial network data at the current detection time is obtained by subtracting the drift detection parameter from the sum of the cumulative statistical value of the previous detection time and the current residual ratio.

[0031] In some embodiments, obtaining the anomaly detection result of the industrial network data based on the cumulative statistical value includes:

[0032] Obtain the anomaly detection range;

[0033] When the cumulative statistical value is not within the anomaly detection range, an anomaly detection result is generated to characterize the industrial network data as abnormal;

[0034] When the cumulative statistical value is within the anomaly detection range, an anomaly detection result is generated that indicates the industrial network data is normal.

[0035] To achieve the above objectives, a second aspect of this application provides an anomaly detection device for industrial network data, the device comprising:

[0036] The physical model generation module is used to acquire industrial network data and generate a physical model corresponding to the industrial network data.

[0037] The hybrid physical model generation module is used to input the industrial network data into a time-series feature extraction network for feature prediction, obtain residual prediction values, and obtain a hybrid physical model based on the physical model and the residual prediction values.

[0038] The residual sequence generation module is used to obtain the mixed predicted value of the industrial network data based on the mixed physical model, and to obtain the residual sequence based on the difference between the mixed predicted value and the actual observed value of the industrial network data.

[0039] Anomaly detection module, configured to calculate cumulative statistical value of the industrial network data based on the residual sequence, and obtain anomaly detection result of the industrial network data based on the cumulative statistical value.

[0040] To achieve the above object, a third aspect of the embodiments of the present application provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the anomaly detection method of the industrial network data when executing the computer program.

[0041] To achieve the above object, a fourth aspect of the embodiments of the present application provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the anomaly detection method of the industrial network data of the first aspect.

[0042] The anomaly detection method of the industrial network data and the related device provided by the embodiments of the present application, the method comprises: first, obtaining the industrial network data, and generating a physical model corresponding to the industrial network data; next, inputting the industrial network data into a time series feature extraction network for feature prediction to obtain a residual prediction value, and obtaining a hybrid physical model based on the physical model and the residual prediction value; then, obtaining a hybrid prediction value of the industrial network data based on the hybrid physical model, and obtaining a residual sequence based on a difference between the hybrid prediction value and an actual observation value of the industrial network data; finally, calculating a cumulative statistical value of the industrial network data based on the residual sequence, and obtaining an anomaly detection result of the industrial network data based on the cumulative statistical value. The embodiments of the present application automatically generate a physical model from the industrial network data, reduce the dependence on domain expert knowledge, realize the automatic discovery of physical laws, solve the problem of complex and poor adaptability in the traditional physical modeling process, and combine the physical model with physical interpretability and the time series feature extraction network capable of accurately fitting the nonlinear dynamic characteristics through the constructed hybrid physical model. The time series feature extraction network is used to learn and predict the residual of the physical model, so as to realize the complementary advantages, greatly improve the overall prediction accuracy of the complex industrial process, and then calculate the cumulative statistical value of the residual sequence of the high-precision hybrid model for anomaly judgment, effectively amplify the small but continuous abnormal signal, realize the sensitive detection of the hidden attack or system gradual failure with low amplitude which is difficult to be found by the traditional method, and thus significantly improve the accuracy and robustness of the industrial network anomaly detection.

[0043] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be achieved and obtained by the structure particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 is a flowchart of an anomaly detection method for industrial network data provided by an embodiment of the present application.

[0045] Figure 2 is Figure 1 is a flowchart of step 101 in the method.

[0046] Figure 3 is Figure 2 is a flowchart of step 202 in the method.

[0047] Figure 4 is a flowchart of a training process of a time series feature extraction network provided by an embodiment of the present application.

[0048] Figure 5 is Figure 1 is a flowchart of step 102 in the method.

[0049] Figure 6 is Figure 1 is a flowchart of step 104 in the method.

[0050] Figure 7 is Figure 1 is another flowchart of step 104 in the method.

[0051] Figure 8 is a structural diagram of an anomaly detection system applying the anomaly detection method provided by an embodiment of the present application.

[0052] Figure 9 is a structural diagram of an anomaly detection apparatus for industrial network data provided by an embodiment of the present application.

[0053] Figure 10 is a hardware structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0055] It should be noted that although the functional modules are divided in the apparatus structural diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a manner different from the module division in the apparatus or the order in the flowchart.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to be limiting of this application.

[0057] For anomaly detection of industrial control network (industrial internet), the prior art is usually a method based on physical model or expert rules. In an industrial control system, a physical process must follow certain field engineering constraints and natural laws, and these constraint relationships become an important basis for anomaly detection. Therefore, an anomaly detection method based on physical model constraints is an effective protection path in the field of industrial internet security protection.

[0058] The rule-based anomaly detection method mainly includes the method based on physical model and the traditional method based on expert experience rule. The core idea of this method is to use the prior knowledge and theoretical basis of the system to identify abnormal behavior. The method based on physical model refers to the establishment of mathematical description model according to the physical principle and engineering law of industrial control system, such as the establishment of fluid dynamics model based on the law of conservation of mass and energy, or the establishment of temperature distribution model based on the principle of heat transfer. This method compares the actual measured value with the predicted value of the physical model, and determines the abnormality when the deviation exceeds the preset threshold. For example, in chemical process control, the physical model of the reactor can be established according to the reaction kinetics equation, and the deviation between the actual temperature, pressure, concentration and other parameters and the predicted value of the model is monitored to detect the abnormality. The method based on expert experience rule refers to the traditional method of judging system anomaly by pre-defined expert rules and threshold, which is usually based on the design specification, operation manual and long-term operation experience of industrial control system, and a series of if-then rules or boundary conditions are established. Although this method has certain interpretability and theoretical basis, it has obvious limitations: first, the model construction complexity is high and depends on professional knowledge. Accurate physical model requires in-depth understanding of the physical mechanism, boundary conditions and parameter characteristics of the system, and the model establishment process requires a lot of theoretical analysis and experimental verification, which requires high professional level of modeling personnel. For complex multi-physical field coupling system, accurate modeling often faces great challenges. Second, the model adaptability and generalization ability are limited. During the long-term operation of industrial control system, factors such as equipment aging, process parameter drift and environmental condition change will cause the change of system characteristics, and the physical model based on fixed parameters is difficult to adapt to these changes. When the system configuration is updated or the process flow is adjusted, the model needs to be re-established or the model parameters need to be corrected. Third, it is difficult to deal with high-dimensional complex system. Modern industrial control system often contains hundreds of monitoring points and control variables, and there are complex nonlinear coupling relationships between variables. It is challenging in terms of computational complexity and practicality to establish an accurate model covering all variables based on physical principles. Finally, sensitive to model error and uncertainty. The parameter estimation error, modeling hypothesis deviation and measurement noise in the physical model will affect the accuracy of anomaly detection. Especially in the face of well-designed covert attacks, the attack signal may be submerged in the model uncertainty, resulting in poor detection effect.

[0059] However, this anomaly detection method based on physical model constraint has certain interpretability, but the model construction process highly depends on professional knowledge, it is difficult to accurately describe the nonlinear dynamic characteristics of complex industrial systems, and the adaptability to system working condition change and equipment aging is poor, resulting in low detection accuracy of industrial network data.

[0060] In order to improve the detection accuracy of the industrial network data anomaly detection, the embodiments of the present application automatically generate a physical model from the industrial network data, reduce the dependence on the domain expert knowledge, realize the automatic discovery of the physical law, solve the problems of complex and poor adaptability in the traditional physical modeling process, combine the physical model with the physical explainability and the time series feature extraction network capable of accurately fitting the nonlinear dynamic characteristics through the constructed hybrid physical model, use the time series feature extraction network specially learning and predicting the residual of the physical model, so that the advantages are complementary, the overall prediction accuracy of the complex industrial process is greatly improved, then the cumulative statistical value of the residual sequence of the high-precision hybrid model is calculated to judge the anomaly, the small but continuous anomaly signal can be effectively amplified, the sensitive detection of the hidden attack or system gradual failure with low amplitude which is difficult to be found by the traditional method is realized, and the accuracy and robustness of the industrial network anomaly detection are significantly improved.

[0061] The anomaly detection method for industrial network data and the related equipment provided by the present application will be further described below.

