An industrial control abnormality detection method and system based on double-path noise adjustment

Abstract

The application belongs to the field of industrial control anomaly detection, and provides an industrial control anomaly detection method and system based on double-path noise adjustment, comprising: obtaining an industrial control data set for preprocessing, converting the preprocessed result into an industrial control embedding representation; performing time distance dependence and data dependence on the industrial control embedding representation in parallel to obtain industrial control coding features; decomposing the industrial control coding features into a trend component and a predicted seasonal component; based on a diffusion-based noise modulation mechanism, processing the predicted seasonal component to obtain a noisy predicted seasonal component; performing multi-cycle fusion reconstruction on the noisy predicted seasonal component and the trend component to obtain industrial control reconstruction data; and based on the anomaly score of the industrial control reconstruction data, obtaining an anomaly detection result. The application can robustly separate non-stationary trend items, effectively alleviate problems caused by distribution offset, enhance the generalization ability of the model on different time period data, and improve the accuracy, robustness and stability of the anomaly detection model.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial control anomaly detection, and particularly relates to an industrial control anomaly detection method and system based on double-path noise adjustment. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute prior art.

[0003] In an industrial control system (ICS), a large number of sensors and actuators continuously generate multi-dimensional time series data, which contains important information about the system's running state. However, the data in real-world scenarios is generally non-stationary, with its distribution changing dynamically over time. This distribution shift makes it difficult for the anomaly detection threshold set on the validation set to effectively generalize to the test data, leading to serious false positives and false negatives, and causing the detection system performance to drop significantly. To deal with the distribution shift caused by non-stationarity, existing technologies mainly explore in two directions: one is based on static statistics, such as independent standardization of each sequence sample through reversible instance normalization, which makes the model focus on learning scale-independent patterns, and then restores the prediction results to the original scale. However, this method relies on pre-computed fixed statistical benchmarks (such as mean and variance) to define the normal behavior boundary. When the data distribution shifts during the inference phase, the static statistics cannot accurately represent the characteristics of the new data, resulting in a sharp decline in detection efficiency. Another advanced method based on decomposition, including D3R, TADNet and TimeMixer++, attempts to decompose the time series into trend and seasonal components to alleviate the distribution shift. The idea is to separate the unstable trend component and model the relatively stable seasonal component. Although this method has made some progress, it still has obvious limitations: the periodic patterns in real industrial environments are often complex and variable, such as daily, quarterly and annual changes, which are not simply superimposed, but overlap and interweave each other. Traditional decomposition models are difficult to effectively decouple these complex and interacting periodic components, thus restricting the accuracy of modeling non-stationary time series.

[0004] In addition, the anomaly detection method also faces key trade-offs when optimizing information bottlenecks. Too strict constraints will hinder the high-quality reconstruction of normal patterns, while too loose constraints may cause the model to learn to accurately reconstruct abnormal points, thereby masking abnormal features and reducing detection sensitivity. SUMMARY

[0005] In order to solve the above problems, the application provides an industrial control abnormality detection method and system based on double-path noise adjustment. First, a double-path attention module is used in the data encoder. The module models time distance dependence and data dependence respectively and generates time sequence representation. Then, a frequency domain enhancement decomposition module is used to obtain frequency domain mapping sequence that can capture important structural features. In combination with a season-trend decomposition module, the module removes the trend component to extract seasonality, thereby solving the distribution deviation problem. In order to cope with the information bottleneck balancing problem, a diffusion-based noise modulation mechanism is introduced to add noise on clean data, actively control and adjust the information bottleneck, and force the model to learn more essential and robust features in the data. Then, multi-period fusion reconstruction converts the features into a two-dimensional space, thereby being able to represent the changes within and between periods and solving the complex time problem caused by multi-period changes. Finally, in order to better identify abnormalities, a two-stage adversarial optimization strategy is used to minimize the reconstruction error while maximizing the dependence difference between normal points and abnormal points in the two dependence relationships, thereby realizing efficient abnormality detection on non-stationary sequence data.

