Single classification industrial control system anomaly detection method based on double-view information bottleneck fusion

Abstract

The application discloses a single classification industrial control system anomaly detection method based on double-view information bottleneck fusion, and belongs to the technical field of industrial control system anomaly detection, and the steps are as follows: a time series view and a pseudo-image view are simultaneously constructed in a training stage; representation is extracted through a time dynamic encoder and a pre-trained visual backbone respectively; cross-view compression is performed in a variational information bottleneck fusion module, and a projection branch that only depends on sequence representation is established; subsequently, a normal subspace is learned around a center vector, an accurate hypersphere is established to describe normal data, a center distance is taken as an anomaly score, and discrimination is completed by using a quantile threshold; in a detection stage, only the time series view needs to be input to realize online identification. The application fuses double-view priori and variational information bottleneck, and cooperatively optimizes end-to-end with deep support vector data description, so that an accurate decision boundary can be established under the condition of a small amount of samples, and a solution for industrial control system anomaly detection under the condition of limited samples is provided.

Description

Technical Field

[0001] This invention belongs to the field of industrial control system anomaly detection technology, specifically involving a single-classification industrial control system anomaly detection method based on dual-view information bottleneck fusion. Background Technology

[0002] Industrial Control Systems (ICS) support critical infrastructure in energy, power, chemical, metallurgical, transportation, and discrete manufacturing industries. Their operational safety directly impacts personnel and equipment safety, environmental compliance, and continuous production. Undetected anomalies can trigger cascading shutdowns, quality accidents, and even catastrophic consequences. Furthermore, ICS are characterized by multivariate coupling, non-stationarity, and frequent changes in operating conditions, making traditional anomaly detection methods ineffective in such complex situations. Therefore, developing highly reliable anomaly detection technologies for high-dimensional, multivariate ICS time series is crucial for ensuring the inherent safety and economical operation of ICS.

[0003] Deep Support Vector Data Description (DeSVDD), a current technology, is a deep single-class classification learning method trained solely on normal samples. This method combines "feature learning + single-class boundary" objectives end-to-end, avoiding reliance on prior features or known anomaly patterns and exhibiting good scalability for unknown anomalies. However, under realistic conditions of limited normal samples, variable operating conditions, and unstable statistics, DeSVDD is prone to insufficient boundary learning and unstable generalization. The center and radius fluctuate wildly due to the distributional variations of a very small number of samples, and the threshold is difficult to set robustly. Therefore, how to stably establish an effective single-class description boundary under conditions of few samples and changing distributions has become the core bottleneck of current technologies. Summary of the Invention

[0004] To address the problem that traditional DeSVDD cannot extract effective discriminative information and establish accurate decision boundaries under limited sample conditions, this invention proposes a single-classification anomaly detection method for industrial control systems based on dual-view information bottleneck fusion. This method adds a pseudo-image auxiliary viewpoint to the time series viewpoint, introduces a variational information bottleneck strategy to fuse dual-view information, extracts the most discriminative decision information, and finally constructs a robust hypersphere decision boundary.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] An anomaly detection method for single-class industrial control systems based on dual-view information bottleneck fusion includes the following steps:

[0007] Step 1: Obtain the multivariable sensor sequence of the industrial control system ,in The number of channels is used to apply a length of [value] to the sequence. A sliding window is used to obtain samples. Deterministic mapping Will Convert to auxiliary pseudo-image Used to assist training, a training set is constructed from normal samples. The samples to be tested constitute the test set. ;

[0008] Step 2: During the training phase, a time-based dynamic encoder and a time-based image representation module are used to perform dual-view representation of the same historical window. The time-based dynamic encoder maps the original sequence to a time-series representation. The time-image representation module represents pseudo-images. Visual representations are extracted from pre-trained visual backbones. ;

[0009] Step 3: Establish a variational information bottleneck fusion module to fuse the concatenated vector [ Using [] as input, generate a fusion latent representation. Information compression is performed relative to isotropic priors, while setting up a system that only depends on... projection branch Used to replace in the reasoning stage This enables dual-view training and single-view inference stages.

[0010] Step 4: Transfer the training phase With time series representation Linear combination, via embedded mapping parameters ( , The final embedding vector is obtained. , around the central vector Learn a compact subspace of normal samples and build a final embedding vector. With the center vector The distance between them is used as an anomaly score. The scoring rules are based on setting thresholds according to the quantiles of the score set of normal samples in the training set. ;

[0011] Step 5: The window under test is characterized only by time series analysis. With projection branch Calculate the anomaly score and compare it with the threshold. Compare and output the result to determine whether it is normal or abnormal.