[0062] The anomaly detection method for industrial network data in the embodiments of the present application will be described first. Referring to Figure 1 , the anomaly detection method for industrial network data provided by the embodiments of the present application includes an optional flowchart, Figure 1 The method in the embodiments of the present application can include but is not limited to steps 101 to 104. It can be understood that the order of steps 101 to 104 in the embodiments of the present application is not limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs. The anomaly detection method for industrial network data provided by the present application can be applied to any server, processor or the like connected with the industrial network. Figure 1

[0063] Step 101: Obtain industrial network data and generate a physical model corresponding to the industrial network data.

[0064] Step 101 will be described in detail below.

[0065] In some embodiments, the data acquisition module is first used to obtain the industrial network data in the form of multivariate time series from the industrial control network, and the industrial network data contains various sensor data, controller state data, network communication data and other system running information. The data acquisition module includes a data interface unit, a data preprocessing unit and a data storage unit. The data interface unit supports various industrial communication protocols (such as Modbus, OPC, Profinet, etc.); the data preprocessing unit performs cleaning, denoising and standardization processing on the original data; and the data storage unit adopts a time series database structure to ensure efficient storage and fast retrieval of high-frequency data. ​

[0066] Subsequently, in order to establish a benchmark model with physical interpretability, the obtained industrial network data is input into a symbolic regression physics modeling module for data processing. The symbolic regression physics modeling module is a core innovative part of the present application, including three sub-units of genetic programming algorithm engine, physical constraint library and expression optimizer. The genetic programming algorithm engine adopts an improved genetic algorithm, and searches for the optimal physical expression in the predefined function space through steps of population initialization, fitness evaluation, selection operation, crossover and mutation; the physical constraint library pre-stores basic physical laws and constraint conditions in the field of industrial control, and is used to guide the search process and filter candidate solutions that do not conform to the physical law; the expression optimizer adopts a multi-objective optimization strategy, and simultaneously considers model accuracy and complexity, so as to ensure that the generated physical expression is both accurate and concise.

[0067] In the symbolic regression physics modeling module part, the system adopts automatic modeling technologies such as symbolic regression to process the collected industrial network data. Symbolic regression is a machine learning method, which can automatically search and discover explicit mathematical expressions describing the relationship between variables from data without pre-setting the model structure, and the final obtained mathematical expression is a physical model corresponding to the industrial network data . The physical model reveals the internal correlation between system variables in a clear equation form, which conforms to the physical law.

[0068] With reference to Figure 2 , generating a physical model corresponding to the industrial network data includes the following steps 201 to 204.

[0069] Step 201: Obtain a plurality of initial physical models of the industrial network data.

[0070] Step 202: Calculate the corresponding fitness based on the prediction accuracy and complexity of each initial physical model.

[0071] The steps 201 to 202 are described in detail as follows.

[0072] In some embodiments, after obtaining the industrial network data, a plurality of initial physical models of the industrial network data are obtained using a genetic programming algorithm engine in the symbolic regression physical modeling module. This step is the initialization stage of the automated modeling process, the core of which is to construct a diverse set of candidate solutions, which is referred to as "population initialization" in the context of genetic algorithms. Instead of starting from a single model assumption, the system randomly generates a series of mathematical expressions with different structures and parameters, each of which constitutes an initial physical model. These models are represented in a tree structure, with leaf nodes being variables or constants in the industrial network data, and non-leaf nodes being mathematical operators (such as addition, subtraction, multiplication, division, trigonometric functions, etc.). By generating a plurality of initial physical models with different structures, a rich genetic material foundation is provided for the subsequent evolution and optimization process, avoiding premature convergence into local optimal solutions.

[0073] Taking a typical industrial heating process as an example, suppose the goal is to automatically discover a physical model describing the relationship between the temperature of a storage tank and the heater power , the material inflow rate , and the ambient temperature . The genetic programming algorithm engine will first define a set of "genes": basic variables (called "terminal nodes"), namely , , , and some random constants; and a set of mathematical operations (called "function nodes"), such as addition, subtraction, multiplication, division, exponentiation, logarithm, etc. Subsequently, the engine will randomly and recursively combine these terminal nodes and function nodes into a plurality of tree-structured mathematical expressions, which are the initial physical models.

[0074] For example, in this initialization stage, the engine may randomly generate the following several initial physical models with different structures as the first generation "population": Model One is , a simple linear relationship; Model Two is , a more complex nonlinear relationship; and Model Three is , a physically unreasonable expression. The key to this process is "randomness" and "diversity", which does not predefine any model form, but creates an initial solution space containing a large number of candidate models from simple to complex, from reasonable to unreasonable, providing a rich source of raw materials for the subsequent evolution process to filter and optimize the best physical model through "survival of the fittest".

[0075] Next, to select or generate the most suitable physical model from these initial physical models, a fitness corresponding to each initial physical model needs to be calculated based on the prediction accuracy and complexity of each initial physical model. This step is a process of quantitative evaluation of each individual (i.e., each initial physical model) in the population. Fitness is a key evaluation index for measuring the pros and cons of a model. It is not determined solely by prediction accuracy, which refers to the fitting degree of the model to the industrial network data, usually measured by indicators such as root mean square error. At the same time, fitness also includes the consideration of complexity, which is a penalty term for the complexity of the model, such as the number of nodes or tree depth, aiming to avoid the model becoming too bloated in order to fit the data, i.e., so-called "overfitting". By integrating prediction accuracy and complexity, a comprehensive fitness score is calculated, which can guide the algorithm to evolve towards an accurate and concise model. How to calculate the fitness of each initial physical model will be described further below.

[0076] Referring to Figure 3 , the fitness corresponding to each initial physical model is calculated based on the prediction accuracy and complexity of each initial physical model, including the following steps 301 to 304.

[0077] Step 301: Substitute the industrial network data into each initial physical model to obtain the initial physical prediction value.

[0078] Step 302: Based on the difference between the initial physical prediction value and the actual observed value of the industrial network data, the prediction accuracy of each initial physical model is obtained.

[0079] Step 303: Based on the expression composition parameters of each initial physical model, the corresponding complexity is determined.

[0080] Step 304: Based on the weighted sum of prediction accuracy and complexity, the fitness of each initial physical model is obtained.

[0081] The steps 301 to 304 are described in detail below.

[0082] In some embodiments, to calculate the fitness of each initial physical model, first substitute the industrial network data into each initial physical model to obtain the initial physical prediction value. This step is the execution phase of model evaluation, aiming to obtain the specific prediction performance of each candidate model. For each initial physical model in the population (i.e., each candidate mathematical expression), the system will substitute the industrial network data (e.g., historical or real-time acquired sensor readings, control signals, etc.) as input into the expression for calculation. The output of this calculation process, i.e., the predicted output of the specific initial physical model under the given input data, is the initial physical prediction value.

[0083] Then, based on the difference between the initial physical prediction value and the actual observation value of the industrial network data, the prediction accuracy of each initial physical model is obtained. The core of this step is to quantify the accuracy of each model prediction. The system compares the initial physical prediction value obtained in step 301 with the corresponding actual observation value recorded in the industrial network data point by point, calculates the prediction error index between them, and uses the inverse relationship between prediction accuracy and error to obtain the prediction accuracy of each initial physical model. Generally, the smaller the error value, the higher the calculated prediction accuracy index. The prediction error index can use one or more of the conventional error measurement methods such as mean square error, root mean square error, and mean absolute error.

[0084] Then, the complexity of the model structure itself is evaluated to prevent overfitting caused by overly complex models. The system parses the mathematical expression structure of each initial physical model (i.e., analyzes the expression composition parameters) and calculates its complexity score based on one or more pre-defined expression composition parameters. The number of symbol nodes refers to the total number of variables, constants, and operators that make up the expression, and the more the number, the more complex it is. The tree depth refers to the maximum level of the expression in the tree structure representation, and the greater the depth represents the more nested levels of calculation, which is also more complex. The operator type can assign different complexity weights to different types of mathematical operators. By quantifying these parameters, the system determines an objective complexity score for each model that represents its structural simplicity.

[0085] After that, based on the weighted sum of prediction accuracy and complexity, the fitness of each initial physical model is obtained. This step is the core of the comprehensive evaluation, which combines the performance and structure of the model into two dimensions to form the final evaluation index. The system calculates the final fitness of each initial physical model by performing a weighted sum operation on the obtained prediction accuracy and complexity. The weight coefficient can be pre-set according to the specific application scenario to adjust the relative importance of prediction accuracy and model simplicity in the final evaluation. For example, a positive weight can be given to high prediction accuracy, and a negative weight (i.e., as a penalty term) can be given to high complexity. The fitness obtained in this way is a comprehensive and balanced measure that can effectively evaluate whether a model has sufficient prediction ability while also having good simplicity and generalization potential.