[0006] According to some embodiments, the first aspect of the application provides an industrial control abnormality detection method based on double-path noise adjustment, which adopts the following technical solutions:

[0007] An industrial control abnormality detection method based on double-path noise adjustment comprises the following steps:

[0008] An industrial control data set is obtained and preprocessed, and the preprocessed result is converted into an industrial control embedding representation;

[0009] Based on the industrial control embedding representation, an abnormality detection model is trained to perform abnormality detection, and an abnormality detection result is obtained, comprising:

[0010] The industrial control embedding representation is subjected to time distance dependence and data dependence in parallel to obtain industrial control coding features;

[0011] The industrial control coding features are decomposed into a trend component and a predicted seasonal component;

[0012] A diffusion-based noise modulation mechanism is used to process the predicted seasonal component to obtain a noisy predicted seasonal component;

[0013] The noisy predicted seasonal component and the trend component are subjected to multi-period fusion reconstruction to obtain industrial control reconstruction data;

[0014] Based on the abnormality score of the industrial control reconstruction data, an abnormality detection result is obtained.

[0015] Further, the industrial control embedding representation is subjected to time distance dependence and data dependence in parallel to obtain industrial control coding features, comprising:

[0016] The industrial control embedding is processed by using a feedforward layer to obtain an output of the feedforward fully connected layer;

[0017] The output of the feedforward fully connected layer is processed by using a dual-path attention module to obtain an industrial control coding feature.

[0018] Further, the industrial control coding feature is decomposed into a trend component and a predicted seasonal component, including:

[0019] The industrial control coding feature is subjected to frequency domain enhancement, and a multiplexing tensor is obtained by converting from a time domain to a frequency domain. The multiplexing tensor is compressed and then subjected to cross-channel frequency filtering. The filtered result is reconstructed into a time domain signal to obtain an industrial control enhanced feature of a first layer;

[0020] The industrial control enhanced feature of the first layer is subjected to season-trend decomposition to obtain an original seasonal component, a trend component and a predicted seasonal component of the first layer;

[0021] The original seasonal component of the first layer is subjected to frequency domain enhancement and season-trend decomposition in sequence to obtain an original seasonal component, a trend component and a predicted seasonal component of a second layer;

[0022] By analogy, until the trend component and the predicted seasonal component of the last layer are obtained.

[0023] Further, the original seasonal component of the first layer is subjected to frequency domain enhancement and season-trend decomposition in sequence to obtain an original seasonal component, a trend component and a predicted seasonal component of a second layer, including:

[0024] The original seasonal component of the first layer is subjected to frequency domain enhancement by using a frequency domain enhancement module, and a multiplexing tensor is obtained by converting from a time domain to a frequency domain. The multiplexing tensor is compressed and then subjected to cross-channel frequency filtering. The filtered result is reconstructed into a time domain signal to obtain an industrial control enhanced feature of a second layer;

[0025] The industrial control enhanced feature of the second layer is decomposed by using a season-trend decomposition module to obtain an original trend component and an original seasonal component of a first decomposition block of the second layer;

[0026] The original seasonal component of the first decomposition block of the second layer is processed according to the feedforward fully connected layer, and the output of the feedforward fully connected layer is decomposed by using the season-trend decomposition module to obtain an original trend component and an original seasonal component of a second decomposition block of the second layer. The original seasonal component of the second decomposition block of the second layer is taken as the original seasonal component of the second layer;

[0027] After the original seasonal component of the second layer is subjected to linear processing, a predicted seasonal component of the second layer is obtained;

[0028] The trend component of the second layer is obtained by weighting the trend component of the first layer, the original trend component of the first decomposition block of the first layer, and the original trend component of the second decomposition block of the first layer.

[0029] Further, the noisy predicted seasonal component and the trend component are fused and reconstructed in multiple periods to obtain the industrial control reconstruction data, including:

[0030] The amplitude of the noisy predicted seasonal component is obtained, the frequency of the estimated period is selected according to the amplitude, the estimated period is obtained based on the estimated frequency, the noisy predicted seasonal component is converted into a two-dimensional space by using the estimated period, and a plurality of two-dimensional predicted seasonal components of multiple periods are obtained;

[0031] The plurality of one-dimensional seasonal components of multiple periods are aggregated based on the amplitude to obtain a one-dimensional aggregated seasonal component.

[0032] The one-dimensional aggregated seasonal component and the trend component are fused by weighting to obtain the industrial control reconstruction data.

[0033] Further, based on the anomaly score of the industrial control reconstruction data, an anomaly detection result is obtained, including:

[0034] The anomaly score of the industrial control reconstruction data is calculated.

[0035] If the anomaly score exceeds a preset score threshold, an anomaly detection result is obtained.

[0036] Otherwise, a normal detection result is obtained.

