Anomaly behavior identification method, device and apparatus of an industrial control system
By quantitatively analyzing the operating data and network traffic characteristics of industrial control systems, constructing noise interference values and elimination coefficients, and cleaning data samples, the problem of noise interference in existing technologies is solved, and high-accuracy and reliable identification of abnormal behavior in industrial control systems is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHONGKUN ENERGY TECHNOLOGY RESEARCH INSTITUTE (XIAN) CO LTD
- Filing Date
- 2025-11-05
- Publication Date
- 2026-05-12
AI Technical Summary
Existing technologies use noisy random samples to train abnormal behavior recognition models in industrial control systems, which leads to the models learning noisy false patterns, reducing the accuracy and reliability of recognition, and making it difficult to effectively identify abnormal behaviors in complex industrial control environments.
By quantitatively analyzing the gradual and continuous characteristics of operational data and the correlation of multi-source data, a first noise interference value and a second noise interference value are constructed. Combined with a rejection coefficient, the data is cleaned, and only high-quality samples are retained to train a neural network model to identify abnormal behavior of industrial control systems.
It improves the accuracy and reliability of anomaly identification models for industrial control systems, effectively distinguishes between noise interference and real anomalies, and enhances the model's generalization ability.
Smart Images
Figure CN121411274B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of industrial data analysis technology, specifically to a method, device, and apparatus for identifying abnormal behavior in an industrial control system. Background Technology
[0002] An industrial control system is a computer system used to monitor, control, and optimize automated production processes. Therefore, it is necessary to identify abnormal operating behaviors in industrial control systems to promptly detect potential faults and safety issues in industrial equipment, thereby preventing automated production interruptions, product quality degradation, or safety accidents.
[0003] Existing methods typically use historical data randomly sampled from an experience replay buffer to train anomaly recognition models. However, industrial control systems are often noisy environments, and sensors introduce interference during data acquisition and transmission. Directly using these noisy random samples for training causes the model to learn spurious patterns generated by the noise, rather than genuine system behavior. This severely compromises the model's accuracy and generalization ability, ultimately making it difficult to effectively identify genuine anomalies in complex industrial control environments, thus reducing the accuracy and reliability of identifying abnormal operating conditions in industrial control systems. Summary of the Invention
[0004] In a first aspect, embodiments of this application provide a method for identifying abnormal behavior in an industrial control system, the method comprising the following steps:
[0005] Acquire all types of operational data and network traffic data at any acquisition time within preset historical time periods in the industrial control system;
[0006] Based on the distribution of the differences of each type of operational data between all adjacent acquisition times in each historical period, and the fitting error in the fitting process of each type of operational data, the slowly varying continuous characteristic value under each historical period is determined; based on the correlation between all types of operational data in each historical period, the correlation characteristic value under each historical period is determined, and combined with the slowly varying continuous characteristic value, the first noise interference value under each historical period is determined.
[0007] Based on the autocorrelation of network traffic data at all collection times within each historical period, the second noise interference value for each historical period is determined, and combined with the first noise interference value, the elimination coefficient for each historical period is determined.
[0008] Based on the elimination coefficient, all types of operational data in each historical period are eliminated, and the abnormal behavior of the industrial control system is identified based on the operational data after elimination.
[0009] Preferably, the method for determining the slowly varying continuous characteristic values for each historical period is as follows:
[0010] Calculate the sum of the absolute values of all elements in the first-order difference sequence of each type of operational data within each historical period, and denote the reciprocal of the sum as the slowly varying characteristic value of each type of operational data within each historical period;
[0011] Fitting curves are obtained for each type of operational data in each historical period. The mean of the difference between each type of operational data and the fitted value on its fitted curve is calculated. The reciprocal of the mean is recorded as the continuous characteristic value of each type of operational data in each historical period.
[0012] Calculate the mean of the normalized value of the slowly varying characteristic value and the mean of the normalized value of the continuous characteristic value for each type of operational data in each historical period, and record it as the comprehensive characteristic value of each type of operational data. Take the mean of the comprehensive characteristic values of all types of operational data in each historical period as the slowly varying continuous characteristic value for each historical period.
[0013] Preferably, the correlation characteristic value for each historical period is the mean of the absolute values of the correlation coefficients among all types of operational data within each historical period.
[0014] Preferably, the first noise interference value for each historical period is the reciprocal of the mean of the normalized value of the slowly varying continuous characteristic value and the normalized value of the correlation characteristic value for each historical period.