[0086] By the above steps 301 to 304, a scientific and comprehensive model evaluation system is constructed, which not only evaluates the fitting ability (i.e. prediction accuracy) of the model to the existing data, but also innovatively introduces the quantitative consideration of the structure (i.e. complexity) of the model itself. By weighting and summing the two, the fitness is calculated, which can effectively inhibit the occurrence of the "overfitting" phenomenon in the model selection process, i.e. avoiding the algorithm's tendency to select those models that can perfectly fit the training data but have an abnormally complex structure, so that the final selected physical model is not only accurate, but also more concise, easy to understand and interpret, thereby significantly improving the generalization ability of the model and ensuring its stable and reliable performance when facing new and unseen data.

[0087] Step 203: selecting a target physical model from the plurality of initial physical models based on the fitness of each initial physical model, and performing cross-mutation processing on the plurality of initial physical models to obtain updated physical models, and taking the updated physical models as new initial physical models, performing multiple cross-mutation updates, and updating the target physical model in the process of cross-mutation update.

[0088] Step 204: taking the target physical model after the last cross-mutation update as the physical model.

[0089] The steps 201 to 204 are described in detail as follows.

[0090] After determining the fitness of each initial physical model, a target physical model is selected from the plurality of initial physical models based on the fitness of each initial physical model, and cross-mutation processing is performed on the plurality of initial physical models to obtain updated physical models, and the updated physical models are taken as new initial physical models, multiple cross-mutation updates are performed, and the target physical model is updated in the process of cross-mutation update. This is the core loop step of model evolution iteration. First, the system selects models with higher fitness from the current population according to the calculated fitness, with the model having the highest fitness being temporarily stored as the target physical model. Then, the selected models are subjected to cross-mutation processing: cross processing refers to exchanging the substructures (subtrees) of two models to produce new offspring models; mutation processing refers to randomly changing a node (such as an operator or a variable) of a single model. These operations produce completely new updated physical models, which constitute a new generation of population (i.e. new initial physical models). This process is repeated, i.e. multiple cross-mutation updates are performed, and after each generation update, the current optimal target physical model is re-evaluated and updated.

[0091] Finally, the target physical model updated after the last crossover mutation is used as the physical model. This step marks the termination of the entire evolutionary optimization process. After the set number of generations of evolution (i.e., multiple crossover mutation updates), the overall fitness of the model in the population will tend to stabilize, or the preset number of iterations will be reached. At this point, the algorithm stops evolving. The system uses the target physical model with the highest fitness recorded and saved throughout the entire iteration process as the final output. This final model is the optimal or suboptimal mathematical expression searched from a massive candidate solution space after balancing prediction accuracy and model simplicity. It is established as the physical model that can represent the inherent laws of the industrial network data. This is used in subsequent anomaly detection processes.

[0092] Through steps 201 to 204 above, an automated, data-driven physical model construction method is realized. By simulating the "survival of the fittest" and "genetic variation" mechanisms in biological evolution, it can automatically search for and discover potential, explicit mathematical relationships between variables in industrial network data, thereby generating a model with clear physical meaning. This solves the technical problems of traditional physical modeling methods, which heavily rely on domain expert knowledge, are time-consuming and labor-intensive, and are difficult to adapt to complex systems. At the same time, by introducing constraints on complexity into the fitness function, it ensures that the final generated physical model not only has high prediction accuracy but also has a simple structure and strong generalization ability, effectively avoiding overfitting problems. This provides a solid and interpretable foundation for building a highly robust anomaly detection system.

[0093] Step 102: Input the industrial network data into the time series feature extraction network for feature prediction to obtain the residual prediction value, and obtain the hybrid physical model based on the physical model and the residual prediction value.

[0094] Step 102 is described in detail below.

[0095] In some embodiments, after obtaining the physical model corresponding to the industrial network data After that, then... The hybrid physics model construction module is used for model fusion processing. This module is responsible for fusing the physical expressions (i.e., physical models) obtained from symbolic regression with deep learning models. This module includes a temporal feature extraction network unit, a model fusion unit, and a model training optimization unit. The temporal feature extraction network unit adopts an adaptive deep neural network architecture, which can automatically adjust the network structure according to the characteristics of specific industrial scenarios, effectively capturing the multi-timescale dynamic characteristics of industrial systems. The model fusion unit is responsible for organically combining the physical expressions from symbolic regression with the feature representations from deep learning, constructing a model like... A hybrid physics model, in which For industrial network data a corresponding physical model part, for the time industrial network data a corresponding residual prediction part, a random disturbance value for the model; the model training optimization unit employs adaptive learning rate adjustment and regularization techniques to prevent model overfitting and improve generalization capability. In a preferred embodiment, this module can also integrate a physical constraint loss function, further enhancing the physical reasonableness of the model by adding a physical consistency constraint term during the training process.

[0096] Based on this, in order to construct a suitable hybrid physical model, the industrial network data needs to be first input into a time series feature extraction network for feature prediction, obtaining the residual prediction , based on the physical model and the residual prediction , a hybrid physical model is obtained. This step aims to make up for the complex nonlinear or dynamic characteristics that the generated physical model may not fully capture. The system parallelly inputs the same industrial network data into a time series feature extraction network, which usually employs deep learning architectures such as Long Short-Term Memory (LSTM) or Transformer, which are good at capturing complex dependencies of data in the time dimension. The learning goal of this time series feature extraction network is not the original value of the industrial network data, but the prediction error of the physical model , i.e., the difference between the physical model prediction value and the actual observation value. Therefore, the feature prediction result output by this network is a prediction of this error, i.e., the residual prediction . Finally, by combining the deterministic output of the physical model with the residual prediction value output by the time series feature extraction network, a hybrid physical model is constructed to describe the system behavior.

[0097] First, we describe how to train the time series feature extraction network, so that the output residual prediction can effectively make up for the prediction error of the physical model .

[0098] Referring to Figure 4 , the training process of the time series feature extraction network includes the following steps 401 to 403.

[0099] Step 401: Obtain the training physical model from the training industrial network data, and determine the training prediction residual of the training physical model.

[0100] Step 402: Input the training industrial network data into the time series feature extraction network for feature extraction, obtain multi-scale features, and integrate the multi-scale features to obtain the training residual prediction value.

[0101] Step 403: Taking the training prediction residual as the learning target of the training residual prediction value, adjusting the network parameters of the time series feature extraction network.

[0102] The steps 401 to 403 are described in detail below.

[0103] In some embodiments, the unit of the time series feature extraction network adopts an adaptive deep neural network architecture, including: an input layer that receives multi-dimensional time series data, adopts a multi-scale time window mechanism, and automatically adjusts the window size according to the time characteristics of different industrial scenarios; a feature extraction layer that adopts a network structure suitable for time series data (such as a recurrent neural network, a long short-term memory network, or a Transformer architecture), and is adaptively selected according to data complexity and computing resources; a fusion layer that integrates multi-scale time features and outputs residual prediction values ; an adaptive adjustment mechanism that dynamically adjusts the network depth, width, and connection mode according to the characteristics of specific industrial control systems (such as the number of variables, time scale, nonlinearity, etc.).

[0104] Based on this, in the training of the time series feature extraction network, first, the training physical model obtained from the training industrial network data is obtained, and the training prediction residual of the training physical model is determined. This step aims to prepare the "learning label" and "true value" for the training of the time series feature extraction network. First, the system uses a part of the industrial network data specially used for model training (i.e., the training industrial network data) to construct a benchmark physical model, which is referred to as the training physical model herein. Subsequently, the training industrial network data is input into this already constructed training physical model for prediction, and the prediction result of the model is compared with the actual observation value in the training industrial network data, and the difference between the two is calculated. This difference sequence, i.e., the training prediction residual of the training physical model, accurately quantifies the shortcomings of the physical model in capturing the complex dynamics of the system, and serves as the learning target of the deep learning model in the time series feature extraction network.