[0012] Furthermore, in step 1, the multivariable sensor sequence from the industrial control system is processed according to a fixed window length. Historical windows are obtained by performing sliding aggregation and time alignment. During the training phase, continuous sensor variables in each normal window are deterministically mapped. Generate an auxiliary pseudo-image aligned with the normal window time. ;

[0013] Where, mapping After normalizing the sequence intervals of each channel, it is represented as follows: Based on this, three types of encoding—Gram angle field, Markov transition field, and recursive graph—are jointly implemented, and the results are stacked by channel. ,in Number of channels , For the high of the pseudo image, The width of the pseudo-image;

[0014] The construction of the Gram Corner Field first requires The angle variable is obtained through the inverse cosine mapping shown in formula (1). The expression of formula (1) is:

[0015] (1);

[0016] The elements of the Gram matrix are constructed using formula (2), and the expression for formula (2) is as follows:

[0017] (2);

[0018] in For the first An angular variable at a given time position. The Gram angle field diagram is shown in the window. , No. The corresponding time position is the 1st line, number Column elements, , The first , No. An angular variable at a given time position;

[0019] The Markov transition field is constructed as follows: value range according to The non-overlapping intervals are divided into According to formula (3), the first-order transition probability is defined, and the expression of formula (3) is:

[0020] (3);

[0021] And let the value at each time step be quantized by a quantization function. Mapped to its corresponding bin index The Markov transition field matrix elements are constructed using formula (4), and the expression for formula (4) is as follows:

[0022] (4);

[0023] in For probability operators, To be from the interval Transfer to interval The first-order transition probability, For binning mapping, Indicates from time The range of values Migration to time The range of values The first-order transition probability is equivalent to the first-order transition probability in the transition matrix. Get the first place line, number Column elements, This indicates that the Markov transition field diagram is within the window. , No. The corresponding time position is the 1st line, number Column elements;

[0024] The recursion graph is constructed as follows: Embedded With the The phase space obtains the state. Given a sparsity control threshold With step function The elements in the recursive graph are constructed using formula (5), and the expression of formula (5) is:

[0025] (5);

[0026] in Instruction No. With the Whether the phase space state is reproduced;

[0027] The three encoding methods generate symmetrical... The matrix is ​​then uniformly adjusted to the resolution via interpolation or cropping. Furthermore, only continuous sensor channels are encoded to avoid monochromatic noise in the image domain caused by switching signals, and finally, the signals are stacked along the channel axis to obtain... .

[0028] Furthermore, in step 2, the time dynamic encoder maps the original sequence into a time series representation. Specifically:

[0029] First, the input window is batch-dimensionally expanded and rearranged into a four-dimensional tensor. ,in To determine the batch size, a one-dimensional convolution that slides only along the time axis is used in the local feature extraction stack of the temporal dynamic encoder using formula (6) to obtain a length of... The feature dimension is sequence tensors The expression for formula (6) is:

[0030] (6);

[0031] in, For temporal local feature mapping;

[0032] Then, using formula (7), a long short-term memory network capable of encoding long-range dependencies is employed. right Perform timing aggregation and output the last time step. The expression for formula (7) is:

[0033] (7);

[0034] in, The dimension of the time representation vector;

[0035] The time-image representation module will use pseudo-images Visual representations are extracted from pre-trained visual backbones. Specifically:

[0036] Using a pre-trained visual backbone network with frozen parameters Convolutional feature extraction is performed and then global average pooling is used to obtain the vector. The visual representation is then obtained through linear mapping using formula (8), which is expressed as follows:

[0037] (8);

[0038] in, For linear mapping network parameters, For bias vectors, is the dimension of the visual representation vector.