[0037] According to some embodiments, the second aspect of the present application provides an industrial control anomaly detection system based on double-path noise adjustment, which adopts the following technical solutions:

[0038] An industrial control anomaly detection system based on double-path noise adjustment, including:

[0039] A data preprocessing module configured to obtain an industrial control data set for preprocessing, and convert the preprocessed result into an industrial control embedding representation;

[0040] An anomaly detection module configured to perform anomaly detection based on the industrial control embedding representation by using a trained anomaly detection model to obtain an anomaly detection result, including:

[0041] The industrial control embedding representation is subjected to time distance dependence and data dependence in parallel to obtain an industrial control coding feature;

[0042] The industrial control coding feature is decomposed into a trend component and a predicted seasonal component;

[0043] The prediction seasonal component is processed based on a diffusion-based noise modulation mechanism to obtain a noisy prediction seasonal component;

[0044] The noisy prediction seasonal component is fused with the trend component in multiple periods to reconstruct industrial control reconstruction data.

[0045] Anomaly scores based on the industrial control reconstruction data are obtained to obtain an anomaly detection result.

[0046] According to some embodiments, a third aspect of the present application provides a computer readable storage medium.

[0047] A computer readable storage medium has a computer program stored thereon, and the program is executed by a processor to implement the steps of the industrial control anomaly detection method based on double-path noise adjustment according to the first aspect.

[0048] According to some embodiments, a fourth aspect of the present application provides a computer device.

[0049] A computer device includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor executes the program to implement the steps of the industrial control anomaly detection method based on double-path noise adjustment according to the first aspect.

[0050] According to some embodiments, a fifth aspect of the present application provides a computer program product or computer program.

[0051] A computer program product or computer program includes computer instructions stored in a computer readable storage medium, and a processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the steps of the industrial control anomaly detection method based on double-path noise adjustment according to the first aspect.

[0052] Compared with the prior art, the present application has the following beneficial effects:

[0053] The frequency domain enhancement decomposition module can robustly separate the non-stationary trend item, effectively alleviate the problem caused by distribution deviation, and enhance the generalization ability of the model on different time period data.

[0054] The present application adopts multi-period fusion reconstruction to map one-dimensional time series to two-dimensional space, which can capture changes within and between periods at the same time, and effectively solve the overlapping and interactive periodicity problem that traditional methods cannot handle.

[0055] The application introduces a diffusion-based noise modulation mechanism, controls noise to actively create and adjust information bottlenecks, forces the model to learn the essence distribution of normal data, and solves the problem of information bottleneck trade-off.

[0056] The application introduces a double-path attention module and a double-stage adversarial optimization strategy, takes the difference between time distance dependence and data dependence as a new loss, and expands the dependence difference between normal points and abnormal points through training, greatly enhances the recognition of the model to the abnormal, and improves the sensitivity and accuracy of detection. BRIEF DESCRIPTION OF DRAWINGS

[0057] The drawings accompanying the specification of the application form a part of the application and serve to further understand the application, the illustrative embodiments of the application and the description thereof are used to explain the application, and do not constitute an improper limitation on the application.

[0058] Figure 1 The whole flow chart of the industrial control abnormality detection method based on double-path noise adjustment in the embodiment of the application is shown in the figure.

[0059] Figure 2 The whole framework chart of the industrial control abnormality detection method based on double-path noise adjustment in the embodiment of the application is shown in the figure.

[0060] Figure 3 The comparison result diagram of F1 score of the abnormality detection model in the embodiment of the application on multiple multi-dimensional time series data sets and the most advanced method is shown in the figure. DETAILED DESCRIPTION

[0061] The application will be further described below in combination with the drawings and embodiments.

[0062] It should be pointed out that the following detailed description is exemplary and is intended to provide further description of the application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as generally understood by those skilled in the art to which the application belongs.

[0063] It should be noted that the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the exemplary embodiments according to the application. As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise, and furthermore, it should be understood that when the terms "comprise" and / or "include" are used in the specification, there is a feature, step, operation, device, component and / or combination thereof.

[0064] The embodiments in the application and the features in the embodiments can be combined with each other without conflict.

[0065] Term explanation:

[0066] 1. Non-stationarity: refers to the property that the key statistical characteristics (e.g., mean, variance) of a time series change over time. This is one of the main reasons why traditional anomaly detection models fail in real-world applications.

[0067] 2. Overlapping and interacting periodicity: refers to the phenomenon that real-world time series are often driven by multiple periodic patterns that overlap and interact with each other, which is difficult for traditional decomposition methods to handle.