[0105] In addition, in order to ensure the compatibility of the training physical model obtained by symbolic regression output and the deep learning input of the time series feature extraction network in terms of data format and dimension, it is necessary to perform feature alignment on the training prediction residual corresponding to the training physical model, which includes: time dimension alignment, unifying the time sampling frequency and time window length of the symbolic regression physical expression and the deep learning model, ensuring that both models process the same period of data; variable dimension alignment, converting the physical expression output obtained by symbolic regression into a data format compatible with the input layer of the deep learning network, including dimension matching and numerical range standardization; data type unification, ensuring that the calculation result of the physical expression and the data type of the deep learning model are consistent, avoiding data type conversion errors.

[0106] Next, the training industrial network data is input into the time series feature extraction network for feature extraction, to obtain multi-scale features, and to integrate the multi-scale features to obtain a training residual prediction value. This step is the forward propagation process of the network for prediction. The system feeds the same training industrial network data into a time series feature extraction network that is not fully trained or is being trained. The network captures dynamic patterns and dependencies at different time scales from the input time series data through its internal recurrent layers (such as LSTM) or self-attention mechanisms (such as Transformer), and the extracted information is the multi-scale features. Subsequently, the network integrates and maps these multi-scale features through a fully connected layer or the like, and finally outputs a prediction value sequence, which is the network's estimate of the physical model residual, i.e., the training residual prediction value.

[0107] Then, the training prediction residual is taken as the learning target of the training residual prediction value to adjust the network parameters of the time series feature extraction network. This step is the core of network training, i.e., backpropagation and parameter updating. The system takes the "real" training prediction residual as the learning target of the training residual prediction value output by the network. By calculating the loss function (such as mean square error) between the two, the system can quantify the accuracy of the network prediction. Then, using optimization algorithms such as gradient descent, all trainable network parameters (such as weights and biases) inside the time series feature extraction network are adjusted in the opposite direction according to the loss value. This process is repeated until the output of the network (the training residual prediction value) can very accurately fit its learning target (the training prediction residual), so that the network has the ability to accurately predict the physical model error.

[0108] During the training process, the model training optimization unit is responsible for the training process of the time series feature extraction network, which includes: (1) loss function design: using mean square error as the basic loss function to measure the overall prediction accuracy of the hybrid model; (2) training strategy formulation: using a phased training strategy, first fixing the physical expression to train the deep learning part, and then performing end-to-end joint optimization (i.e., first training the time series feature extraction network based on a fixed training physical model, and then updating the training physical model and training the time series feature extraction network); (3) parameter updating mechanism, using an adaptive learning rate adjustment algorithm to dynamically adjust the learning rate according to the loss change during training; (4) regularization processing, using L1 / L2 regularization and Dropout technology to prevent overfitting and ensure model generalization ability; (5) early stopping strategy: monitoring the validation set performance, and stopping training in time when the validation loss no longer decreases to avoid overfitting.

[0109] In one example, the training process of the time series feature extraction network can also use a physical constraint loss function as wherein, is a standard mean square error loss, is an optional physical constraint term, and λ is a balance parameter. The physical constraint term can include various types of industrial physical constraints as mentioned above, such as energy conservation, mass conservation, temperature monotonicity, etc., according to specific application scenarios. Through this optional constraint mechanism, the physical rationality of the model output is further ensured, but the constraint is not necessary, and the system can still work effectively without using the physical constraint loss function.

[0110] The present application designs an efficient and target-oriented network training method through the above steps 401 to 403. Instead of letting the time series feature extraction network learn the entire complex industrial process containing physical laws, the learning task is focused on the training prediction residual that cannot be explained by the physical model. This "difference learning" strategy greatly reduces the learning difficulty of the network, enabling it to focus on capturing the non-linear and time-varying dynamic characteristics missed by the physical model. Not only does this make the network training process easier to converge and more efficient, but the final hybrid model also achieves perfect complementarity between physical mechanisms and data-driven methods. The physical model is responsible for explaining deterministic laws, and the network model accurately compensates for randomness and non-linear errors, thereby achieving prediction accuracy and generalization ability far superior to single models.

[0111] How to obtain a hybrid physical model based on the physical model and the residual prediction value will be further described below.

[0112] With reference to Figure 5 , the hybrid physical model is obtained based on the physical model and the residual prediction value, including the following steps 501 to 502.

[0113] Step 501: Obtain a first weight and a second weight.

[0114] Step 502: Add the product of the first weight and the physical model and the second weight and the residual prediction value to obtain a hybrid physical model.

[0115] The steps 501 to 502 will be described in detail below.

[0116] In some embodiments, the industrial network data for detection is obtained The corresponding physical model and the residual prediction value After that, the first weight and the second weight corresponding to the two are further obtained. This step aims to determine the contribution of each component in the subsequent model fusion process. The first weight and the second weight are preset or learned numerical coefficients, which correspond to the physical model and the residual prediction value the proportion of the final mixed model. These weights can be set statically according to the understanding of the prior knowledge of the industrial system, for example, if it is believed that the physical model is very reliable under most working conditions, a higher value can be given to the first weight. Alternatively, these weights can also be used as hyperparameters, dynamically optimized by optimization algorithms during model training, to find the best combination that minimizes the final mixed prediction error.

[0117] Then, the product of the first weight and the physical model is accumulated with the second weight and the residual prediction value to obtain the hybrid physical model This step is the specific calculation process of model fusion. The system multiplies the prediction output of the physical model on the industrial network data by the first weight, while multiplying the residual prediction value output by the time series feature extraction network by the second weight. Then, the two product results are point-by-point accumulated, and the final output after accumulation represents the comprehensive prediction result of the hybrid physical model. Through this weighted combination, the hybrid physical model is essentially based on the prediction of the physical model, and uses the weighted and adjusted residual prediction value to make fine corrections, thereby forming a complete prediction model that has both physical basis and data-driven correction.

[0118] Through the above steps 501 to 502, a clear and effective model fusion framework is constructed, and by introducing the first weight and the second weight, a flexible adjustable mechanism is provided to balance the certainty of the physical mechanism and the fitting ability of the data-driven model, avoiding the instability that may be caused by the hard combination of the two models. This weighted and accumulated fusion method makes the physical model provide a prediction baseline with strong interpretability, while the residual prediction model serves as a "correction term" to make up for the insufficient description of the physical model in nonlinearity and time-varying characteristics. The final hybrid physical model can therefore combine the advantages of both models, significantly improving the prediction accuracy of complex industrial processes, and enhancing the robustness and adaptability of the model to different working conditions.

[0119] Step 103: obtaining a hybrid prediction value of the industrial network data based on the hybrid physical model, and obtaining a residual sequence based on the difference between the hybrid prediction value and the actual observation value of the industrial network data.

[0120] The following describes step 103 in detail.

[0121] After obtaining the hybrid physical model Then, the current detection time The corresponding industrial network data input statistical enhancement anomaly detection module performs anomaly detection processing to obtain an anomaly detection result. The statistical enhancement anomaly detection module performs anomaly detection based on the output residual error sequence of the hybrid physical model. The module includes a residual error statistical analysis unit and a CUSUM control chart unit. The residual error statistical analysis unit is responsible for establishing an accurate statistical model of the residual error sequence, analyzing its distribution type, parameter characteristics and time correlation; the CUSUM control chart unit realizes sensitive detection of small but continuous deviations, and amplifies directional deviation signals through cumulative and control charts . Wherein, is the cumulative statistical value of the current detection time , is the cumulative statistical value of the last detection time , is the residual error value corresponding to the current detection time, is the mean of the residual error sequence (the residual error sequence includes residual error values of multiple consecutive detection times), is the standard deviation of the residual error sequence, and δ is a drift detection parameter.

[0122] Based on this, after obtaining the hybrid physical model , first, the industrial network data of the current detection time is input into the hybrid physical model to obtain a hybrid prediction value of the industrial network data, and based on the difference between the hybrid prediction value and the actual observation value of the industrial network data, a residual error value is obtained, and a residual error sequence is obtained based on the residual error values of multiple consecutive detection times . In this step, the system uses the hybrid physical model constructed with physical interpretability and high fitting ability to perform online or offline prediction on the input industrial network data, thereby generating a high-precision hybrid prediction value. The hybrid prediction value represents the best estimate of the ideal state of the system at each time by the model. Then, the hybrid prediction value is compared with the corresponding actual observation value in the industrial network data point by point and the difference is calculated, thereby generating a time sequence that evolves over time, i.e., a residual error sequence. The residual error sequence should ideally behave as white noise with a mean of zero, which reflects the part of the system behavior that cannot be explained even by a highly optimized hybrid physical model, and thus becomes an extremely sensitive indicator for detecting anomalies.