[0015] Preferably, the second noise interference value for each historical period is the reciprocal of the maximum value of the autocorrelation coefficient of the network traffic data at all collection times within each historical period under all time delays.
[0016] Preferably, the elimination coefficient for each historical period is the result of a positive fusion of the first noise interference value and the second noise interference value for each historical period.
[0017] Preferably, the step of removing all types of operational data within each historical period based on the removal coefficient includes:
[0018] Remove all types of operational data from the first preset number of historical periods from the results of sorting the removal coefficients in descending order.
[0019] Preferably, the identification of abnormal behavior of the industrial control system based on the eliminated operational data includes:
[0020] The system acquires the operating status of the industrial control system within all historical time periods and sets labels for the operating status. It uses all types of operating data and corresponding operating status labels from all historical time periods (excluding the remaining historical time periods) as input to the neural network and outputs a trained neural network model.
[0021] The system takes all types of operational data from the industrial control system during the current time period as input to a trained neural network model and outputs the operational status identification result of the industrial control system during the current time period.
[0022] Secondly, embodiments of this application provide an abnormal behavior identification device for an industrial control system, wherein the device stores a computer program, and when the computer program is executed by a processor, it implements the abnormal behavior identification method for an industrial control system described in any of the above claims.
[0023] Thirdly, embodiments of this application also provide an abnormal behavior identification device for an industrial control system, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of any of the above-described methods for identifying abnormal behavior of an industrial control system.
[0024] As can be seen from the above embodiments, the abnormal behavior identification method for an industrial control system provided in this application has at least the following beneficial effects:
[0025] This application constructs a first noise interference value by quantitatively analyzing the gradual and continuous characteristics of the operational data and the correlation between multi-source data. This value can accurately assess the degree of environmental noise pollution of data in each historical period, thereby effectively distinguishing noise interference from real anomalies. This provides a key basis for subsequent cleaning of low-quality training samples and improving the accuracy and generalization ability of the anomaly identification model. Furthermore, this application constructs a second noise interference value by analyzing the periodicity of network traffic to assess the noise impact at the transmission layer. Finally, this value is positively fused with the first noise interference value, which reflects noise at the acquisition layer, to form a comprehensive elimination coefficient. This elimination coefficient can comprehensively measure the data quality of historical periods from both data acquisition and network transmission dimensions, providing the final decision basis for accurately eliminating high-noise samples and ensuring the training effect of the subsequent anomaly identification model. Finally, based on the elimination coefficient, this application filters the operational data of all historical periods, retaining only high-quality data samples. Furthermore, this cleaned operational data and its state labels are used to train a neural network model. Finally, the trained model is applied to real-time data to accurately identify the abnormal operating state of the industrial control system, thereby effectively improving the accuracy and reliability of anomaly identification of the industrial control system. Attached Figure Description
[0026] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0027] Figure 1 A flowchart illustrating the steps of an abnormal behavior identification method for an industrial control system, provided as an embodiment of this application;
[0028] Figure 2 This is a schematic diagram of the elimination coefficient extraction process provided in one embodiment of this application. Detailed Implementation
[0029] To further illustrate the technical means and effects adopted by this application to achieve the intended purpose of the invention, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of an abnormal behavior identification method, device, and apparatus for an industrial control system proposed in this application. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.
[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.
[0031] The following description, in conjunction with the accompanying drawings, details the specific scheme of the abnormal behavior identification method, equipment, and apparatus for an industrial control system provided in this application.
[0032] Please see Figure 1 The diagram illustrates a flowchart of an abnormal behavior identification method for an industrial control system according to an embodiment of this application. The method includes the following steps:
[0033] S1: Acquire all types of operating data and network traffic data at any acquisition time within each preset historical period in the industrial control system.
[0034] All types of operational data and network traffic data are randomly extracted from the historical data stored in the data center of the industrial control system at any collection time within different historical periods. In this embodiment, the length of the period is t, and a total of N periods are collected. All types of operational data include temperature, pressure, vibration data, current, and voltage. The collection frequency of all data is f.
[0035] It should be noted that the values of time period length t, number of time periods N, and sampling frequency f are all set manually. In this embodiment, the time period length t is 1 minute, the number of time periods N is 300, and the sampling frequency f is 10 Hz. In actual applications, as other implementation methods, implementers can also set them according to specific circumstances. This embodiment does not impose any special restrictions.