[0039] Furthermore, in step 3, [ The mean of the posterior distribution is obtained by parametric mapping using formula (9). with standard deviation The expression for formula (9) is:

[0040] (9);

[0041] in, To [ The parameterized mapping is a function of the mean vector of each dimension of the latent variables. To [ The parameterized mapping is a function of the standard deviation vector of each dimension of the latent variables. The dimension of the potential representation;

[0042] And let the approximate posterior satisfy formula (10), the expression of formula (10) is:

[0043] (10);

[0044] in, For the reason Conditionally determined fusion latent representation, It is a multidimensional Gaussian distribution. For parameters The defined approximate posterior distribution;

[0045] The prior is taken as an isotropic Gaussian distribution. The fusion latent representation is obtained by reparameterization sampling using formula (11), and the expression of formula (11) is:

[0046] (11);

[0047] in, It is a random noise vector;

[0048] And during the training phase with prior The difference is applied by the variational information compression term described by formula (12), and the expression of formula (12) is:

[0049] (12);

[0050] in, For variational information compression term loss, For the Kullback-Leibler divergence operator;

[0051] Parallel settings depend only on the projection branches represented by the first view. , For parameters Define a multilayer perceptron network and promote consistency constraints. Approaching Thus, the fused latent representation can be reproduced without relying on the second view during the inference stage. The consistency between the two views is calculated using formula (13), which is expressed as follows:

[0052] (13);

[0053] in, The consistency loss of the potential representation of the two views;

[0054] The training objective of variational information bottleneck fusion is... , It is formed by combining the weights according to formula (14), and the expression of formula (14) is:

[0055] (14);

[0056] in, The total loss of variational information bottleneck fusion, This is a hyperparameter.

[0057] Furthermore, in step 4, the fusion latent representation from the training phase is used. With time series representation As input, the discriminant embedding vector is obtained through the linear embedding expressed by formula (15). The expression for formula (15) is:

[0058] (15);

[0059] in, For network parameters, To determine the dimension of the embedding vector, To fuse potential representations Length, The bias vector is initialized with the embedding mean of the normal samples in the training set, and the center vector is calculated using formula (16). The expression for formula (16) is:

[0060] (16)

[0061] in, For the first estimation center The final discriminant embedding vector of a normal sample, The number of normal samples participating in the center estimation, the center vector The dimension is the same as the dimension of the discriminant embedding vector;

[0062] The sub-objective function during the training phase is calculated using formula (17). The expression for formula (17) is:

[0063] (17);

[0064] and The end-to-end optimization objective is jointly constructed using formula (18). The expression for formula (18) is:

[0065] (18);

[0066] The anomaly score based on center distance is calculated using formula (19), which is expressed as follows:

[0067] (19);

[0068] The threshold is determined by the quantiles of the normal sample score set during the training phase, and the threshold calculation method is shown in formula (20):

[0069] (20);

[0070] in, Given the maximum permissible false alarm ratio, when hour, Equal to normal score quantile values, This represents the total number of normal samples used to estimate the threshold during the training phase. The first normal sample outlier score in the normal sample anomaly score sequence sorted from smallest to largest. Each score value, i.e., the empirical distribution of scores in a normal sample. quantiles, corresponding to ensuring the false positive rate does not exceed [a certain threshold]. The threshold.

[0071] Furthermore, in step 5, single-view reasoning is performed under the condition of only inputting the time series view, and the result is obtained through formula (7) in step 2. The projection branch is obtained through step 3. The test vector is calculated according to formula (21). The expression for formula (21) is:

[0072] (twenty one);

[0073] The anomaly score of the test vector is calculated using formula (22). The expression for formula (22) is:

[0074] (twenty two);

[0075] And compared with the threshold pre-set based on the quantiles of the normal sample score set during the training phase. By comparison, the predicted label is output based on the discrimination rule of the indicator function using formula (23). The expression for formula (23) is:

[0076] (twenty three);

[0077] in, For indicator functions, if Anomaly score greater than threshold If the output label is 1, it indicates an error; otherwise, it indicates a normal operation.

[0078] The beneficial technical effects of this invention are as follows:

[0079] This invention provides an anomaly detection method for single-class industrial control systems based on dual-view information bottleneck fusion. Using only normal data, it fuses dual-view priors with variational information bottlenecks into DeSVDD. During training, time-series and pseudo-image dual views are used to compress redundancy and enhance discrimination. During inference, single-view projection is used to replace deployment. This allows for the stable establishment of effective anomaly detection boundaries even with few samples, significantly reducing false positives and false negatives, and improving cross-scene generalization ability and detection efficiency. Attached Figure Description

[0080] Figure 1 This is a model structure diagram of the anomaly detection method for single-class industrial control systems based on dual-view information bottleneck fusion in this invention. Detailed Implementation

[0081] The specific embodiments of the present invention will be further described below with reference to specific examples:

[0082] An anomaly detection method for single-class industrial control systems based on dual-view information bottleneck fusion, such as Figure 1 As shown, it includes the following steps:

[0083] Step 1: Obtain the multivariable sensor sequence of the industrial control system ,in The number of channels is used to apply a length of [value] to the sequence. A sliding window is used to obtain samples. Deterministic mapping Will Convert to auxiliary pseudo-image Used to assist training, a training set is constructed from normal samples. The samples to be tested constitute the test set. ;

[0084] Specifically, the multivariable sensor sequences from the industrial control system are arranged according to a fixed window length. Perform sliding aggregation and time alignment to obtain the history window During the training phase, continuous sensor variables in each normal window are subjected to deterministic mapping. Generate auxiliary pseudo-images aligned with the normal window time. No fake images are generated during the testing and online inference phases;

[0085] Where, mapping After normalizing the sequence intervals of each channel, it is represented as follows: Based on this, three types of encoding—Gram angle field, Markov transition field, and recursive graph—are jointly implemented, and the results are stacked by channel. ,in Number of channels , For the high of the pseudo image, The width of the pseudo-image;

[0086] The construction of the Gram Corner Field first requires The angle variable is obtained through the inverse cosine mapping shown in formula (1). The expression of formula (1) is:

[0087] (1);

[0088] The elements of the Gram matrix are constructed using formula (2), and the expression for formula (2) is as follows:

[0089] (2);

[0090] in For the first An angular variable at a given time position. The Gram angle field diagram is shown in the window. , No. The corresponding time position is the 1st line, number Column elements, , The first , No. An angular variable at a given time position;

[0091] The Markov transition field is constructed as follows: value range according to The non-overlapping intervals are divided into According to formula (3), the first-order transition probability is defined, and the expression of formula (3) is:

[0092] (3);

[0093] And let the value at each time step be quantized by a quantization function. Mapped to its corresponding bin index The Markov transition field matrix elements are constructed using formula (4), and the expression for formula (4) is as follows:

[0094] (4);

[0095] in For probability operators, To be from the interval Transfer to interval The first-order transition probability, For binning mapping, Indicates from time The range of values Migration to time The range of values The first-order transition probability is equivalent to the first-order transition probability in the transition matrix. Get the first place line, number Column elements, This indicates that the Markov transition field diagram is within the window. , No. The corresponding time position is the 1st line, number Column elements;

[0096] The recursion graph is constructed as follows: Embedded With the The phase space obtains the state. Given a sparsity control threshold With step function The elements in the recursive graph are constructed using formula (5), and the expression of formula (5) is:

[0097] (5);

[0098] in Instruction No. With the Whether the phase space state is reproduced;

[0099] The three encoding methods generate symmetrical... The matrix is ​​then uniformly adjusted to the resolution via interpolation or cropping. Furthermore, only continuous sensor channels are encoded to avoid monochromatic noise in the image domain caused by switching signals, and finally, the signals are stacked along the channel axis to obtain... .

[0100] Step 2: During the training phase, a time-based dynamic encoder and a time-based image representation module are used to perform dual-view representation of the same historical window. The time-based dynamic encoder maps the original sequence to a time-series representation. The time-image representation module represents pseudo-images. Visual representations are extracted from pre-trained visual backbones. .

[0101] The time-series dynamic encoder maps the original sequence to a time-series representation. Specifically:

[0102] First, the input window is batch-dimensionally expanded and rearranged into a four-dimensional tensor. ,in To determine the batch size, a one-dimensional convolution that slides only along the time axis is used in the local feature extraction stack of the temporal dynamic encoder using formula (6) to obtain a length of... The feature dimension is sequence tensors The expression for formula (6) is:

[0103] (6);

[0104] in, For temporal local feature mapping;

[0105] Then, using formula (7), a long short-term memory network capable of encoding long-range dependencies is employed. right Perform timing aggregation and output the last time step. The expression for formula (7) is:

[0106] (7);

[0107] in, The dimension of the time representation vector;

[0108] The time-image representation module will use pseudo-images Visual representations are extracted from pre-trained visual backbones. Specifically:

[0109] Using a pre-trained visual backbone network with frozen parameters Convolutional feature extraction is performed and then global average pooling is used to obtain the vector. The visual representation is then obtained through linear mapping using formula (8), which is expressed as follows:

[0110] (8);

[0111] in, For linear mapping network parameters, For bias vectors, is the dimension of the visual representation vector.

[0112] Step 3: Establish a variational information bottleneck fusion module to fuse the concatenated vector [ Using [] as input, generate a fusion latent representation. Information compression is performed relative to isotropic priors, while setting up a system that only depends on... projection branch Used to replace in the reasoning stage This enables dual-view training and single-view inference stages.

