Industrial control system anomaly detection method and device, electronic equipment and medium

Abstract

The invention relates to an industrial control system anomaly detection method and device, electronic equipment and a medium, and the method comprises the steps: obtaining and dividing multivariable time series data of a target industrial control system to obtain corresponding time window data, and decoupling the time window data into window low-frequency and window high-frequency components; constructing a corresponding process diagram according to the process knowledge of the target industrial control system, extracting an association relationship in the low-frequency component of the window, dynamically updating the process diagram through the association relationship, and embedding the low-frequency component based on the updated process diagram and the diagram neural network; and reconstructing the embedded window low-frequency component and window high-frequency component to determine corresponding reconstruction loss, and training a target neural network through the reconstruction loss to obtain an anomaly detection model so as to perform anomaly detection on the target industrial control system. Therefore, the problems that in an existing industrial control system anomaly detection technology, frequency domain feature extraction is insufficient, and dynamic process association cannot be fully modeled are solved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, device, electronic device and medium for detecting anomalies in industrial control systems. Background Technology

[0002] With the rapid development of Industry 4.0 technologies and their widespread application in manufacturing, Industrial Control Systems (ICS) have evolved into highly interconnected and complex infrastructures. These systems involve numerous sensors, actuators, and controllers working collaboratively to achieve efficient monitoring and management of industrial processes through a layered architecture. A typical ICS employs a layered structure, with the upper supervisory control layer communicating with the lower-level physical devices through automation control layers such as Programmable Logic Controllers (PLCs). This enables data acquisition and command issuance from field devices, promoting the deep integration of industrial automation and information technology, and making advanced functions such as remote monitoring and automatic control possible.

[0003] However, with increasing system interconnectivity and complexity, industrial control systems face growing security and management challenges. Anomalies may manifest as unusual behavior in sensors and actuators, such as sudden data changes, abnormal frequency fluctuations, and signal distortion. These anomalies can not only disrupt production processes and damage equipment but also pose safety hazards. Attackers may exploit protocol vulnerabilities to carry out deception, man-in-the-middle attacks, or interfere with the normal control of the PLC through malicious code, ultimately aiming to disrupt physical processes, interfere with the normal operation of sensors and actuators, and cause serious consequences.

[0004] Existing methods for detecting anomalies in industrial control systems primarily rely on clustering, statistical modeling, or time-series data analysis based on deep learning. While deep learning has made some progress in capturing complex temporal dependencies and high-dimensional features, it still suffers from two shortcomings. First, most methods focus only on time-domain features, neglecting the rich anomaly information contained in the frequency domain, resulting in insufficient detection capabilities for certain spectral anomalies. For example, when equipment malfunctions, sensor signals may exhibit high-frequency jitter or oscillations. These phenomena appear as data remaining within the normal threshold range in the time domain, but a significant aberration in high-frequency components can be observed in frequency domain analysis. Traditional time-domain methods often struggle to identify such hidden anomalies. Second, existing deep learning methods are unable to effectively model the actual coupling relationships between physical components and struggle to identify abnormal interactions across components.

[0005] In summary, existing anomaly detection technologies for industrial control systems suffer from insufficient frequency domain feature extraction, failing to adequately model dynamic process relationships, and this issue urgently needs to be addressed. Summary of the Invention

[0006] This application provides an industrial control system anomaly detection method, device, electronic equipment, and medium to solve the problems of insufficient frequency domain feature extraction and inability to fully model dynamic process relationships in existing industrial control system anomaly detection technologies.

[0007] The first aspect of this application provides an anomaly detection method for an industrial control system, applied in the offline training stage, comprising the following steps: acquiring and dividing multivariate time series data of a target industrial control system to obtain corresponding time window data, and decoupling the time window data into corresponding low-frequency components and high-frequency components; constructing a corresponding process diagram based on the process knowledge of the target industrial control system, and extracting the correlation relationships in the low-frequency components of the window to dynamically update the process diagram through the correlation relationships, and embedding the low-frequency components based on the updated process diagram and a preset graph neural network; reconstructing the embedded low-frequency components and the high-frequency components of the window to determine the corresponding reconstruction loss, and training the target neural network through the reconstruction loss to generate an anomaly detection model, so as to use the anomaly detection model to detect anomalies in the target industrial control system in the online detection stage.

[0008] Optionally, in one embodiment of this application, the step of acquiring and dividing the multivariate time series data of the target industrial control system to obtain corresponding time window data, and decoupling the time window data into corresponding window low-frequency components and window high-frequency components, includes: acquiring multivariate time series data containing state change entries of the target industrial control system, wherein the system state change entries include timestamps, entity names, and entity values; dividing the multivariate time series data according to time windows, and using discrete wavelet transform to decouple the multivariate time series data in each window into the window low-frequency components and the window high-frequency components.

[0009] Optionally, in one embodiment of this application, the step of constructing a corresponding process diagram based on the process knowledge of the target industrial control system, extracting the correlation relationships in the low-frequency components of the window, dynamically updating the process diagram through the correlation relationships, and embedding the low-frequency components based on the updated process diagram and a preset graph neural network includes: modeling the process flow of the target industrial control system using a preset graph structure to obtain the process diagram, so as to characterize the process flow of the target industrial control system according to the process diagram; calculating the Pearson correlation coefficient between the low-frequency components of the window corresponding to the ingress and egress nodes of the edge in the process diagram, so as to characterize the correlation relationship between the multivariate time series data in each window, and constructing a window correlation coefficient matrix corresponding to the process diagram according to the correlation relationships; and inputting the low-frequency components of the window and the window correlation coefficient matrix into the graph neural network to embed the low-frequency components.

[0010] Optionally, in one embodiment of this application, the step of reconstructing the embedded low-frequency component and the high-frequency component of the window to determine the corresponding reconstruction loss includes: inputting the embedded low-frequency component and the high-frequency component of the window into a preset encoder-decoder structure to obtain the corresponding final representation vector; and determining the reconstruction loss between the low-frequency component or the high-frequency component of the window and the final representation vector based on the graph neural network and the encoder-decoder structure.