[0036] Meanwhile, network traffic data at any collection time within each historical period is obtained from the historical data stored in the data center of the industrial control system. The collection frequency of the network traffic data is the same as that of the above data.
[0037] The various operational data and network traffic data under all the above time periods are normalized respectively. In this embodiment, the maximum and minimum value normalization method is used to normalize the data. In actual application, as other implementation methods, implementers can also choose the z-score normalization method to normalize the data according to the specific situation. This embodiment does not impose any special restrictions on the selection of normalization methods.
[0038] Among them, the maximum-minimum normalization method is a well-known technique, and the process of using it to normalize data will not be elaborated here.
[0039] S2: Based on the distribution of the differences of each type of operational data between all adjacent acquisition times in each historical period, and the fitting error in the fitting process of each type of operational data, determine the slowly varying continuous feature value under each historical period; based on the correlation between all types of operational data in each historical period, determine the correlation feature value under each historical period, and combine the slowly varying continuous feature value to determine the first noise interference value under each historical period.
[0040] In steady-state operation, industrial control systems typically exhibit gradual and continuous changes in multi-source operational data, such as temperature, pressure, and current, along with correlations determined by strong physical field coupling (e.g., thermo-electrical-structural coupling). While real abnormal behaviors of industrial control coefficients (e.g., actuator jamming) can cause sudden increases or decreases in some operational data, disrupting their continuity, the inherent physical relationships within the industrial control system mean that various operational data often exhibit a coordinated trend, thus maintaining their correlation to some extent. In contrast, environmental noise interference is sudden and random. The false data introduced by environmental noise not only disrupts the continuity of individual operational data but also, due to its irregularity, destroys the inherent correlations between different types of operational data. Therefore, the lower the continuity and correlation exhibited by different types of operational data, the greater the degree of environmental noise interference experienced during data acquisition.
[0041] Based on the above analysis, this embodiment determines the slowly varying continuous characteristic value for each historical period based on the distribution of differences in each type of operational data between all adjacent acquisition times within each historical period, and the fitting error in the fitting process of each type of operational data; based on the correlation between all types of operational data within each historical period, the correlation characteristic value for each historical period is determined; and combined with the slowly varying continuous characteristic value, the first noise interference value for each historical period is determined to assess the degree of environmental noise interference to the operational data in each period. The specific process is as follows:
[0042] First, this embodiment determines the slowly varying continuous characteristic values for each historical period based on the distribution of differences in each type of operational data between all adjacent acquisition times within each historical period, and the fitting error during the fitting process for each type of operational data. Specifically:
[0043] This embodiment calculates the sum of the absolute values of all elements in the first-order difference sequence of each type of operating data within each historical period. The reciprocal of this sum is recorded as the slow-change characteristic value of each type of operating data within each historical period. This value is used to characterize whether the operating data has the characteristic of slow change. If the slow-change characteristic value of the operating data within the current historical period is smaller, it indicates that the instantaneous fluctuation of the operating data is larger, indicating that the instantaneous fluctuation of the operating data within the current historical period is more drastic and the change is steeper. This reflects that the operating data may be mixed with sudden noise or that the industrial control system has undergone a real change. The data quality is poor and the possibility of noise interference is higher. Conversely, if the slow-change characteristic value of the operating data within the current historical period is larger, it indicates that the instantaneous fluctuation of the operating data is smaller and the change is smoother. This reflects that the operating state of the industrial control system within the current historical period is stable and the possibility of sudden interference is low.
[0044] Furthermore, fitting curves are obtained for each type of operational data within each historical period. The mean difference between each type of operational data and the fitted value on its fitting curve is calculated. The reciprocal of the mean is recorded as the continuous characteristic value of each type of operational data within each historical period. The continuous characteristic value is used to characterize the continuous and smooth change state of the operational data. If the continuous characteristic value of the operational data within the current historical period is smaller, it indicates that the operational data deviates more from the fitted curve, the change pattern is more chaotic and discontinuous, indicating that the operational data may be severely contaminated by random noise, destroying its original continuity. Conversely, if the continuous characteristic value of the operational data within the current historical period is larger, it indicates that the operational data deviates less from the fitted curve, the change pattern is clearer and more continuous, indicating that the operational data maintains its inherent smooth change trend well, is less contaminated by random noise, and has higher data quality.