[0123] Step 104: Based on the residual error sequence, the cumulative statistical value of the industrial network data is calculated, and the anomaly detection result of the industrial network data is obtained based on the cumulative statistical value.

[0124] Step 104 is described in detail below.

[0125] In some embodiments, the industrial network data is obtained at a current detection time point After the residual sequence is obtained, the cumulative statistical value of the industrial network data is calculated based on the residual sequence, and the anomaly detection result of the industrial network data is obtained based on the cumulative statistical value. In order to effectively detect hidden attacks or gradual faults with small amplitude but long duration, the residual sequence is not simply subjected to instantaneous threshold judgment, but is processed by using a cumulative sum (CUSUM) algorithm in statistical process control. Specifically, the system continuously calculates the cumulative statistical value of the residual sequence, which can continuously accumulate small and same-direction deviations over time, thereby amplifying abnormal signals. The system pre-sets one or more control limits as a judgment threshold. Once the calculated cumulative statistical value exceeds the control limit range, the system determines that the industrial network data is abnormal, and generates a corresponding anomaly detection result, such as an alarm signal. Otherwise, if the cumulative statistical value fluctuates within the control limit, a normal detection result is generated.

[0126] How to determine the cumulative statistical value of the industrial network data will be further described below.

[0127] Referring to Figure 6 , the cumulative statistical value of the industrial network data is calculated based on the residual sequence, including steps 601 to 603.

[0128] Step 601: determining the residual sequence mean and the residual sequence standard deviation of the residual sequence.

[0129] Step 602: based on the difference between the residual value at the current detection time point and the residual sequence mean, and then dividing by the residual sequence standard deviation, to obtain the current residual ratio.

[0130] Step 603: based on the cumulative statistical value at the previous detection time point and the cumulative value of the current residual ratio, and then subtracting the drift detection parameter, to obtain the cumulative statistical value of the industrial network data at the current detection time point.

[0131] Steps 601 to 603 will be described in detail below.

[0132] In some embodiments, the residual sequence mean and the residual sequence standard deviation of the residual sequence are first determined. This step is to calibrate the benchmark parameters for subsequent statistical analysis. The system first analyzes a residual sequence obtained when the system is confirmed to be in a normal operating state, which is regarded as a reference of “normal mode”. By statistically calculating the reference residual sequence, the overall mean (i.e. the residual sequence mean) and the standard deviation (i.e. the residual sequence standard deviation) These two statistics jointly characterize the center position and dispersion degree of residual fluctuation under normal conditions, providing key measurement benchmarks for subsequent judgment of whether new residual values deviate from the normal range.

[0133] Next, based on the residual value at the current detection time , the difference from the residual sequence mean , and then divided by the residual sequence standard deviation , the current residual ratio is obtained. This step aims to standardize each new residual value to eliminate the influence of dimension, making it comparable. When performing online detection, after the system obtains the residual value at the current detection time, it will first calculate the difference between it and the residual sequence mean, which reflects the degree of deviation of the current residual from the normal center. Then, divide the difference by the residual sequence standard deviation. This process is called "standardization" or "Z-score calculation", and the result is the current residual ratio. This ratio represents the degree of deviation of the current residual in units of "standard deviation", which is a dimensionless relative value, facilitating subsequent unified statistical accumulation.

[0134] In order to effectively detect small but persistent system changes, based on the cumulative statistical value at the last detection time and the cumulative value of the current residual ratio , subtract a preset drift detection parameter , and finally obtain the cumulative statistical value of the industrial network data at the current detection time . The cumulative statistical value here is a core variable in sequential analysis techniques, which amplifies weak signals in the time dimension by continuously accumulating standardized residual information. The drift detection parameter is a key adjustment factor, which functions to slightly "pull back" the cumulative sum in each iteration to offset the cumulative effect of pure random noise, ensuring that only when the residual consistently and systematically deviates in a certain direction, the cumulative statistical value will significantly increase. This iterative updating mechanism enables the statistical value to respond sensitively to long-term trend changes in data (i.e., conceptual drift) like an "integrator".

[0135] The application constructs a dynamic cumulative monitoring mechanism for industrial network data through the above steps 601 to 603. The statistical characteristics of the residual sequence are modeled, then the residual at each time is standardized to eliminate the scale effect, and finally a cumulative summation method with drift adjustment is used to integrate historical and current information. The final cumulative statistical value can not only effectively identify significant mutation anomalies in the data, but also sensitively capture slow-changing system performance degradation or working condition drift problems that are difficult to find by traditional threshold methods. This design makes the detection method more robust and sensitive in complex industrial network environments, providing strong technical support for ensuring the stable operation and predictive maintenance of industrial systems.

[0136] After obtaining the cumulative statistical value, it is input into the abnormal detection result processing module for abnormal matching detection. The abnormal detection result processing module of the present application is responsible for output processing and alarm management of the detected anomalies. The module includes an anomaly scoring unit, a result output unit and an alarm management unit. The anomaly scoring unit quantitatively evaluates the detected anomalies to generate an anomaly confidence score; the result output unit outputs the anomaly detection result in a standardized format, facilitating subsequent system integration and manual analysis; the alarm management unit generates alarm information and pushes it to relevant operation and maintenance personnel through various ways (email, SMS, system notification, etc.). In further embodiments, the module can also be extended to include anomaly type classification function and attack trace analysis function to provide more comprehensive anomaly diagnosis capability.

[0137] How to obtain the anomaly detection result of the industrial network data using the cumulative statistical value will be further described below.

[0138] Referring to Figure 7 , the anomaly detection result of the industrial network data based on the cumulative statistical value includes the following steps 701 to 703.

[0139] Step 701: Obtain the anomaly detection range.

[0140] Step 702: When the cumulative statistical value is not within the anomaly detection range, generate an anomaly detection result indicating that the industrial network data is abnormal.

[0141] Step 703: When the cumulative statistical value is within the anomaly detection range, generate an anomaly detection result indicating that the industrial network data is normal.

[0142] The steps 701 to 703 will be described in detail below.

[0143] In some embodiments, in addition to obtaining the cumulative statistic value corresponding to the current detection time, the abnormality detection range also needs to be obtained. This step is to set a clear and quantitative standard for the final decision-making judgment. The abnormality detection range is usually composed of an upper control limit and a lower control limit, which together define a numerical interval. The setting of this interval is based on statistical principles and a deep understanding of the normal behavior of the system, aiming to define a reasonable limit within which the cumulative statistic value should fluctuate under normal operating conditions. The process of obtaining this range may include statistical calculation based on historical normal data, or setting according to the requirements of system safety (e.g., expected false alarm rate and missed alarm rate), which provides an objective and stable basis for subsequent judgment.

[0144] When the real-time detected cumulative statistic value is not within the abnormality detection range, an abnormality detection result indicating that the industrial network data is abnormal is generated. This step is the triggering and response mechanism of abnormal events. In the continuous monitoring process, the system continuously compares the real-time calculated cumulative statistic value with the obtained abnormality detection range. Once the size of the cumulative statistic value exceeds the upper limit or lower limit of the range, it indicates that the cumulative deviation of the system residual has exceeded the statistically acceptable normal fluctuation, reaching a significantly abnormal level. At this time, the system immediately determines that the current state is abnormal and generates an abnormality detection result indicating that the industrial network data is abnormal. This result can be specifically manifested as issuing an alarm, recording a log, or triggering a corresponding safety response program.

[0145] When the cumulative statistic value is within the abnormality detection range , an abnormality detection result indicating that the industrial network data is normal is generated. This step describes the continuous confirmation process of the system in the normal operating state. As long as the real-time calculated cumulative statistic value fluctuates between the upper and lower limits defined by the abnormality detection range, the system believes that the cumulative effect of the residual has not posed a threat, and the system behavior conforms to its normal mode. Therefore, the system continuously generates an abnormality detection result indicating that the industrial network data is normal. This step ensures that the detection system remains silent when there is no real abnormality, avoiding unnecessary interference, and is the regular state of maintaining normal operation monitoring of the system.