[0011] A second aspect of this application provides an anomaly detection method for an industrial control system, applied in the online detection stage, comprising the following steps: acquiring test data of a target industrial control system; dividing the test data and decoupling the divided data to obtain corresponding decoupled data, wherein the decoupled data includes low-frequency components and high-frequency components corresponding to the test data; inputting the decoupled data into a pre-constructed anomaly detection model to generate a time-domain window anomaly score and a frequency-domain window anomaly score, performing a weighted summation operation on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain a corresponding total window anomaly score, and performing anomaly detection on the target industrial control system based on the total window anomaly score and a preset anomaly threshold to obtain a corresponding anomaly detection result.

[0012] Optionally, in one embodiment of this application, the step of inputting the decoupled data into a pre-constructed anomaly detection model to generate a time-domain window anomaly score and a frequency-domain window anomaly score, and performing a weighted summation operation on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain a corresponding total window anomaly score, and performing anomaly detection on the target industrial control system based on the total window anomaly score and a preset anomaly threshold to obtain a corresponding anomaly detection result, includes: inputting the decoupled data into the anomaly detection model to obtain multiple sets of final representation vectors corresponding to the decoupled data, and calculating the absolute error between each set of final representation vectors and the decoupled data; determining the time-domain window anomaly score and the frequency-domain window anomaly score based on the absolute error, and performing a weighted summation of the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the total window anomaly score; determining whether the total window anomaly score is greater than the anomaly threshold, wherein if the total window anomaly score is greater than the anomaly threshold, the data to be tested is determined to be an anomaly window.

[0013] A third aspect of this application provides an anomaly detection device for an industrial control system, applied in the offline training phase, comprising: a first decoupling module, configured to acquire and segment multivariate time series data of a target industrial control system to obtain corresponding time window data, and decouple the time window data into corresponding low-frequency components and high-frequency components; an extraction module, configured to construct a corresponding process diagram based on the process knowledge of the target industrial control system, and extract the correlation relationships in the low-frequency components of the window, so as to dynamically update the process diagram through the correlation relationships, and embed the low-frequency components based on the updated process diagram and a preset graph neural network; and a training module, configured to reconstruct the embedded low-frequency components and the high-frequency components of the window to determine the corresponding reconstruction loss, and train the target neural network through the reconstruction loss to generate an anomaly detection model, so as to use the anomaly detection model to detect anomalies in the target industrial control system in the online detection phase.

[0014] Optionally, in one embodiment of this application, the first decoupling module includes: an acquisition unit, configured to acquire multivariate time series data containing state change entries of the target industrial control system, wherein the system state change entries include timestamps, entity names, and entity values; and a partitioning unit, configured to partition the multivariate time series data according to time windows, and use discrete wavelet transform to decouple the multivariate time series data in each window into the low-frequency component and the high-frequency component of the window.

[0015] Optionally, in one embodiment of this application, the extraction module includes: a modeling unit, configured to model the process flow of the target industrial control system using a preset graph structure to obtain the process graph, so as to characterize the process flow of the target industrial control system according to the process graph; a construction unit, configured to calculate the Pearson correlation coefficient between the low-frequency components of the windows corresponding to the ingress and egress nodes of the edges in the process graph, so as to characterize the correlation between the multivariate time series data in each window, and construct the window correlation coefficient matrix corresponding to the process graph according to the correlation; and an embedding unit, configured to input the low-frequency components of the windows and the window correlation coefficient matrix into the graph neural network to embed the low-frequency components.

[0016] Optionally, in one embodiment of this application, the training module includes: an input unit, configured to input the embedded low-frequency component of the window and the high-frequency component of the window into a preset encoder-decoder structure respectively to obtain the corresponding final representation vector; and a determination unit, configured to determine the reconstruction loss between the low-frequency component of the window or the high-frequency component of the window and the final representation vector based on the graph neural network and the encoder-decoder structure.

[0017] A fourth aspect of this application provides an anomaly detection device for an industrial control system, applied in the online detection stage, comprising: an acquisition module for acquiring test data of a target industrial control system; a second decoupling module for dividing the test data and decoupling the divided data to obtain corresponding decoupled data, wherein the decoupled data includes low-frequency components and high-frequency components corresponding to the test data; and a detection module for inputting the decoupled data into a pre-constructed anomaly detection model to generate a time-domain window anomaly score and a frequency-domain window anomaly score, performing a weighted summation operation on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain a corresponding window anomaly total score, and performing anomaly detection on the target industrial control system based on the window anomaly total score and a preset anomaly threshold to obtain a corresponding anomaly detection result.

[0018] Optionally, in one embodiment of this application, the detection module includes: a calculation unit, configured to input the decoupled data into the anomaly detection model to obtain multiple sets of final representation vectors corresponding to the decoupled data, and calculate the absolute error between each set of final representation vectors and the decoupled data; a summation unit, configured to determine the time-domain window anomaly score and the frequency-domain window anomaly score based on the absolute error, and perform a weighted summation of the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the total window anomaly score; and a judgment unit, configured to judge whether the total window anomaly score is greater than the anomaly threshold, wherein if the total window anomaly score is greater than the anomaly threshold, the data to be tested is judged as an anomaly window.

[0019] A fifth aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the industrial control system anomaly detection method as described in the above embodiments.

[0020] A sixth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described industrial control system anomaly detection method.