[0045] It should be noted that there are many methods to measure the difference between data. In this embodiment, the absolute value of the difference between each type of running data and the fitted value is taken as the difference between each type of running data and the fitted value. In practical applications, as other implementation methods, implementers may also use other methods to measure the difference, such as the square or ratio of the difference, depending on the specific circumstances. This embodiment does not impose any special restrictions on the selection of methods to measure the difference between data.
[0046] Furthermore, the mean of the normalized value of the slow-varying characteristic value and the mean of the normalized value of the continuous characteristic value of each type of operational data in each historical period is calculated and recorded as the comprehensive characteristic value of each type of operational data. The mean of the comprehensive characteristic values of all types of operational data in each historical period is taken as the slow-varying continuous characteristic value in each historical period.
[0047] It should be noted that there are many commonly used fitting methods. In this embodiment, the least squares method is used to fit the running data. In practical applications, as other implementation methods, implementers may also use other fitting methods such as polynomial function fitting method according to specific circumstances. This embodiment does not impose any special restrictions on the selection of fitting algorithms.
[0048] The methods for obtaining the first-order difference sequence and the least squares method are well-known techniques. The specific process of obtaining the first-order difference sequence and the specific process of fitting the running data using the least squares method will not be elaborated here.
[0049] Based on the slowly varying continuous characteristic values for each historical period, it can be understood that these values reflect the stability and regularity of the overall changes in operational data. A smaller slowly varying characteristic value for the current historical period indicates more drastic changes in the operational data; therefore, a smaller corresponding slowly varying continuous characteristic value indicates a greater likelihood that the operational data is affected by environmental noise during the current historical period. Conversely, a smaller continuous characteristic value for the current historical period indicates that the overall changes in the operational data are chaotic and discontinuous, and the inherent regularity of the operational data is disrupted; therefore, a larger corresponding slowly varying continuous characteristic value indicates a greater likelihood that the operational data is affected by noise during the current historical period.
[0050] Conversely, if the gradual change characteristic value of the operating data in the current historical period is larger, it indicates that the operating data changes smoothly. Therefore, the larger the corresponding slow continuous characteristic value, the more stable the operating data is in the current historical period, and the less likely it is to be affected by environmental noise. At the same time, if the continuous characteristic value of the operating data in the current historical period is larger, it indicates that the overall change of the operating data is regular and continuous, and the inherent regularity of the operating data is well maintained. Therefore, the corresponding gradual continuous characteristic value is also larger, indicating that the operating data is less likely to be affected by noise in the current historical period.
[0051] Furthermore, this embodiment determines the correlation characteristic value for each historical period based on the correlation between all types of operational data within each historical period. Specifically:
[0052] In this embodiment, the mean of the absolute values of the correlation coefficients among all types of operational data within each historical period is used as the correlation characteristic value for each historical period.
[0053] It should be noted that there are many commonly used methods for calculating correlation coefficients. In this embodiment, the Pearson correlation coefficient among all types of operational data within each historical period is used as the correlation coefficient among all types of operational data within each historical period. In practical applications, as other implementation methods, implementers may also use other correlation coefficient calculation methods such as Spearman correlation coefficient or Kendall's rank correlation coefficient, depending on the specific circumstances. This embodiment does not impose any special restrictions on the selection of correlation coefficient calculation methods. Among them, the calculation method of Pearson correlation coefficient is a well-known technique, and its specific calculation process will not be elaborated further.
[0054] Based on the correlation characteristic values of each historical period, it can be understood that the correlation characteristic values are used to characterize the linkage between different types of operating data in an industrial control system due to strong coupling relationships. If the mean value of the Pearson correlation coefficient between all types of operating data in the current historical period is larger, the corresponding correlation characteristic value is larger, indicating that the coordinated change trend between operating data is stronger and the overall linkage is better. This indicates that different types of operating data conform to their inherent physical coupling laws and the data logic is consistent. It also indicates that the possibility of the operating data being interfered with by environmental noise in the current historical period is smaller and the quality of the operating data is higher.
[0055] Conversely, if the mean of the Pearson correlation coefficient among all types of operational data in the current historical period is smaller, and the corresponding correlation characteristic value is smaller, it indicates that the coordinated change trend among the operational data is weaker and the overall linkage is worse. This suggests that the inherent physical coupling law between different types of operational data is destroyed by irregular noise, and the data logic is inconsistent. It also indicates that the operational data in the current historical period is more likely to be affected by environmental noise interference, and the quality of the operational data is lower.