[0113] Specifically, [ The mean of the posterior distribution is obtained by parametric mapping using formula (9). with standard deviation The expression for formula (9) is:

[0114] (9);

[0115] in, To [ The parameterized mapping is a function of the mean vector of each dimension of the latent variables (derived from the parameters). Sure), To [ The parameterized mapping is a function of the standard deviation vector of each dimension of the latent variables. The dimension of the potential representation;

[0116] And let the approximate posterior satisfy formula (10), the expression of formula (10) is:

[0117] (10);

[0118] in, For the reason Conditionally determined fusion latent representation, It is a multidimensional Gaussian distribution. For parameters The defined approximate posterior distribution;

[0119] The prior is taken as an isotropic Gaussian distribution. The fusion latent representation is obtained by reparameterization sampling using formula (11), and the expression of formula (11) is:

[0120] (11);

[0121] in, It is a random noise vector;

[0122] And during the training phase with prior The difference is applied by the variational information compression term described by formula (12), and the expression of formula (12) is:

[0123] (12);

[0124] in, For variational information compression term loss, For the Kullback-Leibler divergence operator;

[0125] To achieve "two views during training and one view during inference", projection branches that rely solely on the representation of the first view are set up in parallel. , For parameters Define a multilayer perceptron network and promote consistency constraints. Approaching Thus, the fused latent representation can be reproduced without relying on the second view during the inference stage. The consistency between the two views is calculated using formula (13), which is expressed as follows:

[0126] (13);

[0127] in, The consistency loss of the potential representation of the two views;

[0128] The training objective of variational information bottleneck fusion is... , It is formed by combining the weights according to formula (14), and the expression of formula (14) is:

[0129] (14);

[0130] in, The total loss of variational information bottleneck fusion, Hyperparameters are used during the training phase. As a fusion of latent representations, it participates in subsequent learning during the inference stage. As a process for integrating latent representation inputs into subsequent support vector data description and discrimination, it ensures that the representational capability remains consistent with that of dual-view training even when only the first view is available.

[0131] Step 4: Transfer the training phase With time series representation Linear combination, via embedded mapping parameters ( , The final embedding vector is obtained. , around the central vector Learn a compact subspace of normal samples and build a final embedding vector. With the center vector The distance between them is used as an anomaly score. The scoring rules are based on setting thresholds according to the quantiles of the score set of normal samples in the training set. ;

[0132] Fusion latent representation during the training phase With time series representation As input, the discriminant embedding vector is obtained through the linear embedding expressed by formula (15). The expression for formula (15) is:

[0133] (15);

[0134] in, For network parameters, To determine the dimension of the embedding vector, To fuse potential representations Length, The bias vector is initialized with the embedding mean of the normal samples in the training set, and the center vector is calculated using formula (16). The expression for formula (16) is:

[0135] (16)

[0136] in, For the first estimation center The final discriminant embedding vector of a normal sample, The number of normal samples participating in the center estimation, the center vector The dimension is the same as the dimension of the discriminant embedding vector;

[0137] The sub-objective function during the training phase is calculated using formula (17). The expression for formula (17) is:

[0138] (17);

[0139] and The end-to-end optimization objective is jointly constructed using formula (18). The expression for formula (18) is:

[0140] (18);

[0141] The anomaly score based on center distance is calculated using formula (19), which is expressed as follows:

[0142] (19);

[0143] The threshold is determined by the quantiles of the normal sample score set during the training phase, and the threshold calculation method is shown in formula (20):

[0144] (20);

[0145] in, Given the maximum permissible false alarm ratio, when hour, Equal to normal score quantile values, This represents the total number of normal samples used to estimate the threshold during the training phase. The first normal sample outlier score in the normal sample anomaly score sequence sorted from smallest to largest. Each score value, i.e., the empirical distribution of scores in a normal sample. quantiles, corresponding to ensuring the false positive rate does not exceed [a certain threshold]. The threshold.

[0146] Step 5: The sample to be tested is characterized only by time series analysis. With projection branch Calculate the anomaly score and compare it with the threshold. Compare and output the result to determine whether it is normal or abnormal.