[0021] Therefore, the embodiments of this application have the following beneficial effects:

[0022] The embodiments of this application can obtain and segment multivariate time series data of the target industrial control system to obtain corresponding time window data, and decouple the time window data into corresponding low-frequency and high-frequency components. A corresponding process diagram is constructed based on the process knowledge of the target industrial control system, and the correlation relationships in the low-frequency components of the window are extracted to dynamically update the process diagram through these relationships. Based on the updated process diagram and a preset graph neural network, the low-frequency components are embedded. The embedded low-frequency and high-frequency components of the window are reconstructed to determine the corresponding reconstruction loss. The target neural network is then trained using the reconstruction loss to generate an anomaly detection model. This model is used to detect anomalies in the target industrial control system during the online detection phase, resulting in high-efficiency anomaly identification performance, robustness, and strong adaptability. It can be well applied to various security scenarios such as log auditing and anomaly detection. Therefore, this solves the problems of insufficient frequency domain feature extraction and inability to fully model dynamic process correlations in existing industrial control system anomaly detection technologies.

[0023] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0024] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0025] Figure 1 This is a flowchart of an anomaly detection method for an industrial control system applied during the offline training phase, according to an embodiment of this application.

[0026] Figure 2 This is a schematic diagram of the discrete wavelet transform process according to an embodiment of this application;

[0027] Figure 3 This is a schematic diagram of the process flow of one embodiment of this application;

[0028] Figure 4 This is a schematic diagram of the execution logic of an industrial control system anomaly detection method according to an embodiment of this application;

[0029] Figure 5 This is a flowchart of an anomaly detection method for an industrial control system applied in the online detection stage, according to an embodiment of this application.

[0030] Figure 6 This is an example diagram of an anomaly detection device for an industrial control system applied in the offline training phase, according to an embodiment of this application.

[0031] Figure 7This is an example diagram of an anomaly detection device for an industrial control system applied in the online detection stage according to an embodiment of this application;

[0032] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0033] Among them, 10-an industrial control system anomaly detection device applied to the offline training stage, 20-an industrial control system anomaly detection device applied to the online detection stage; 101-first decoupling module, 102-extraction module, 103-training module; 201-acquisition module, 202-second decoupling module, 203-detection module; 801-memory, 802-processor, 803-communication interface. Detailed Implementation

[0034] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0035] The following description, with reference to the accompanying drawings, outlines an industrial control system anomaly detection method, apparatus, electronic device, and medium according to embodiments of this application. Addressing the problems mentioned in the background section, this application provides an industrial control system anomaly detection method. This method involves acquiring and dividing multivariate time-series data of the target industrial control system to obtain corresponding time window data, and decoupling the time window data into corresponding low-frequency and high-frequency components. A corresponding process diagram is constructed based on the process knowledge of the target industrial control system, and the correlation relationships in the low-frequency components of the window are extracted to dynamically update the process diagram. Based on the updated process diagram and a preset graph neural network, the low-frequency components are embedded. The embedded low-frequency and high-frequency components of the window are reconstructed to determine the corresponding reconstruction loss. The target neural network is then trained using the reconstruction loss to generate an anomaly detection model. This model is used to detect anomalies in the target industrial control system during the online detection phase, resulting in high-efficiency anomaly identification performance, robustness, and strong adaptability. It can be well applied to various security scenarios such as log auditing and anomaly detection. This solves the problems of insufficient frequency domain feature extraction and inability to fully model dynamic process correlations in existing industrial control system anomaly detection technologies.

[0036] Specifically, Figure 1 This is a flowchart illustrating an anomaly detection method for an industrial control system applied during the offline training phase, as provided in an embodiment of this application.

[0037] like Figure 1As shown, the anomaly detection method for this industrial control system includes the following steps:

[0038] In step S101, the multivariate time series data of the target industrial control system is acquired and divided to obtain the corresponding time window data, and the time window data is decoupled into the corresponding window low-frequency component and window high-frequency component.

[0039] In this embodiment, the multivariate time series data of the industrial control system can first be divided into time windows to obtain corresponding time window data. The time window data is then decoupled into low-frequency and high-frequency components to represent the time domain and frequency domain characteristics, respectively.

[0040] It should be noted that the industrial control system in this application embodiment integrates multiple sensors, actuators and intermediate variables, which can continuously monitor and record the process and status of industrial processes, forming multivariate time series data; the log, as an important data source of the industrial control system, can comprehensively reflect the system operation status; this application embodiment takes the industrial control system status log (i.e., multivariate time series data) as the research object, extracts multi-dimensional features in the system operation process, and models and detects system anomalies.

[0041] Optionally, in one embodiment of this application, acquiring and dividing multivariate time series data of the target industrial control system to obtain corresponding time window data, and decoupling the time window data into corresponding window low-frequency components and window high-frequency components, includes: acquiring multivariate time series data containing state change entries of the target industrial control system, wherein the system state change entries include timestamps, entity names, and entity values; dividing the multivariate time series data according to time windows, and using discrete wavelet transform to decouple the multivariate time series data in each window into window low-frequency components and window high-frequency components.

[0042] In the embodiments of this application, a multivariate time series log containing entries of state changes in the industrial control system can first be obtained. The entries of system state changes include timestamps, entity names, and entity values. The entity is the actuator, sensor, or intermediate variable of the industrial control system. The log is the log data generated during normal operation of the system and does not contain abnormal data. Then, in the embodiments of this application, the log can be divided according to time windows, and the data in each window can be decoupled into multiple sets of low-frequency components and high-frequency components of the window using discrete wavelet transform, which are used to represent time domain features and frequency domain features, respectively.

[0043] Specifically, for multivariate time series data in industrial control systems, embodiments of this application can utilize a sliding window to obtain time window data W. (t) ,t=0,1,…,T;for W (t) ,like Figure 2As shown in the figure, the embodiments of this application can use discrete wavelet transform to decouple the time window data into a low-frequency component and a high-frequency component, as shown in the following equation:

[0044]

[0045]

[0046]

[0047] in, and W represents the data of the t-th time window. (t) The low-frequency and high-frequency component sequences are obtained after the i-th layer discrete wavelet transform; j represents the j-th element in the sequence; h[·] and g[·] represent the low-pass filter and high-pass filter, respectively.