[0056] Furthermore, this embodiment determines the first noise interference value for each historical period based on the slowly varying continuous characteristic values and correlation characteristic values for each historical period. Specifically:
[0057] In this embodiment, the reciprocal of the mean of the normalized value of the slowly varying continuous feature value and the normalized value of the correlation feature value under each historical period is used as the first noise interference value under each historical period.
[0058] Based on the first noise interference value for each historical period, it can be understood that the first noise interference value reflects the degree of interference of environmental noise on the operating data. If the slowly changing continuous characteristic value is larger in the current historical period, it indicates that the operating data changes more smoothly and continuously in the current historical period, and is less affected by noise interference. Therefore, the corresponding first noise interference value is smaller. At the same time, if the correlation characteristic value is larger in the current historical period, it indicates that the linkage between different types of operating data in the current historical period is higher, indicating that the operating data is less affected by noise interference in the current historical period. Therefore, the corresponding first noise interference value is smaller.
[0059] Conversely, if the gradual change continuous characteristic value under the current historical period is smaller, it indicates that the operation data under the current historical period changes more drastically and chaotically, and is more susceptible to noise interference. Therefore, the corresponding first noise interference value is larger. At the same time, if the correlation characteristic value under the current historical period is smaller, it indicates that the linkage between different types of operation data under the current historical period is lower, indicating that the operation data under the current historical period is more susceptible to noise interference. Therefore, the corresponding first noise interference value is larger.
[0060] Thus, this embodiment constructs a first noise interference value by quantitatively analyzing the gradual and continuous characteristics of the running data itself and the correlation between multi-source data. This value can accurately assess the degree of environmental noise pollution of data in each historical period, thereby effectively distinguishing noise interference from real anomalies. This provides a key basis for subsequent cleaning of low-quality training samples and improving the accuracy and generalization ability of the anomaly identification model.
[0061] S3: Based on the autocorrelation of network traffic data at all collection times within each historical period, determine the second noise interference value for each historical period, and combine it with the first noise interference value to determine the elimination coefficient for each historical period.
[0062] Industrial control systems follow standardized operating procedures, and their equipment behavior and network communication exhibit a high degree of periodicity. However, environmental noise such as electromagnetic interference can cause data packet loss or retransmission, thereby disrupting the inherent periodicity of network traffic. Therefore, this embodiment determines the second noise interference value for each historical period based on the autocorrelation of network traffic data at all acquisition times within each historical period. Combined with the first noise interference value, a rejection coefficient is determined for each historical period to assess the degree of environmental noise interference. The specific process is as follows:
[0063] In this embodiment, firstly, based on the autocorrelation of network traffic data at all collection times within each historical period, the second noise interference value for each historical period is determined. Specifically:
[0064] In this embodiment, the reciprocal of the maximum value of the autocorrelation coefficient of network traffic data at all collection times within each historical period under all time delays is used as the second noise interference value for each historical period.
[0065] The method for calculating the autocorrelation coefficient is a well-known technique, and its specific calculation process will not be elaborated here.
[0066] Based on the second noise interference value under each historical period, it can be understood that the second noise interference characteristic value is used to characterize whether the stability and periodicity of network communication in the industrial control system are destroyed by noise. If the maximum value of the network traffic data under all time delays at all acquisition times in the current historical period is smaller, that is, the second noise interference value is larger, it indicates that the autocorrelation of the network traffic data is weaker and its inherent periodicity is more severely destroyed. This reflects that the network traffic data is affected by strong environmental noise during transmission, resulting in packet loss or retransmission, which may cause noise interference in the data acquisition process. Therefore, the corresponding second noise interference value is larger.
[0067] Conversely, if the maximum value of the autocorrelation coefficient of network traffic data at all collection times within the current historical period is larger among all time delays, that is, the smaller the second noise interference value, it indicates that the autocorrelation of the network traffic data is stronger and its inherent periodicity is better preserved. This reflects that the network traffic data is not affected or is only affected by weak environmental noise during transmission, and the communication process is stable. Therefore, the corresponding second noise interference value is smaller.
[0068] Furthermore, this embodiment determines the elimination coefficient for each historical period based on the first noise interference value and the second noise interference value for each historical period. Specifically:
[0069] In this embodiment, the result of positively fusing the first noise interference value and the second noise interference value in each historical period is used as the elimination coefficient for each historical period.