[0147] Single-view reasoning is performed under the condition of only inputting the time series view, and obtained through formula (7) in step 2. The projection branch is obtained through step 3. The test vector is calculated according to formula (21). The expression for formula (21) is:

[0148] (twenty one);

[0149] The anomaly score of the test vector is calculated using formula (22). The expression for formula (22) is:

[0150] (twenty two);

[0151] And compared with the threshold pre-set based on the quantiles of the normal sample score set during the training phase. By comparison, the predicted label is output based on the discrimination rule of the indicator function using formula (23). The expression for formula (23) is:

[0152] (twenty three);

[0153] in, For indicator functions, if Anomaly score greater than threshold If the output label is 1, it indicates an error; otherwise, it indicates a normal operation.

[0154] The present invention provides an anomaly detection method for industrial control systems. During the training phase, a time-series view and a pseudo-image view are simultaneously constructed for the same historical window. Representations are extracted by a time-dynamic encoder and a time-image representation module, respectively. Cross-view fusion and redundancy compression are achieved in the variational information bottleneck fusion module. Simultaneously, a projection branch relying solely on the time-series representation is set to ensure single-view substitutability during inference. Subsequently, in the support vector data description and scoring module, the fused latent representation and time-series representation are linearly embedded. A normal subspace is learned around the center vector, and the center distance is used as the anomaly score. End-to-end optimization is performed by combining variational compression and projection consistency terms. During the detection phase, only the time-series view is input. The latent representation is obtained through the projection branch, and the anomaly score is calculated and compared with a threshold determined by the quantiles of the training normal samples to complete the judgment. This invention organically combines dual-view prior injection, variational compression, and deep single-class classification. Without constructing additional samples, it can stably establish effective boundaries under limited sample conditions, significantly reducing false positives and false negatives while maintaining cross-scenario generalization capabilities.

[0155] Example:

[0156] This embodiment uses the SWaT dataset and the WADI dataset for experimental verification. Both SWaT and WADI datasets are publicly available industrial control system anomaly detection datasets provided by SUTD iTrust (accessible via: https: / / itrust.sutd.edu.sg / itrust-labs_datasets / dataset_info / ).

[0157] The SWaT dataset is a control system log collected from a six-stage reverse osmosis water purification platform developed by the iTrust Institute of Singapore University of Technology and Design. It contains 51 sensor and actuator signals and collects real-time operating data for 11 days. The first 7 days were under completely safe operating conditions, while the last 4 days were injected with various attack scripts by the penetration testing team.

[0158] The WADI dataset records data from 127 monitoring points in the water supply system of Singapore University of Technology and Design, covering valves, flow meters, and water quality indicators. It collects the operating status of the water supply network for 16 days. The first 14 days collect data on normal flow, and the last 2 days simulate multiple types of attack scenarios.

[0159] In this embodiment, simulations compare the methods of autoencoder (AE), variational autoencoder based on long short-term memory network (LSTM-VAE), deep support vector data description (DeSVDD), and the proposed method based on dual-view variational information bottleneck fusion (DVIB-DeSVDD). Precision, recall, and F1 score are used as performance metrics to evaluate the different anomaly detection methods. The hyperparameters of the proposed DVIB-DeSVDD method are also discussed. They are respectively The results of the comparative experiments are shown in Table 1.

[0160] Table 1. Performance of different models on the two datasets

[0161] ;

[0162] The experimental results in Table 1 verify the effectiveness of the DVIB-DeSVDD method of this invention in anomaly detection tasks. By introducing a dual-view approach (time series and pseudo-images) during training and compressing redundancy in the variational information bottleneck, and achieving single-view substitution during inference through projection consistency, this method outperforms traditional single-classification methods. Furthermore, Table 2 shows the F1 score comparison under different proportions of missing training data on the SWaT dataset.

[0163] Table 2. Comparison of F1 scores under different proportions of training data in the SWaT dataset.

[0164] ;

[0165] Table 2 shows that even with a very small sample size (10%), DVIB-DeSVDD still achieves an F1 score of 76.41%, while traditional single-classification methods only achieve F1 scores of 23–38% under the same conditions, demonstrating the vulnerability of such methods when data is scarce. This comparative analysis further verifies the core role of dual-view feature fusion and latent space compression in improving anomaly detection performance under limited sample conditions.

[0166] Based on the above analysis, the DVIB-DeSVDD method provided by this invention integrates dual-view priors with variational information bottlenecks and performs end-to-end collaborative optimization with deep support vector data description. During training, cross-view discriminative priors are injected and redundant information is compressed. During testing, inference is achieved solely based on single-view projection. This method can establish accurate decision boundaries even with a small number of samples, providing a solution for anomaly detection in industrial control systems under limited sample conditions.