[0048] In this embodiment of the application, the Haar wavelet can be used, and its corresponding low-pass and high-pass filters are:

[0049]

[0050]

[0051] In actual implementation, the embodiments of this application may employ a 3-layer discrete wavelet transform, i.e., i = 1, 2, 3.

[0052] Therefore, the embodiments of this application obtain the low-frequency and high-frequency components corresponding to the multivariate time series data of the industrial control system, thereby providing reliable data support for the training of subsequent models.

[0053] In step S102, a corresponding process diagram is constructed based on the process knowledge of the target industrial control system, and the correlation relationship in the low-frequency component of the window is extracted so as to dynamically update the process diagram through the correlation relationship. Based on the updated process diagram and the preset graph neural network, the low-frequency component is embedded.

[0054] Furthermore, embodiments of this application can represent the process of the target industrial control system as a graph structure and extract the correlation relationships in the low-frequency components of the window to dynamically update the process graph, thereby utilizing a graph neural network to achieve the embedding of low-frequency component features with dynamic correlation relationships.

[0055] Optionally, in one embodiment of this application, a corresponding process diagram is constructed based on the process knowledge of the target industrial control system, and the correlation relationships in the low-frequency components of the window are extracted to dynamically update the process diagram through the correlation relationships. Based on the updated process diagram and a preset graph neural network, the low-frequency components are embedded, including: modeling the process flow of the target industrial control system using a preset graph structure to obtain a process diagram to represent the process flow of the target industrial control system; calculating the Pearson correlation coefficient between the low-frequency components of the window corresponding to the in-node and out-node of the edge in the process diagram to represent the correlation relationship between the multivariate time series data in each window, and constructing a window correlation coefficient matrix corresponding to the process diagram based on the correlation relationships; and inputting the low-frequency components of the window and the window correlation coefficient matrix into the graph neural network to embed the low-frequency components.

[0056] In actual implementation, embodiments of this application can use graph structures to model the process flow of industrial control systems to fully characterize the relationships between system entities. For edges in the graph structure, the Pearson correlation coefficient between the low-frequency components of the window corresponding to the ingress and egress nodes is calculated to represent the relationship between data within the window, thus obtaining the correlation coefficient matrix corresponding to the process graph. Furthermore, embodiments of this application can input the low-frequency components of the window and the window correlation coefficient matrix into a graph neural network to obtain low-frequency component embeddings with dynamic correlation characteristics.

[0057] In its specific implementation, the embodiments of this application can construct a "process diagram" of the process flow of a specific industrial control system. The "process diagram" is a directed graph. It serves as a graph-structured knowledge abstraction of a specific industrial control system process. and Let each represent a set of nodes and a set of edges, respectively. Mapping each edge to two ordered nodes indicates that the entity corresponding to node u will affect the entity corresponding to node v.

[0058] Specifically, nodes are divided into setpoint nodes N based on the type of entity in the industrial control system. s and measured value node N m There are two categories: setpoint nodes represent target values ​​specified by the control system; measured value nodes represent actual readings obtained through physical processes. Edges are further categorized into four types based on the dependencies between entities:

[0059] 1. Corresponding edge E r Used to connect the set value node and the actual value node of a specific entity;

[0060] 2. Correlation edge E c Used to represent the inherent correlation between different process variables, such as the relationship between valve opening and flow rate;

[0061] 3. Control edge E pid Used to indicate the PID (Proportional-Integral-Derivative) control relationship, that is, the input node affects the output node through the PID control system;

[0062] 4. Transform edge E t Used to represent the conversion relationship between physically equivalent variables, such as the conversion between flow rate and flow velocity.

[0063] Figure 3 This is a structural schematic diagram of the process flow diagram. For example... Figure 3 As shown, this illustrates the boiler flow control and boiler level control process. In this system, the setpoint of the outlet flow control valve (FCV03D) is adjusted using a PID feedback system that utilizes data from the flow sensor (FT03); simultaneously, the setpoint of the inlet flow control valve (LCV01D) is influenced by both FCV03D and the level indicator (LIT01); the setpoints LCV01D and FCV03D jointly regulate the actual positions of the two water valves (LCV01Z and FCV03Z); furthermore, FT03Z represents the flow measurement value converted by FT03.

[0064] Furthermore, in order to capture the quantitative dependencies between different variables within the window, the low-frequency components after decoupling the window data are... This application embodiment calculates the correlation between all connected node pairs in the "process diagram". Specifically, for node n u and n v The Pearson correlation coefficients are as follows:

[0065]

[0066] in, and These represent the time window W. (t) Inside, The wavelet coefficients corresponding to the u-th and v-th components; This represents the covariance between the two wavelet coefficient sequences; and These represent their standard deviations.

[0067] Therefore, for the time window W (t) Low-frequency components within This application embodiment constructs the adjacency matrix M corresponding to the "process diagram". (t) as follows:

[0068]

[0069] Furthermore, to integrate dynamic "process graph" information into the low-frequency component feature representation, this embodiment employs a graph convolutional network to perform feature transformation on the correlated "process graph" and low-frequency components within the window, thereby obtaining a feature representation with practical significance. The graph convolutional network aggregates and transforms information from the local neighborhood of nodes to achieve unified modeling of the process topology and correlation patterns within the time window; for each set of low-frequency wavelet coefficients... This application embodiment applies graph convolutional layers to the graph structure to transform node features. The specific transformation method is as follows:

[0070]

[0071] in, In adjacency matrix M (t) The result after adding a self-loop; For the corresponding degree matrix, satisfying H (t,l) Indicates the time window W (t) The low-frequency component features are obtained through the l-th layer of the neural network. When l = 0, the initial input features are... Θ (l) Let be the trainable weight matrix of the l-th layer; σ represents the nonlinear activation function.

[0072] It should be noted that, in the embodiments of this application, the above operations are applied to the low-frequency coefficients obtained from each layer of discrete wavelet transform. All of these are executed, thus enabling the comprehensive capture of temporal correlation features across multi-scale decomposition.