[0070] Preferably, the schematic diagram of the elimination coefficient extraction process provided in this embodiment is as follows: Figure 2 As shown.
[0071] It should be understood that positive fusion refers to combining two or more indicators through addition or multiplication to obtain a comprehensive indicator, thereby more comprehensively and accurately assessing a phenomenon or problem. This fusion method is not limited to simple arithmetic operations, but can also include more complex statistical models and analytical methods. Implementers can choose according to specific circumstances, and this embodiment does not impose any special restrictions.
[0072] Preferably, as one implementation method, in this embodiment, the product of the first noise interference value and the second noise interference value in each historical period is used as the elimination coefficient in each historical period. In actual application, as another implementation method, the implementer may also adopt other positive fusion methods such as sum value according to the specific situation. This embodiment does not impose any special restrictions.
[0073] Based on the elimination coefficients for each historical period, it can be understood that the elimination coefficient is a comprehensive score of the overall degree of environmental noise interference to the operational data. The first noise interference value reflects the noise level in the data acquisition dimension, and the second noise interference value reflects the noise level in the network transmission dimension. If the first noise interference value is larger in the current historical period, it indicates that the operational data is subject to greater noise interference, and the quality of the operational data is worse. Therefore, the larger the elimination coefficient, the more operational data in the current historical period should be eliminated to avoid reducing the accuracy and reliability of subsequent training of abnormal behavior recognition models for industrial control systems. At the same time, if the second noise interference value is larger in the current historical period, it indicates that the network transmission process is subject to greater noise interference, and the possibility of the operational data being subject to noise interference is also greater. Therefore, the larger the corresponding elimination coefficient, the more operational data in the current historical period should be eliminated.
[0074] Conversely, the smaller the first noise interference value in the current historical period, the less noise interference the operating data is subjected to, and the higher the quality of the operating data. Therefore, the smaller the elimination coefficient, the more operating data in the current historical period should be retained to ensure the data quality for subsequent training of the abnormal behavior recognition model of the industrial control system. At the same time, the smaller the second noise interference value in the current historical period, the less noise interference it is subjected to during network transmission, indicating that the possibility of the operating data being affected by noise interference is also smaller. Therefore, the smaller the corresponding elimination coefficient, the more operating data in the current historical period should be retained.
[0075] Thus, this embodiment constructs a second noise interference value by analyzing the periodicity of network traffic to assess the noise impact at the transmission layer, and finally positively integrates it with the first noise interference value, which reflects the noise at the acquisition layer, to form a comprehensive elimination coefficient. This elimination coefficient can comprehensively measure the data quality of historical periods from both data acquisition and network transmission dimensions, providing the final decision basis for accurately eliminating high-noise samples and ensuring the training effect of subsequent anomaly identification models.
[0076] S4: Based on the elimination coefficient, all types of operating data in each historical period are eliminated, and the abnormal behavior of the industrial control system is identified based on the eliminated operating data.
[0077] This embodiment uses the elimination coefficient obtained in step S3 to eliminate operating data that is significantly affected by environmental noise. A model is then trained based on the eliminated operating data to identify abnormal behaviors in the industrial control system's operating state. The specific process is as follows:
[0078] In this embodiment, the operating status of the industrial control system within all historical time periods is obtained, and labels are set for the operating status. The normal operating status is set as label 0, and the abnormal operating status is set as label 1. All types of operating data and corresponding operating status labels of all historical time periods are used as input to the neural network, and the trained neural network model is output.
[0079] The system takes all types of operational data from the industrial control system during the current time period as input to a trained neural network model and outputs the operational status identification result of the industrial control system during the current time period.
[0080] It should be noted that the preset quantity is set manually. In this embodiment, the preset quantity is 100. In actual application, as other implementation methods, implementers can also set it according to specific circumstances. This embodiment does not impose any special restrictions.
[0081] It should be noted that there are many commonly used neural networks. In this embodiment, a Bootstrapped DQN network is used for model training. In practical applications, implementers may also use other neural network models such as convolutional neural networks depending on the specific circumstances. This embodiment does not impose any special restrictions.
[0082] Among them, the network based on Bootstrapped DQN is a well-known technology, and its specific operating principle and process will not be elaborated here.
[0083] Thus, this embodiment filters all historical operating data based on the elimination coefficient, retaining only high-quality data samples. Furthermore, it uses these cleaned operating data and their status labels to train a neural network model. Finally, the trained model is applied to real-time data to accurately identify abnormal operating states of industrial control systems, thereby effectively improving the accuracy and reliability of identifying abnormal operating states of industrial control systems.