[0068] 3. Dependence disparity: refers to the difference between the local dependence based on temporal proximity and the global dependence based on data content in a time series.

[0069] 4. Two-stage adversarial optimization: an innovative training strategy that sharpens the model's sensitivity to abnormal signals without compromising its ability to reconstruct normal patterns through two adversarial stages: "parameter adaptation" and "disparity enhancement".

[0070] 5. Noise regulation: through a variance scheduling strategy determined by the hyperparameter β, the noise injection intensity in the forward diffusion process is precisely regulated, thereby constructing an information bottleneck constraint, forcing the model to focus on key semantic features while filtering out redundant disturbances.

[0071] As the background art says, in industrial control systems, the core dilemma of anomaly detection arises from the fact that sensor and actuator data often exhibit dynamic changes in data distribution over time. This distribution shift makes traditional methods that rely on fixed statistical benchmarks (such as mean and variance) quickly ineffective in real-world applications, as the pre-set normal boundaries cannot adapt to new data characteristics, resulting in a sharp decline in generalization ability and frequent false positives and false negatives. Although more advanced decomposition methods attempt to address this problem by separating trends and seasonality, they still struggle to effectively decouple complex periodic patterns that overlap and interact with each other in the real world (the intertwined effects of daily, seasonal, and annual changes), thus still not fully modeling non-stationarity. The deeper problem is that model optimization itself is trapped in an information bottleneck trade-off dilemma: too strict a constraint will hinder the model's complete reconstruction of normal patterns, while too loose a constraint may make the model so powerful that it can accurately reconstruct even abnormal points, ultimately making it ineffective for detection. Therefore, the entire field faces problems such as poor generalization ability due to distribution shift, difficulty in effectively modeling overlapping and interacting periodicity, and difficulty in information bottleneck trade-off when dealing with non-stationary data. The present invention aims to solve the problems of poor generalization ability due to distribution shift, difficulty in effectively modeling overlapping and interacting periodicity, and difficulty in information bottleneck trade-off when existing anomaly detection methods deal with non-stationary data, with the goal of improving the accuracy, robustness, and stability of anomaly detection models.

[0072] Embodiment one

[0073] The embodiment provides an industrial control anomaly detection method based on double-path noise adjustment. The embodiment takes the method applied to a server as an example. It can be understood that the method can also be applied to a terminal and can also be applied to a system including a terminal and a server and is realized through interaction of the terminal and the server. The server can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network server, cloud communication, middleware service, domain name service, security service CDN, and big data and artificial intelligence platform. The terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, and the like, but is not limited thereto. The terminal and the server can be directly or indirectly connected through wired or wireless communication, which is not limited in the present application. In the embodiment, the method includes the following steps:

[0074] Step S1: obtaining an industrial control data set for preprocessing, and converting the preprocessed result into an industrial control embedding representation;

[0075] Step S2: based on the industrial control embedding representation, using a trained anomaly detection model to perform anomaly detection to obtain an anomaly detection result, including:

[0076] Step S2.1: performing time distance dependence and data dependence on the industrial control embedding representation in parallel to obtain an industrial control coding feature;

[0077] Step S2.2: decomposing the industrial control coding feature into a trend component and a predicted seasonal component;

[0078] Step S2.3: based on a diffusion-based noise modulation mechanism, processing the predicted seasonal component to obtain a noisy predicted seasonal component;

[0079] Step S2.4: multi-cycle fusion reconstruction of the noisy predicted seasonal component and the trend component to obtain industrial control reconstruction data;

[0080] Step S2.5: obtaining an anomaly detection result based on an anomaly score of the industrial control reconstruction data.

[0081] Specifically, as shown in Figure 1 and Figure 2 , the detailed process of the method described in the embodiment is as follows:

[0082] Step S1: obtaining an industrial control data set and preprocessing, and converting the preprocessed result into an industrial control embedding representation;

[0083] Step S1.1: data preprocessing, obtaining an industrial control data set and preprocessing to obtain a preprocessed result.

[0084] Suppose in an industrial control system, define an industrial control dataset represents devices and the total length of time steps The measured device values obtained above, wherein the devices include sensors and actuators. Using traditional preprocessing methods, the industrial control dataset is preprocessed to obtain the preprocessed results . is the measurement value at time step , represents the preprocessed results of the th variable at time step . For the seasonal component, the trend term is extracted and removed from the original sequence to construct the true seasonal component , . This construction method can prevent the model from being disturbed by non-stationary data.