[0073] In summary, the embodiments of this application represent the process as a dynamically updated graph structure, extract the correlation in low-frequency components, and utilize graph neural networks, thereby effectively achieving the embedding of low-frequency component features with dynamic correlation.

[0074] In step S103, the low-frequency components and high-frequency components of the embedded window are reconstructed to determine the corresponding reconstruction loss. The target neural network is then trained using the reconstruction loss to generate an anomaly detection model, which is then used to detect anomalies in the target industrial control system during the online detection phase.

[0075] Subsequently, embodiments of this application can use a preset reconstruction module (i.e., encoder-decoder structure) to determine the corresponding reconstruction loss between the embedded low-frequency component of the window and the original high-frequency component of the window, and train the target neural network through the reconstruction loss to generate an anomaly detection model.

[0076] Optionally, in one embodiment of this application, the embedded low-frequency component and high-frequency component of the window are reconstructed to determine the corresponding reconstruction loss, including: inputting the embedded low-frequency component and high-frequency component of the window into a preset encoder-decoder structure to obtain the corresponding final representation vector; and determining the reconstruction loss between the low-frequency component or the high-frequency component of the window and the final representation vector based on the graph neural network and the encoder-decoder structure.

[0077] It should be noted that, in the embodiments of this application, the low-frequency component group of the window after the graph neural network and the high-frequency component group of the original window can be obtained by encoder-decoder structure to obtain the final representation vector. For the graph neural network and encoder-decoder, the reconstruction loss between the original low-frequency or high-frequency component and the final representation vector is used to train the model and update the parameters until the model converges.

[0078] In the specific implementation process, for the low-frequency component features after graph neural network processing and the original high-frequency components, the embodiments of this application learn the normal distribution pattern of benign industrial control system data through encoder-decoder.

[0079] Specifically, for the low-frequency component features H after graph neural network processing (t,l+1) It takes the form of an encoder-decoder as follows:

[0080]

[0081]

[0082] Among them, This represents the hidden layer features output by the encoder; This is the output of the decoder.

[0083] In the embodiments of this application, both the encoder and decoder employ fully connected neural networks. Similarly, for the original high-frequency components, the same encoder-decoder structure is used:

[0084]

[0085]

[0086] During the offline training phase, this embodiment of the application can update model parameters using unsupervised learning, with the data sourced from the normal operation data of the industrial control system. Specifically, the high-frequency and low-frequency components of the discrete wavelet transform decoupling at different levels are trained independently. The loss function of this embodiment consists of two parts: reconstruction loss, which measures the degree of difference between the model output and the original input to ensure that the model can accurately reconstruct normal data; and maximum mean discrepancy (MMD) loss, which is used to ensure that the data generated by the model accurately reflects the statistical characteristics of the real data. The total loss function is defined as follows:

[0087] L = L rec +μ·L MMd

[0088] Among them, L rec For reconstruction loss; L MMD The maximum mean difference loss is denoted by μ; μ is the weight of the MMD loss. The reconstruction loss formula is as follows:

[0089]

[0090] or:

[0091]

[0092] Where Q is the number of training samples.

[0093] The MMD loss formula is as follows:

[0094]

[0095] Where φ(·) represents the feature mapping function, which maps data points from the original space to the reproducing kernel Hilbert space; Z (t) P represents the latent characteristics of the encoder output. t Represents a sample with a prior distribution; Let H be the square norm of the Hilbert space H, used to measure the distance between features after mapping.

[0096] Thus, through several rounds of iterative training, the encoder-decoder in the embodiments of this application is able to map normal operating data to a latent space that conforms to a predefined prior distribution and reconstruct the original wavelet coefficients from the latent representation.

[0097] The execution logic of the industrial control system anomaly detection method of this application is described below with reference to the accompanying drawings.

[0098] Figure 4 This is a schematic diagram illustrating the execution logic of the industrial control system anomaly detection method of this application. For example... Figure 4 As shown, the execution process of the industrial control system anomaly detection method of this application is as follows:

[0099] S401: Divide the multivariate time series data of the industrial control system into time windows, and decouple the time window data into low-frequency and high-frequency components, which represent the time domain and frequency domain characteristics, respectively.

[0100] S402: Represent the process as a graph structure, extract the correlation in the low-frequency components to dynamically update the process graph, and use a graph neural network to embed the low-frequency component features with dynamic correlation.

[0101] S403: The embedded low-frequency components and the original high-frequency components are combined through a reconstruction module, and a complete neural network is trained.

[0102] S404: For the data to be tested, after dividing it into windows and decoupling it, input it into the trained model to obtain the window anomaly scores in the time domain and frequency domain respectively. After weighted summation, anomaly thresholds are set to determine anomalies.

[0103] The industrial control system anomaly detection method proposed in this application for offline training phase involves acquiring and dividing multivariate time series data of the target industrial control system to obtain corresponding time window data, and decoupling the time window data into corresponding low-frequency and high-frequency components. A corresponding process diagram is constructed based on the process knowledge of the target industrial control system, and the correlation relationships in the low-frequency components of the window are extracted to dynamically update the process diagram. Based on the updated process diagram and a preset graph neural network, the low-frequency components are embedded. The embedded low-frequency and high-frequency components of the window are reconstructed to determine the corresponding reconstruction loss, and the target neural network is trained using the reconstruction loss to generate an anomaly detection model. This model is then used to detect anomalies in the target industrial control system during the online detection phase, resulting in high efficiency in anomaly identification, robustness, and strong adaptability. It can be well applied to various security scenarios such as log auditing and anomaly detection.

[0104] Figure 5 This is a flowchart illustrating an anomaly detection method for an industrial control system applied in the online detection phase, as provided in an embodiment of this application.

[0105] like Figure 5 As shown, the anomaly detection method for this industrial control system includes the following steps:

[0106] In step S501, the test data of the target industrial control system is acquired.

[0107] In step S502, the test data is divided and the divided data is decoupled to obtain the corresponding decoupled data, wherein the decoupled data includes the low-frequency component and the high-frequency component corresponding to the test data.