[0146] The application establishes a clear, reliable and automated decision-making process through steps 701 to 703, converts the complex and continuous cumulative statistical value sequence into a simple and clear binary judgment result (normal or abnormal) by comparing it with a clear abnormality detection range. This decision-making mechanism based on statistical control limit has higher robustness and sensitivity than simple instantaneous value threshold judgment because it acts on a signal amplified by time accumulation. This makes the final abnormality detection result not only accurate, but also effectively distinguishes statistical random noise from real system abnormalities with persistence, thereby providing timely, accurate and executable decision support for industrial network security protection.

[0147] Reference Figure 8 is a structural schematic diagram of an abnormality detection system provided by an embodiment of the application and applying an abnormality detection method. As shown in Figure 8 The system first acquires real-time industrial network data from the industrial control network through a data acquisition module. Then, the data is sent to a symbolic regression physical modeling module and a hybrid physical model construction module, which are core modules for constructing a hybrid physical model capable of accurately predicting normal behavior of the system. The difference between the prediction value generated by the model and the actually acquired data constitutes the residual sequence described in the foregoing technical solution. The statistical enhancement abnormality detection module in the figure is a core functional unit for calculating the cumulative statistical value, which receives the hybrid physical model as a reference and internally implements the complete abnormality detection logic: determining the statistical characteristics of the residual sequence, calculating the normalized current residual ratio, and finally obtaining the cumulative statistical value by iteratively updating the drift detection parameter to generate the abnormality detection result. The result is finally sent to an abnormality detection result processing module for subsequent alarm or response disposal, which fully demonstrates a closed-loop processing process from establishing a dynamic baseline to implementing sensitive drift detection.

[0148] The following takes an industrial scene as an example.

[0149] First, the industrial network data needs to be acquired and a baseline behavior model needs to be established. In a scene, an industrial control network connected with a programmable logic controller (PLC) and a remote terminal unit (RTU) is monitored. The request-response time interval of the Modbus communication protocol between the two during the normal production cycle is collected as the key industrial network data. The system will use the historical data in the healthy state to train a prediction model (such as a time series prediction model), which can predict the normal time interval at the next detection time according to the historical time interval sequence.

[0150] After that, the system enters the real-time monitoring phase and starts to calculate the residual series. At each detection time, the system records the actual request-response time interval (actual observation value) and the prediction model also outputs a predicted time interval (predicted value). The system calculates the difference between the two values (actual value - predicted value) as a residual. Over time, these continuously calculated differences constitute the residual series, which is the core of the analysis object of the scheme. When the network is normal, the residual series should be like random white noise, randomly fluctuating around 0.

[0151] Then, the system performs the most critical cumulative analysis process. First, the system calculates the statistical characteristics of an initial residual series that is confirmed to be normal, that is, the mean of the residual series (theoretically close to 0 ms) and the standard deviation of the residual series (for example, 0.5 ms). Then, suppose that there is a slow and continuous performance degradation in the network, which may be due to device aging or slight network congestion, causing the response time to be continuously and slightly longer than the model's predicted value. For example, at a certain time, the residual value is +0.8 ms, and the system will calculate the current residual ratio as (0.8 - 0) / 0.5 = 1.6. Next, the system will use the cumulative statistical value of the last time, add 1.6, and subtract a small drift detection parameter (for example, 0.1) to get the new cumulative statistical value at the current time. Since the performance problem is continuous, the subsequent residual values will be continuously positive, causing the cumulative statistical value to continuously increase.

[0152] Finally, the system makes the final abnormality determination. The system internally presets an alarm threshold, for example, 10.0. At each detection time, the calculated cumulative statistical value is compared with the threshold. In the early stage of performance degradation, although the single residual is small, after continuous accumulation, the cumulative statistical value will steadily rise from 1.5 (0 + 1.6 - 0.1) to 2.9, then to 4.4……, and finally, when this value exceeds 10.0, the system will determine that there is a significant performance drift anomaly. At this time, the system will trigger an alarm to inform the operation and maintenance personnel that there is a continuously deteriorating potential problem in the network. In this way, the scheme successfully converts a series of isolated and insignificant small delays into a clear and quantifiable alarm signal, achieving effective detection of slow performance degradation or hidden network attacks that are difficult to detect by traditional threshold methods.

[0153] The method for detecting the abnormality of industrial network data and the related device provided by the embodiments of the present application comprise the following steps: first, obtaining the industrial network data, obtaining a plurality of initial physical models of the industrial network data, substituting the industrial network data into each initial physical model to obtain an initial physical prediction value, obtaining the prediction accuracy of each initial physical model based on the difference between the initial physical prediction value and the actual observation value of the industrial network data, determining the corresponding complexity based on the expression component parameters of each initial physical model, the expression component parameters comprising at least one of the following: the number of symbol nodes, the tree depth, and the operator type, obtaining the fitness of each initial physical model based on the weighted sum of the prediction accuracy and the complexity, selecting a target physical model from the plurality of initial physical models based on the fitness of each initial physical model, and performing cross mutation processing on the plurality of initial physical models to obtain an updated physical model, taking the updated physical model as a new initial physical model, performing multiple cross mutation updates, and updating the target physical model in the process of cross mutation update, taking the target physical model after the last cross mutation update as the physical model; next, inputting the industrial network data into a time sequence feature extraction network to perform feature prediction, obtaining a residual prediction value, obtaining a first weight and a second weight, accumulating the product of the first weight and the physical model and the second weight and the residual prediction value to obtain a hybrid physical model; then, obtaining the hybrid prediction value of the industrial network data based on the hybrid physical model, and obtaining a residual sequence based on the difference between the hybrid prediction value and the actual observation value of the industrial network data; finally, determining the residual sequence mean and the residual sequence standard deviation of the residual sequence, obtaining the current residual ratio based on the difference between the residual value at the current detection time and the residual sequence mean, and then dividing by the residual sequence standard deviation, obtaining the cumulative statistical value of the industrial network data at the current detection time based on the accumulated value of the current residual ratio and the cumulative statistical value at the last detection time, and then subtracting the drift detection parameter, obtaining the abnormality detection range, generating an abnormality detection result representing that the industrial network data is abnormal when the cumulative statistical value is not within the abnormality detection range, and generating an abnormality detection result representing that the industrial network data is normal when the cumulative statistical value is within the abnormality detection range.

[0154] The embodiments of the application reduce the dependence on domain expert knowledge by automatically generating a physical model from industrial network data, realize the automatic discovery of physical laws, solve the problem of complex and poor adaptability of the traditional physical modeling process, and then combine the physical model with physical interpretability with the time series feature extraction network capable of accurately fitting the nonlinear dynamic characteristics through the constructed hybrid physical model, use the time series feature extraction network specially learning and predicting the residual of the physical model, so as to realize the complementary advantages, greatly improve the overall prediction accuracy of the complex industrial process, and then calculate the cumulative statistical value of the residual sequence of the high-precision hybrid model to judge the anomaly, which can effectively amplify the small but continuous abnormal signal, realize the sensitive detection of hidden attacks or system gradual faults with low amplitude that are difficult to be found by traditional methods, thereby significantly improving the accuracy and robustness of industrial network anomaly detection; in addition, a scientific and comprehensive model evaluation system is constructed, not only the fitting ability (i.e. prediction accuracy) of the model to the existing data is evaluated, but also the structure (i.e. complexity) of the model itself is innovatively introduced for quantitative consideration, and the fitness is calculated by weighted summation, which can effectively suppress the occurrence of "overfitting" phenomenon in the model selection process, that is, the algorithm avoids selecting those models that can perfectly fit the training data but have abnormal complex structure, so that the finally selected physical model is not only accurate, but also more concise, easy to understand and explain, thereby significantly improving the generalization ability of the model and ensuring its stable and reliable performance when facing new and unseen data; and, an automatic and data-driven physical model construction method is realized, which can automatically search and discover the potential and explicit mathematical relationship between variables from industrial network data through the "survival of the fittest" and "genetic variation" mechanism in biological evolution, thereby generating a model with clear physical meaning, solving the technical problems of traditional physical modeling methods that seriously depend on domain expert knowledge, time-consuming and labor-intensive, and difficult to adapt to complex systems, at the same time, by introducing the complexity constraint in the fitness function, the finally generated physical model not only has high prediction accuracy, but also has simple structure and strong generalization ability, effectively avoiding the overfitting problem, and providing a solid and interpretable foundation for building a high-robustness anomaly detection system.Further, a clear and effective model fusion framework is constructed, by introducing the first weight and the second weight, a flexible and adjustable mechanism is provided to balance the certainty of the physical mechanism and the fitting ability of the data-driven model, avoiding the instability that may be caused by the hard combination of the two models. The weighted and accumulated fusion method makes the physical model provide a prediction baseline with strong interpretability, while the residual prediction model serves as a "correction term" to make up for the insufficient description of the physical model in nonlinearity and time-varying characteristics. The final hybrid physical model can therefore combine the advantages of both models, significantly improving the prediction accuracy of complex industrial processes, and enhancing the robustness and adaptability of the model to different working conditions. In addition, a dynamic cumulative monitoring mechanism for industrial network data is constructed. The statistical characteristics of the residual sequence are modeled, and then the residuals at each time are standardized to eliminate the scale effect. Finally, a cumulative sum method with drift adjustment is used to integrate historical and current information. The cumulative statistical value generated can not only effectively identify significant mutations in the data, but also sensitively capture the slow changes in system performance degradation or working condition drift that are difficult to detect by traditional threshold methods. This design makes the detection method more robust and sensitive in complex industrial network environments, providing strong technical support for the stable operation and predictive maintenance of industrial systems. Finally, a clear, reliable and automated decision-making process is established. The complex and continuous cumulative statistical value sequence is compared with a clear abnormal detection range to convert it into a simple and clear binary judgment result (normal or abnormal). This decision-making mechanism based on statistical control limits has higher robustness and sensitivity than simple instantaneous value threshold judgment because it acts on a signal that has been amplified by time accumulation. This makes the final abnormal detection result not only accurate, but also effectively distinguishes between random noise and real system anomalies with persistence, providing timely, accurate and executable decision support for the safety protection of industrial networks.