[0167] Of course, the above description is not intended to limit the present invention, and the present invention is not limited to the examples given above. Any changes, modifications, additions or substitutions made by those skilled in the art within the scope of the present invention should also fall within the protection scope of the present invention.

Claims

1. An anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion, characterized in that, Includes the following steps: Step 1: Obtain the multivariable sensor sequence of the industrial control system ,in The number of channels is used to apply a length of [value] to the sequence. A sliding window is used to obtain samples. Deterministic mapping Will Convert to auxiliary pseudo-image Used to assist training, a training set is constructed from normal samples. The samples to be tested constitute the test set. ; Step 2: During the training phase, a time-based dynamic encoder and a time-based image representation module are used to perform dual-view representation of the same historical window. The time-based dynamic encoder maps the original sequence to a time-series representation. The time-image representation module represents pseudo-images. Visual representations are extracted from pre-trained visual backbones. ; Step 3: Establish a variational information bottleneck fusion module to fuse the concatenated vector [ Using [] as input, generate a fusion latent representation. Information compression is performed relative to isotropic priors, while setting up a system that only depends on... projection branch Used to replace in the reasoning stage This enables dual-view training and single-view inference stages. Step 4: Transfer the training phase With time series representation Linear combination, via embedded mapping parameters ( , The final embedding vector is obtained. , around the central vector Learn a compact subspace of normal samples and build a final embedding vector. With the center vector The distance between them is used as an anomaly score. The scoring rules are based on setting thresholds according to the quantiles of the score set of normal samples in the training set. ; Step 5: The window under test is characterized only by time series analysis. With projection branch Calculate the anomaly score and compare it with the threshold. Compare and output the result to determine whether it is normal or abnormal.

2. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 1, characterized in that, In step 1, the multivariable sensor sequence from the industrial control system is arranged according to a fixed window length. Historical windows are obtained by performing sliding aggregation and time alignment. During the training phase, continuous sensor variables in each normal window are deterministically mapped. Generate an auxiliary pseudo-image aligned with the normal window time. ; Where, mapping After normalizing the sequence intervals of each channel, it is represented as follows: Based on this, three types of encoding—Gram angle field, Markov transition field, and recursive graph—are jointly implemented, and the results are stacked by channel. ,in Number of channels , For the high of the pseudo image, The width of the pseudo-image; The construction of Gram's Corner Field first requires The angle variable is obtained through the inverse cosine mapping shown in formula (1). The expression of formula (1) is: (1)； The elements of the Gram matrix are constructed using formula (2), and the expression for formula (2) is as follows: (2)； in For the first An angular variable at a given time position. The Gram angle field diagram is shown in the window. , No. The corresponding time position is the 1st line, number Column elements, , The first , No. An angular variable at a given time position; The Markov transition field is constructed as follows: value range according to The non-overlapping intervals are divided into According to formula (3), the first-order transition probability is defined, and the expression of formula (3) is: (3)； And let the value at each time step be quantized by a quantization function. Mapped to its corresponding bin index The Markov transition field matrix elements are constructed using formula (4), and the expression for formula (4) is as follows: (4)； in For probability operators, To be from the interval Transfer to interval The first-order transition probability, For binning mapping, Indicates from time The range of values Migration to time The range of values The first-order transition probability is equivalent to the first-order transition probability in the transition matrix. Get the first place line, number Column elements, This indicates that the Markov transition field diagram is within the window. , No. The corresponding time position is the 1st line, number Column elements; The recursion graph is constructed as follows: Embedded With the The phase space obtains the state. Given a sparsity control threshold With step function The elements in the recursive graph are constructed using formula (5), and the expression of formula (5) is: (5)； in Instruction No. With the Whether the phase space state is reproduced; The three encoding methods generate symmetrical... The matrix is ​​then uniformly adjusted to the resolution via interpolation or cropping. Furthermore, only continuous sensor channels are encoded to avoid monochromatic noise in the image domain caused by switching signals, and finally, the signals are stacked along the channel axis to obtain... .

3. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 2, characterized in that, In step 2, the time dynamic encoder maps the original sequence into a time series representation. Specifically: First, the input window is batch-dimensionally expanded and rearranged into a four-dimensional tensor. ,in To determine the batch size, a one-dimensional convolution that slides only along the time axis is used in the local feature extraction stack of the temporal dynamic encoder using formula (6) to obtain a length of... The feature dimension is sequence tensors The expression for formula (6) is: (6)； in, For temporal local feature mapping; Then, using formula (7), a long short-term memory network capable of encoding long-range dependencies is employed. right Perform timing aggregation and output the last time step. The expression for formula (7) is: (7)； in, The dimension of the time representation vector; The time-image representation module will use pseudo-images Visual representations are extracted from pre-trained visual backbones. Specifically: Using a pre-trained visual backbone network with frozen parameters Convolutional feature extraction is performed and then global average pooling is used to obtain the vector. The visual representation is then obtained through linear mapping using formula (8), which is expressed as follows: (8)； in, For linear mapping network parameters, For bias vectors, is the dimension of the visual representation vector.

4. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 3, characterized in that, In step 3, [ The mean of the posterior distribution is obtained by parametric mapping using formula (9). with standard deviation The expression for formula (9) is: (9)； in, To [ The parameterized mapping is a function of the mean vector of each dimension of the latent variables. To [ The parameterized mapping is a function of the standard deviation vector of each dimension of the latent variables. The dimension of the potential representation; And let the approximate posterior satisfy formula (10), the expression of formula (10) is: (10)； in, For the reason Conditionally determined fusion latent representation, It is a multidimensional Gaussian distribution. For parameters The defined approximate posterior distribution; The prior is taken as an isotropic Gaussian distribution. The fusion latent representation is obtained by reparameterization sampling using formula (11). The expression for formula (11) is: (11)； in, It is a random noise vector; And during the training phase with prior The difference is applied by the variational information compression term described by formula (12), and the expression of formula (12) is: (12)； in, For variational information compression term loss, For the Kullback-Leibler divergence operator; Parallel settings depend only on the projection branches represented by the first view. , For parameters Define a multilayer perceptron network and promote consistency constraints. Approaching Thus, the fused latent representation can be reproduced without relying on the second view during the inference stage. The consistency between the two views is calculated using formula (13), which is expressed as follows: (13)； in, The consistency loss of the potential representation of the two views; The training objective of variational information bottleneck fusion is... , It is formed by combining the weights according to formula (14), and the expression of formula (14) is: (14)； in, The total loss of variational information bottleneck fusion, This is a hyperparameter.

5. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 4, characterized in that, In step 4, the fusion latent representation during the training phase is used. With time series representation As input, the discriminant embedding vector is obtained through the linear embedding expressed by formula (15). The expression for formula (15) is: (15)； in, For network parameters, To determine the dimension of the embedding vector, To fuse potential representations Length, The bias vector is initialized with the embedding mean of the normal samples in the training set, and the center vector is calculated using formula (16). The expression for formula (16) is: (16) in, For the first estimation center The final discriminant embedding vector of a normal sample, The number of normal samples participating in the center estimation, the center vector The dimension is the same as the dimension of the discriminant embedding vector; The sub-objective function during the training phase is calculated using formula (17). The expression for formula (17) is: (17)； and The end-to-end optimization objective is jointly constructed using formula (18). The expression for formula (18) is: (18)； The anomaly score based on center distance is calculated using formula (19), which is expressed as follows: (19)； The threshold is determined by the quantiles of the normal sample score set during the training phase, and the threshold calculation method is shown in formula (20): (20)； in, Given the maximum permissible false alarm ratio, when hour, Equal to normal score quantile values, This represents the total number of normal samples used to estimate the threshold during the training phase. The first normal sample outlier score in the normal sample anomaly score sequence sorted from smallest to largest. Each score value, i.e., the empirical distribution of scores in a normal sample. quantiles, corresponding to ensuring the false positive rate does not exceed [a certain threshold]. The threshold.

6. The anomaly detection method for a single-class industrial control system based on dual-view information bottleneck fusion according to claim 5, characterized in that, In step 5, single-view reasoning is performed under the condition of only inputting the time series view, and the result is obtained through formula (7) in step 2. The projection branch is obtained through step 3. The test vector is calculated according to formula (21). The expression for formula (21) is: (21)； The anomaly score of the test vector is calculated using formula (22). The expression for formula (22) is: (22)； And compared with the threshold pre-set based on the quantiles of the normal sample score set during the training phase. By comparison, the predicted label is output based on the discrimination rule of the indicator function using formula (23). The expression for formula (23) is: (23)； in, For indicator functions, if Anomaly score greater than threshold If the output label is 1, it indicates an error; otherwise, it indicates a normal operation.

Images