[0108] In step S503, the decoupled data is input into the pre-built anomaly detection model to generate time-domain window anomaly scores and frequency-domain window anomaly scores. The time-domain window anomaly scores and frequency-domain window anomaly scores are then weighted and summed to obtain the corresponding total window anomaly score. Based on the total window anomaly score and a preset anomaly threshold, anomaly detection is performed on the target industrial control system to obtain the corresponding anomaly detection results.

[0109] For the data to be tested, this embodiment can divide it into windows and decouple it using discrete wavelet transform, then input it into a trained anomaly detection model to obtain multiple sets of final representation vectors for low-frequency and high-frequency components. The absolute error between each set of final representation vectors and the original low-frequency or high-frequency components is calculated as the anomaly score in the time and frequency domains of the window. The anomaly scores are weighted and summed to obtain the total anomaly score for the window. Then, this embodiment can combine a given anomaly threshold, and for windows with a total anomaly score higher than the threshold, they are determined to be an anomaly window.

[0110] Optionally, in one embodiment of this application, decoupled data is input into a pre-built anomaly detection model to generate a time-domain window anomaly score and a frequency-domain window anomaly score. A weighted summation operation is then performed on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the corresponding total window anomaly score. Based on the total window anomaly score and a preset anomaly threshold, anomaly detection is performed on the target industrial control system to obtain the corresponding anomaly detection result. This includes: inputting decoupled data into the anomaly detection model to obtain multiple sets of final representation vectors corresponding to the decoupled data, and calculating the absolute error between each set of final representation vectors and the decoupled data; determining the time-domain window anomaly score and the frequency-domain window anomaly score based on the absolute error, and performing a weighted summation on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the total window anomaly score; and determining whether the total window anomaly score is greater than the anomaly threshold. If the total window anomaly score is greater than the anomaly threshold, the data to be tested is determined to be an anomaly window.

[0111] As one possible approach, this application embodiment uses a multivariate time series log of the industrial control system under test as input. The log is divided into windows according to the aforementioned steps, decoupled into low-frequency and high-frequency components, and then processed by their respective trained neural network models. For each window, the model output and each group of low-frequency components are calculated. and high frequency components The mean squared error is used as its anomaly score:

[0112]

[0113]

[0114] Therefore, for the three-level wavelet transform used in this application embodiment, a total of six anomaly scores are obtained, which are weighted and summed according to the following formula to obtain the total anomaly score of the window:

[0115]

[0116] Where λ is the weighting factor of the total score of the window anomaly corresponding to the high-frequency component; l is the discrete wavelet transform series, and in this embodiment, l = 3.

[0117] Furthermore, in this embodiment of the application, an anomaly threshold thr can be given; if the total anomaly score S of the window is... (t) >thr, then the total window exception score S (t) The corresponding time window data is judged as abnormal, and the opposite is considered normal.

[0118] Therefore, the embodiments of this application can effectively solve the problems of insufficient frequency domain feature extraction and inability to fully model dynamic process associations in the traditional methods of the prior art, and have the advantages of high efficiency in anomaly identification, strong robustness and strong adaptability.

[0119] The industrial control system anomaly detection method proposed in this application for online detection stage involves acquiring the test data of the target industrial control system; dividing the test data and decoupling the divided data to obtain corresponding decoupled data, wherein the decoupled data includes low-frequency and high-frequency components corresponding to the test data; inputting the decoupled data into a pre-built anomaly detection model to generate time-domain window anomaly scores and frequency-domain window anomaly scores; performing a weighted summation operation on the time-domain window anomaly scores and frequency-domain window anomaly scores to obtain the corresponding window anomaly total score; and performing anomaly detection on the target industrial control system based on the window anomaly total score and a preset anomaly threshold to obtain the corresponding anomaly detection result. This method exhibits high efficiency in anomaly identification, robustness, and strong adaptability, and can be well applied to various security scenarios such as log auditing and anomaly detection.

[0120] Secondly, the industrial control system anomaly detection device according to the embodiments of this application is described with reference to the accompanying drawings.

[0121] Figure 6 This is a block diagram of an industrial control system anomaly detection device applied to the offline training phase according to an embodiment of this application.

[0122] like Figure 6 As shown, the industrial control system anomaly detection device 10 applied to the offline training stage includes: a first decoupling module 101, an extraction module 102, and a training module 103.

[0123] The first decoupling module 101 is used to acquire and divide the multivariate time series data of the target industrial control system to obtain the corresponding time window data, and decouple the time window data into the corresponding window low-frequency component and window high-frequency component.

[0124] The extraction module 102 is used to construct a corresponding process diagram based on the process knowledge of the target industrial control system, and extract the correlation relationship in the low-frequency component of the window so as to dynamically update the process diagram through the correlation relationship, and embed the low-frequency component based on the updated process diagram and the preset graph neural network.

[0125] The training module 103 is used to reconstruct the low-frequency components and high-frequency components of the embedded window to determine the corresponding reconstruction loss, and to train the target neural network through the reconstruction loss to generate an anomaly detection model, so as to use the anomaly detection model to detect anomalies in the target industrial control system during the online detection stage.

[0126] Optionally, in one embodiment of this application, the first decoupling module 101 includes: a data acquisition unit and a data partitioning unit.

[0127] The acquisition unit is used to acquire multivariate time series data containing state change entries of the target industrial control system. The system state change entries include timestamps, entity names, and entity values.

[0128] The partitioning unit is used to divide multivariate time series data according to time windows, and uses discrete wavelet transform to decouple the multivariate time series data in each window into window low-frequency components and window high-frequency components.

[0129] Optionally, in one embodiment of this application, the extraction module 102 includes: a modeling unit, a construction unit, and an embedding unit.

[0130] The modeling unit is used to model the process flow of the target industrial control system using a preset graph structure to obtain a process diagram, which is used to represent the process flow of the target industrial control system.