[0155] The embodiment of the present application also provides an abnormality detection device for industrial network data, which can implement the above-mentioned abnormality detection method for industrial network data, and the device is referred to as Figure 9 The device 900 comprises:

[0156] A physical model generation module 910 is configured to acquire industrial network data and generate a physical model corresponding to the industrial network data.

[0157] A hybrid physical model generation module 920 is configured to input the industrial network data into a time sequence feature extraction network to obtain a residual prediction value, and obtain a hybrid physical model based on the physical model and the residual prediction value.

[0158] The residual sequence generation module 930 is configured to obtain a hybrid prediction value of the industrial network data based on the hybrid physical model, and obtain a residual sequence based on a difference between the hybrid prediction value and an actual observation value of the industrial network data.

[0159] The anomaly detection module 940 is configured to calculate a cumulative statistical value of the industrial network data based on the residual sequence, and obtain an anomaly detection result of the industrial network data based on the cumulative statistical value.

[0160] In some embodiments, the physical model generation module 910 is further configured to:

[0161] obtain a plurality of initial physical models of the industrial network data;

[0162] calculate a fitness of each initial physical model based on a prediction accuracy and a complexity of the initial physical model;

[0163] select a target physical model from the plurality of initial physical models based on the fitness of each initial physical model, and perform cross mutation processing on the plurality of initial physical models to obtain an updated physical model, and use the updated physical model as a new initial physical model to perform cross mutation updating multiple times, and update the target physical model in the cross mutation updating process;

[0164] use the target physical model after the last cross mutation updating as the physical model.

[0165] In some embodiments, the physical model generation module 910 is further configured to:

[0166] obtain an initial physical prediction value by substituting the industrial network data into each initial physical model;

[0167] calculate a prediction accuracy of each initial physical model based on a difference between the initial physical prediction value and an actual observation value of the industrial network data;

[0168] determine a complexity of each initial physical model based on an expression component parameter of the initial physical model, the expression component parameter including at least one of a symbol node number, a tree depth, and an operator type;

[0169] calculate a fitness of each initial physical model based on a weighted sum of the prediction accuracy and the complexity.

[0170] In some embodiments, the hybrid physical model generation module 920 is further configured to:

[0171] obtain a training physical model obtained from training industrial network data, and determine a training prediction residual of the training physical model;

[0172] The training industrial network data is input into the time sequence feature extraction network for feature extraction, to obtain multi-scale features, and the multi-scale features are integrated to obtain a training residual prediction value.

[0173] The training prediction residual is taken as a learning target of the training residual prediction value, and the network parameter of the time sequence feature extraction network is adjusted.

[0174] In some embodiments, the hybrid physical model generation module 920 is further configured to:

[0175] obtain a first weight and a second weight;

[0176] accumulate the product of the first weight and the physical model and the second weight and the residual prediction value to obtain the hybrid physical model.

[0177] In some embodiments, the residual sequence generation module 930 is further configured to:

[0178] determine a residual sequence mean and a residual sequence standard deviation of the residual sequence;

[0179] based on the difference between the residual value at the current detection time and the residual sequence mean, and then divided by the residual sequence standard deviation, to obtain a current residual ratio;

[0180] based on the accumulated statistical value at the last detection time and the accumulated value of the current residual ratio, and then subtracting a drift detection parameter, to obtain the accumulated statistical value of the industrial network data at the current detection time.

[0181] In some embodiments, the anomaly detection module 940 is further configured to:

[0182] obtain an anomaly detection range;

[0183] when the accumulated statistical value is not within the anomaly detection range, generate an anomaly detection result representing that the industrial network data is abnormal;

[0184] when the accumulated statistical value is within the anomaly detection range, generate an anomaly detection result representing that the industrial network data is normal.

[0185] In the above embodiments, the description of each embodiment has its own emphasis, and the specific embodiments of the industrial network data anomaly detection apparatus are basically the same as the specific embodiments of the above industrial network data anomaly detection method, which will not be repeated here.

[0186] In the embodiments of the present application, the industrial network data anomaly detection device reduces the dependence on domain expert knowledge by automatically generating a physical model from the industrial network data, realizes the automatic discovery of physical laws, solves the problems of complex and poor adaptability in the traditional physical modeling process, and then combines the physical model with physical interpretability and the time series feature extraction network capable of accurately fitting the nonlinear dynamic characteristics by constructing a hybrid physical model, uses the time series feature extraction network that learns and predicts the residual of the physical model, thereby realizing the complementary advantages and greatly improving the overall prediction accuracy of the complex industrial process. Then, the cumulative statistical value of the residual sequence of the high-precision hybrid model is calculated to judge the anomaly, which can effectively amplify the small but continuous abnormal signal, realize the sensitive detection of hidden attacks or system gradual faults with low amplitude that are difficult to be found by traditional methods, and significantly improve the accuracy and robustness of industrial network anomaly detection. In addition, a scientific and comprehensive model evaluation system is constructed, which not only evaluates the fitting ability (i.e. prediction accuracy) of the model to the existing data, but also innovatively introduces the quantitative consideration of the model structure (i.e. complexity), and calculates the fitness by weighted summation, which can effectively suppress the occurrence of "overfitting" phenomenon in the model selection process, i.e. avoid the algorithm to select those models that can perfectly fit the training data but have abnormal complex structure, so that the finally selected physical model is not only accurate, but also more concise, easy to understand and explain, thereby significantly improving the generalization ability of the model and ensuring its stable and reliable performance when facing new and unseen data. Furthermore, an automatic and data-driven physical model construction method is realized, which can automatically search and discover the potential and explicit mathematical relationship between variables from the industrial network data by simulating the "survival of the fittest" and "genetic variation" mechanism in biological evolution, thereby generating a model with clear physical meaning, solving the technical problems of traditional physical modeling methods that seriously depend on domain expert knowledge, time-consuming and laborious, and difficult to adapt to complex systems. At the same time, by introducing the complexity constraint in the fitness function, the finally generated physical model not only has high prediction accuracy, but also has simple structure and strong generalization ability, effectively avoiding overfitting, and providing a solid and interpretable foundation for building a high-robustness anomaly detection system.Further, a structural clear and significant model fusion framework is constructed, by introducing the first weight and the second weight, a flexible adjustable mechanism is provided to balance the certainty of the physical mechanism and the fitting ability of the data driven model, avoiding the instability that may be caused by the hard combination of the two models, this weighted accumulation fusion method makes the physical model provide a prediction baseline with strong interpretability, while the residual prediction model acts as its "correction term", which specially makes up for the insufficient description of the physical model in the nonlinearity and time-varying characteristics, and the final hybrid physical model can therefore combine the advantages of the two models, not only significantly improving the prediction accuracy of the complex industrial process, but also enhancing the robustness and adaptability of the model to different working conditions; in addition, a dynamic cumulative monitoring mechanism for industrial network data is constructed, by modeling the statistical characteristics of the residual sequence, then standardizing the residual at each time to eliminate the scale effect, and finally using a cumulative sum method with drift adjustment to integrate historical and current information, the final cumulative statistical value can not only effectively identify the significant mutation anomalies in the data, but also sensitively capture the slowly changing system performance degradation or working condition drift that is difficult to be found by traditional threshold methods, this design makes the detection method have higher robustness and detection sensitivity in complex industrial network environment, and provides strong technical support for ensuring the stable operation and predictive maintenance of industrial systems; finally, a clear, reliable and automatic decision-making process is established, which converts the complex and continuous cumulative statistical value sequence into a simple and clear binary judgment result (normal or abnormal) by comparing it with a clear abnormal detection range, this decision-making mechanism based on statistical control limit has higher robustness and sensitivity than simple instantaneous value threshold judgment, because it acts on a signal that has been amplified by time accumulation. This makes the final abnormal detection result not only accurate, but also can effectively distinguish between statistical random noise and real system anomalies with persistence, thereby providing timely, accurate and executable decision support for the safety protection of industrial networks. The embodiment of the application also provides an electronic device, comprising:

[0187] At least one memory;

[0188] At least one processor;

[0189] At least one program;

[0190] The program is stored in the memory, and the processor executes the at least one program to implement the industrial network data anomaly detection method described above. The electronic device can be any smart terminal including a mobile phone, a tablet computer, a personal digital assistant (Personal Digital Assistant, PDA), a vehicle-mounted computer, etc.

[0191] Please refer to Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is illustrated, and the electronic device includes:

[0192] The processor 1001 can be implemented in a manner of a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, and is configured to execute a related program to implement the technical solutions provided by the embodiments of the present application.

[0193] The memory 1002 can be implemented in a form of a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory), etc. The memory 1002 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present application are implemented by software or firmware, the related program codes are stored in the memory 1002 and are called and executed by the processor 1001 to implement the industrial network data anomaly detection method of the embodiments of the present application.

[0194] The input / output interface 1003 is configured to implement information input and output.

[0195] The communication interface 1004 is configured to implement the communication interaction between the device and other devices, and can realize the communication through a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0196] The bus 1005 is configured to transmit information between various components (for example, the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004) of the device.

[0197] The processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are connected to each other through the bus 1005 to realize the communication connection between the devices.

[0198] The embodiments of the present application further provide a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program. The computer program is executed by the processor to implement the industrial network data anomaly detection method.

[0199] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include a high-speed random access memory and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory disposed remotely with respect to the processor, which can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0200] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0201] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than shown in the figures, or combine certain steps, or different steps.

[0202] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0203] Those skilled in the art can understand that all or some of the steps in the above disclosed method, the functional modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0204] The terms "first", "second", "third", "fourth" and the like used in the specification of the present application and the above-described drawings, if any, are used to distinguish similar objects, and do not necessarily have to be used to describe a particular order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0205] It should be understood that, in the application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b and c can be single or multiple.

[0206] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the above units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between devices or units, which can be electrical, mechanical or other forms.

[0207] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. According to actual needs, part or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0208] In addition, the functional units in each embodiment of the application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0209] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0210] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and are not limited to the scope of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. An anomaly detection method of industrial network data, characterized by, The method comprises: acquiring industrial network data, generating a physical model corresponding to the industrial network data; inputting the industrial network data into a time series feature extraction network for feature prediction to obtain a residual prediction value, and based on the physical model and the residual prediction value, obtaining a hybrid physical model; based on the hybrid physical model, obtaining a hybrid prediction value of the industrial network data, and based on the difference between the hybrid prediction value and the actual observation value of the industrial network data, obtaining a residual sequence; based on the residual sequence, calculating a cumulative statistical value of the industrial network data, and based on the cumulative statistical value, obtaining an anomaly detection result of the industrial network data; the generation of the physical model corresponding to the industrial network data comprises: acquiring a plurality of initial physical models of the industrial network data; based on the prediction accuracy and complexity of each initial physical model, the corresponding fitness is calculated; based on the fitness of each initial physical model, a target physical model is selected from a plurality of initial physical models, and a plurality of initial physical models are processed by cross mutation to obtain an updated physical model, and the updated physical model is used as a new initial physical model for multiple cross mutation updates, and the target physical model is updated during the cross mutation update; the target physical model after the last cross mutation update is used as the physical model; based on the physical model and the residual prediction value, the hybrid physical model is obtained, comprising: acquiring a first weight and a second weight; accumulating the product of the first weight and the physical model and the second weight and the residual prediction value to obtain the hybrid physical model.

2. The method of anomaly detection of industrial network data according to claim 1, wherein based on the prediction accuracy and complexity of each initial physical model, the corresponding fitness is calculated, comprising: substitute the industrial network data into each initial physical model to obtain an initial physical prediction value; based on the difference between the initial physical prediction value and the actual observation value of the industrial network data, the prediction accuracy of each initial physical model is obtained; based on the expression component parameters of each initial physical model, the corresponding complexity is determined, and the expression component parameters include at least one of symbol node number, tree depth and operator type; based on the weighted sum of the prediction accuracy and the complexity, the fitness of each initial physical model is obtained.

3. The method of anomaly detection of industrial network data according to claim 1, wherein, The training process of the time series feature extraction network comprises: acquiring a training physical model obtained from training industrial network data, and determining a training prediction residual of the training physical model; inputting the training industrial network data into the time series feature extraction network for feature extraction to obtain multi-scale features, and integrating the multi-scale features to obtain a training residual prediction value; the training prediction residual is used as the learning target of the training residual prediction value to adjust the network parameters of the time series feature extraction network.

4. The method of anomaly detection of industrial network data according to claim 1, wherein, The residual sequence includes a plurality of residual values corresponding to detection times, and based on the residual sequence, the cumulative statistical value of the industrial network data is calculated, comprising: determining the residual sequence mean and residual sequence standard deviation of the residual sequence; a current residual ratio is obtained based on a difference between a residual value at a current detection time and a mean value of the residual sequence, and then divided by a standard deviation of the residual sequence; an accumulated statistical value of the industrial network data at the current detection time is obtained based on an accumulated statistical value at a previous detection time, an accumulated value of the current residual ratio, and a subtraction of a drift detection parameter.

5. The method of anomaly detection of industrial network data according to claim 1, wherein, the anomaly detection result of the industrial network data is obtained based on the accumulated statistical value, including: an anomaly detection range is obtained; when the accumulated statistical value is not within the anomaly detection range, the anomaly detection result indicating that the industrial network data is abnormal is generated; when the accumulated statistical value is within the anomaly detection range, the anomaly detection result indicating that the industrial network data is normal is generated.

6. An anomaly detection apparatus of industrial network data, characterized by, the device includes: a physical model generation module configured to obtain industrial network data and generate a physical model corresponding to the industrial network data; a hybrid physical model generation module configured to input the industrial network data into a time series feature extraction network to obtain a residual prediction value, and obtain a hybrid physical model based on the physical model and the residual prediction value; a residual sequence generation module configured to obtain a hybrid prediction value of the industrial network data based on the hybrid physical model, and obtain a residual sequence based on a difference between the hybrid prediction value and an actual observation value of the industrial network data; an anomaly detection module configured to obtain an accumulated statistical value of the industrial network data based on the residual sequence, and obtain an anomaly detection result of the industrial network data based on the accumulated statistical value. the physical model corresponding to the industrial network data is generated, including: a plurality of initial physical models of the industrial network data are obtained; a fitness of each initial physical model is calculated based on a prediction accuracy and a complexity of the initial physical model; a target physical model is selected from the plurality of initial physical models based on the fitness of each initial physical model, and a plurality of updated physical models are obtained by performing cross mutation processing on the plurality of initial physical models, and the updated physical models are used as new initial physical models for multiple cross mutation updates, and the target physical model is updated during the cross mutation updates; the target physical model after the last cross mutation update is used as the physical model; the hybrid physical model is obtained based on the physical model and the residual prediction value, including: a first weight and a second weight are obtained; a product of the first weight and the physical model and a product of the second weight and the residual prediction value are accumulated to obtain the hybrid physical model.

7. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to realize the anomaly detection method of the industrial network data in any one of claims 1-5.

8. A storage medium storing a computer program, characterized by The computer program is executed by the processor to realize the anomaly detection method of the industrial network data in any one of claims 1-5.

Images