[0084] Based on the same inventive concept as the above method, this application embodiment also provides an abnormal behavior identification device for an industrial control system. The device stores a computer program, which, when executed by a processor, implements the abnormal behavior identification method for an industrial control system described in any of the above claims.
[0085] Based on the same inventive concept as the above method, this application embodiment also provides an abnormal behavior identification device for an industrial control system, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any one of the above-described methods for identifying abnormal behavior of an industrial control system.
[0086] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, specific embodiments of this specification have been described above. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.
[0087] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.
[0088] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.
Claims
1. A method for identifying abnormal behavior in an industrial control system, characterized in that, The method includes the following steps: Acquire all types of operational data and network traffic data at any acquisition time within preset historical time periods in the industrial control system; Based on the distribution of the differences of each type of operational data between all adjacent acquisition times in each historical period, and the fitting error in the fitting process of each type of operational data, the slowly varying continuous characteristic value under each historical period is determined; based on the correlation between all types of operational data in each historical period, the correlation characteristic value under each historical period is determined, and combined with the slowly varying continuous characteristic value, the first noise interference value under each historical period is determined. Based on the autocorrelation of network traffic data at all collection times within each historical period, the second noise interference value for each historical period is determined, and combined with the first noise interference value, the elimination coefficient for each historical period is determined. Based on the elimination coefficient, all types of operational data in each historical period are eliminated, and the abnormal behavior of the industrial control system is identified based on the operational data after elimination. The first noise interference value for each historical period is the reciprocal of the mean of the normalized value of the slowly varying continuous characteristic value and the normalized value of the correlation characteristic value for each historical period. The second noise interference value for each historical period is the reciprocal of the maximum value of the autocorrelation coefficient of the network traffic data at all collection times within each historical period under all time delays.
2. The abnormal behavior identification method for an industrial control system as described in claim 1, characterized in that, The method for determining the slowly varying continuous eigenvalues for each historical period is as follows: Calculate the sum of the absolute values of all elements in the first-order difference sequence of each type of operational data in each historical period, and denote the reciprocal of the sum as the slowly varying characteristic value of each type of operational data in each historical period; Fitting curves are obtained for each type of operational data in each historical period. The mean of the difference between each type of operational data and the fitted value on its fitted curve is calculated. The reciprocal of the mean is recorded as the continuous characteristic value of each type of operational data in each historical period. Calculate the mean of the normalized value of the slowly varying characteristic value and the mean of the normalized value of the continuous characteristic value for each type of operational data in each historical period, and record it as the comprehensive characteristic value of each type of operational data. Take the mean of the comprehensive characteristic values of all types of operational data in each historical period as the slowly varying continuous characteristic value for each historical period.
3. The abnormal behavior identification method for an industrial control system as described in claim 1, characterized in that, The correlation characteristic value for each historical period is the mean of the absolute values of the correlation coefficients among all types of operational data within each historical period.
4. The abnormal behavior identification method for an industrial control system as described in claim 1, characterized in that, The elimination coefficient for each historical period is the result of the positive fusion of the first noise interference value and the second noise interference value for each historical period.
5. The abnormal behavior identification method for an industrial control system as described in claim 1, characterized in that, The process of removing all types of operational data within each historical period based on the removal coefficient includes: Remove all types of operational data from the first preset number of historical periods from the results of sorting the removal coefficients in descending order.
6. The abnormal behavior identification method for an industrial control system as described in claim 1, characterized in that, The identification of abnormal behavior in the industrial control system based on the eliminated operational data includes: The system acquires the operating status of the industrial control system within all historical time periods and sets labels for the operating status. It uses all types of operating data and corresponding operating status labels from all historical time periods (excluding the remaining historical time periods) as input to the neural network and outputs a trained neural network model. The system takes all types of operational data from the industrial control system during the current time period as input to a trained neural network model and outputs the operational status identification result of the industrial control system during the current time period.
7. An abnormal behavior identification device for an industrial control system, wherein the device stores a computer program, characterized in that, When the computer program is executed by the processor, it implements the abnormal behavior identification method of an industrial control system as described in any one of claims 1-6.
8. An abnormal behavior identification device for an industrial control system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the abnormal behavior identification method for an industrial control system as described in any one of claims 1-6.