[0131] The construction unit is used to calculate the Pearson correlation coefficient between the low-frequency components of the window corresponding to the in-node and out-node of the edge in the process diagram, so as to characterize the correlation between multivariate time series data in each window, and construct the window correlation coefficient matrix corresponding to the process diagram based on the correlation.

[0132] Embedding units are used to input the low-frequency components of the window and the window correlation coefficient matrix into the graph neural network to embed the low-frequency components.

[0133] Optionally, in one embodiment of this application, the training module 103 includes an input unit and a determination unit.

[0134] The input unit is used to input the embedded low-frequency component and high-frequency component of the window into the preset encoder-decoder structure to obtain the corresponding final representation vector.

[0135] The determination unit is used to determine the reconstruction loss between the low-frequency component or high-frequency component of the window and the final representation vector, based on the graph neural network and encoder-decoder structure.

[0136] It should be noted that the foregoing explanation of the embodiment of the industrial control system anomaly detection method applied to the offline training stage also applies to the industrial control system anomaly detection device applied to the offline training stage of this embodiment, and will not be repeated here.

[0137] The industrial control system anomaly detection device proposed in the embodiments of this application for offline training includes a first decoupling module 101, used to acquire and divide the multivariate time series data of the target industrial control system to obtain the corresponding time window data, and decouple the time window data into the corresponding window low-frequency component and window high-frequency component; an extraction module 102, used to construct the corresponding process diagram based on the process knowledge of the target industrial control system, and extract the correlation relationship in the window low-frequency component to dynamically update the process diagram through the correlation relationship, and embed the low-frequency component based on the updated process diagram and the preset graph neural network; and a training module 103, used to reconstruct the embedded window low-frequency component and window high-frequency component to determine the corresponding reconstruction loss, and train the target neural network through the reconstruction loss to generate an anomaly detection model, so as to use the anomaly detection model to detect anomalies in the target industrial control system in the online detection stage, thereby having efficient anomaly recognition performance, robustness and strong adaptability, and can be well applied to multiple security scenarios such as log auditing and anomaly detection.

[0138] Figure 7 This is a block diagram of an anomaly detection device for an industrial control system applied in the online pre-stage according to an embodiment of this application.

[0139] like Figure 7 As shown, the industrial control system anomaly detection device 20 applied in the online detection stage includes: an acquisition module 201, a second decoupling module 202, and a detection module 203.

[0140] The acquisition module 201 is used to acquire the test data of the target industrial control system.

[0141] The second decoupling module 202 is used to divide the data to be tested and decouple the divided data to obtain the corresponding decoupled data. The decoupled data includes the low-frequency component and the high-frequency component corresponding to the data to be tested.

[0142] The detection module 203 is used to input decoupled data into a pre-built anomaly detection model to generate time-domain window anomaly scores and frequency-domain window anomaly scores, and to perform a weighted summation operation on the time-domain window anomaly scores and frequency-domain window anomaly scores to obtain the corresponding window anomaly total score. Based on the window anomaly total score and a preset anomaly threshold, anomaly detection is performed on the target industrial control system to obtain the corresponding anomaly detection results.

[0143] Optionally, in one embodiment of this application, the detection module 203 includes: a calculation unit, a summation unit, and a judgment unit.

[0144] The computation unit is used to input the decoupled data into the anomaly detection model to obtain multiple sets of final representation vectors corresponding to the decoupled data, and to calculate the absolute error between each set of final representation vectors and the decoupled data.

[0145] The summation unit is used to determine the time-domain window anomaly score and the frequency-domain window anomaly score based on the absolute error, and to perform a weighted summation of the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the total window anomaly score.

[0146] The judgment unit is used to determine whether the total abnormal score of the window is greater than the abnormal threshold. If the total abnormal score of the window is greater than the abnormal threshold, the test data is judged as an abnormal window.

[0147] It should be noted that the foregoing explanation of the embodiment of the industrial control system anomaly detection method applied to the online detection stage also applies to the industrial control system anomaly detection device applied to the online detection stage of this embodiment, and will not be repeated here.

[0148] The industrial control system anomaly detection device proposed in the embodiment of this application for online detection includes an acquisition module 201 for acquiring test data of the target industrial control system; a second decoupling module 202 for dividing the test data and decoupling the divided data to obtain corresponding decoupled data, wherein the decoupled data includes low-frequency components and high-frequency components corresponding to the test data; and a detection module 203 for inputting the decoupled data into a pre-built anomaly detection model to generate a time-domain window anomaly score and a frequency-domain window anomaly score, and performing a weighted summation operation on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the corresponding window anomaly total score, and performing anomaly detection on the target industrial control system based on the window anomaly total score and a preset anomaly threshold to obtain the corresponding anomaly detection result. This device has high efficiency in anomaly identification, robustness, and strong adaptability, and can be well applied in multiple security scenarios such as log auditing and anomaly detection.

[0149] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0150] The memory 801, the processor 802, and the computer program stored on the memory 801 and capable of running on the processor 802.

[0151] When the processor 802 executes the program, it implements the industrial control system anomaly detection method provided in the above embodiments.

[0152] Furthermore, electronic devices also include:

[0153] Communication interface 803 is used for communication between memory 801 and processor 802.

[0154] The memory 801 is used to store computer programs that can run on the processor 802.

[0155] The memory 801 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0156] If the memory 801, processor 802, and communication interface 803 are implemented independently, then the communication interface 803, memory 801, and processor 802 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0157] Optionally, in a specific implementation, if the memory 801, processor 802, and communication interface 803 are integrated on a single chip, then the memory 801, processor 802, and communication interface 803 can communicate with each other through an internal interface.

[0158] The processor 802 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0159] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described industrial control system anomaly detection method.

[0160] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0161] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0162] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0163] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0164] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0165] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0166] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0167] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. An anomaly detection method for an industrial control system, applied in the offline training phase, characterized in that, Includes the following steps: Acquire and segment multivariate time series data of the target industrial control system to obtain corresponding time window data, and decouple the time window data into corresponding low-frequency and high-frequency components of the window; Based on the process knowledge of the target industrial control system, a corresponding process diagram is constructed, and the correlation relationship in the low-frequency component of the window is extracted so as to dynamically update the process diagram through the correlation relationship. Based on the updated process diagram and the preset graph neural network, the low-frequency component is embedded. The low-frequency components and high-frequency components of the embedded window are reconstructed to determine the corresponding reconstruction loss. The target neural network is then trained using the reconstruction loss to generate an anomaly detection model. This model is then used to detect anomalies in the target industrial control system during the online detection phase.

2. The method according to claim 1, characterized in that, The process of acquiring and segmenting the multivariate time series data of the target industrial control system to obtain corresponding time window data, and decoupling the time window data into corresponding low-frequency and high-frequency components, includes: Acquire multivariate time series data containing state change entries of the target industrial control system, wherein the system state change entries include timestamps, entity names, and entity values; The multivariate time series data is divided into time windows, and the multivariate time series data in each window is decoupled into the low-frequency component and the high-frequency component of the window using discrete wavelet transform.

3. The method according to claim 2, characterized in that, The step of constructing a corresponding process diagram based on the process knowledge of the target industrial control system, extracting the correlation relationships in the low-frequency components of the window, dynamically updating the process diagram through the correlation relationships, and embedding the low-frequency components based on the updated process diagram and a preset graph neural network includes: The process flow of the target industrial control system is modeled using a preset graph structure to obtain the process diagram, which is used to characterize the process flow of the target industrial control system. Calculate the Pearson correlation coefficient between the low-frequency components of the windows corresponding to the ingress and egress nodes of the edges in the process diagram to characterize the correlation between the multivariate time series data in each window, and construct the window correlation coefficient matrix corresponding to the process diagram based on the correlation. The low-frequency component of the window and the window correlation coefficient matrix are input into the graph neural network to embed the low-frequency component.

4. The method according to claim 3, characterized in that, The process of reconstructing the low-frequency components and high-frequency components of the embedded window to determine the corresponding reconstruction loss includes: The embedded low-frequency component and the high-frequency component of the window are respectively input into a preset encoder-decoder structure to obtain the corresponding final representation vector; Based on the graph neural network and the encoder-decoder structure, the reconstruction loss between the low-frequency component of the window or the high-frequency component of the window and the final representation vector is determined.

5. An anomaly detection method for an industrial control system, applied in the online detection stage, characterized in that, Includes the following steps: Acquire the test data of the target industrial control system; The test data is divided into segments, and the segmented data is decoupled to obtain corresponding decoupled data, wherein the decoupled data includes the low-frequency component and the high-frequency component corresponding to the test data. The decoupled data is input into a pre-built anomaly detection model to generate time-domain window anomaly scores and frequency-domain window anomaly scores. The time-domain window anomaly scores and the frequency-domain window anomaly scores are then weighted and summed to obtain the corresponding total window anomaly score. Based on the total window anomaly score and a preset anomaly threshold, anomaly detection is performed on the target industrial control system to obtain the corresponding anomaly detection results.

6. The method according to claim 5, characterized in that, The process involves inputting the decoupled data into a pre-built anomaly detection model to generate time-domain window anomaly scores and frequency-domain window anomaly scores. A weighted summation operation is then performed on the time-domain and frequency-domain window anomaly scores to obtain a corresponding total window anomaly score. Based on this total window anomaly score and a preset anomaly threshold, anomaly detection is performed on the target industrial control system to obtain corresponding anomaly detection results. This includes: The decoupled data is input into the anomaly detection model to obtain multiple sets of final representation vectors corresponding to the decoupled data, and the absolute error between each set of final representation vectors and the decoupled data is calculated. The time-domain window anomaly score and the frequency-domain window anomaly score are determined based on the absolute error, and the time-domain window anomaly score and the frequency-domain window anomaly score are weighted and summed to obtain the total window anomaly score. Determine whether the total abnormal score of the window is greater than the abnormal threshold, wherein if the total abnormal score of the window is greater than the abnormal threshold, the data to be tested is determined to be an abnormal window.

7. An anomaly detection device for an industrial control system, used in the offline training phase, characterized in that, include: The first decoupling module is used to acquire and divide the multivariate time series data of the target industrial control system to obtain the corresponding time window data, and decouple the time window data into the corresponding window low-frequency component and window high-frequency component. The extraction module is used to construct a corresponding process diagram based on the process knowledge of the target industrial control system, and extract the correlation relationship in the low-frequency component of the window so as to dynamically update the process diagram through the correlation relationship, and embed the low-frequency component based on the updated process diagram and a preset graph neural network. The training module is used to reconstruct the low-frequency components and high-frequency components of the embedded window to determine the corresponding reconstruction loss, and to train the target neural network through the reconstruction loss to generate an anomaly detection model, so as to use the anomaly detection model to detect anomalies in the target industrial control system during the online detection stage.

8. An industrial control system anomaly detection device, used in the online detection stage, characterized in that, include: The acquisition module is used to acquire the test data of the target industrial control system; The second decoupling module is used to divide the data to be tested and decouple the divided data to obtain the corresponding decoupled data, wherein the decoupled data includes the low-frequency component and the high-frequency component corresponding to the data to be tested. The detection module is used to input the decoupled data into a pre-built anomaly detection model to generate a time-domain window anomaly score and a frequency-domain window anomaly score, and to perform a weighted summation operation on the time-domain window anomaly score and the frequency-domain window anomaly score to obtain the corresponding window anomaly total score. Based on the window anomaly total score and a preset anomaly threshold, the module performs anomaly detection on the target industrial control system to obtain the corresponding anomaly detection result.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the industrial control system anomaly detection method as described in any one of claims 1-4 or any one of claims 5-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the industrial control system anomaly detection method as described in any one of claims 1-4 or any one of claims 5-6.

Images