[0085] When training the anomaly detection model, the preprocessed results are segmented: according to the ratio of 8:2, into training set Dtrain and test set Dtest.

[0086] Step S1.2: Convert the preprocessed results into industrial control embedding representation based on position encoding and numerical encoding methods; convert the preprocessed results into industrial control embedding representation , , is the hidden dimension size, is the embedding layer;

[0087] Step S2: Based on the industrial control embedding representation, use the trained anomaly detection model to perform anomaly detection to obtain the anomaly detection results, the process is as follows:

[0088] Step S2.1: Perform time distance dependence and data dependence on the industrial control embedding representation in parallel to obtain industrial control coding features, including:

[0089] Use the feedforward layer to process the industrial control embedding representation to obtain the output of the feedforward fully connected layer;

[0090] Use the dual-path attention module to perform time distance dependence and data dependence on the output of the feedforward fully connected layer in parallel to obtain the industrial control coding features.

[0091] This step is to use a data encoder to encode the industrial control embedding representation, and the dual-path attention module is built in the data encoder to model the time distance dependence and data dependence in parallel;

[0092] The data encoder has Each layer is implemented using a dual-path attention module and a feedforward fully connected layer. This hierarchical stacked structure can learn latent dependencies from deep, multi-scale features. The calculation formula for the feedforward layer is as follows:

[0093] (1);

[0094] in, Indicates the data encoder's first... The output of the feedforward fully connected layer in the layer, Indicates the data encoder's first... The output of the feedforward fully connected layer in the layer, Indicates the data encoder's first... Hidden states of feedforward fully connected layers in a layer; It is a dual-path attention module. It is a feedforward fully connected layer. It is layer normalization.

[0095] The dual-path attention module consists of the following two branches:

[0096] The time-distance dependency modeling branch employs a learnable Gaussian kernel, which naturally focuses on local regions and includes a scale parameter. To adapt to diverse time patterns.

[0097] The data dependency modeling branch uses a standard self-attention mechanism to learn data-driven global dependencies from the original sequence.

[0098] These two branches encode temporal local dependencies and data-driven global dependencies, respectively. The difference between them characterizes the contrast between local and global dependencies. Because outliers are sparsity-oriented and tend to depend on neighboring points, they are difficult to form strong data dependencies with the entire sequence; therefore, the difference between the two types of dependencies is small. (Data encoder, ...) The anomaly attention mechanism of the dual-path attention module in the layer is defined as follows:

[0099] (2);

[0100] in, It consists of queries, keys, and values. It is a scale parameter. These are three sets of learnable linear projection parameters used to project the input features. Map to the required ; It is the current time step. The remaining time steps, It is the total length of time step. It is the data encoder number The temporal distance dependency output by the dual-path attention module in the layer is determined by analyzing the time step. Using Gaussian kernel function according to With any time step time interval Calculate weights Then, after row-by-row normalization, the result was obtained, among which... The scale parameter controls the width of the area of ​​interest. The larger the value, the more weight distant points will receive. The smaller the value, the more concentrated the weight is on neighboring points. It is a normalization function, the purpose of which is to normalize the weight matrix obtained by the Gaussian kernel row by row (each row is divided by the row sum), so that each row becomes a probability distribution with a sum of 1; It is the data encoder number The data dependencies output by the dual-path attention module in the layer are obtained by performing Softmax normalization along the last dimension. Both of these dependencies will be used in subsequent adversarial optimization. Indicates the data encoder's first... The hidden representation output by the dual-path attention module in the layer.

[0101] Data encoders have layer, It is the first The hidden representation of the layer's output is the industrial control coding feature.

[0102] Step S2.2: Decompose the industrial control coding features into trend components and predicted seasonality components, including:

[0103] The industrial control coding features are enhanced in the frequency domain. The multiplexing tensor is obtained by converting from the time domain to the frequency domain. The multiplexing tensor is compressed and then filtered across the channel frequency. The filtered result is reconstructed into a time domain signal to obtain the first layer of industrial control enhancement features.

[0104] Seasonal-trend decomposition is performed on the first layer of industrial control enhancement features to obtain the original seasonal component, trend component and predicted seasonal component of the first layer.

[0105] The original seasonal components of the first layer are sequentially subjected to frequency domain enhancement and seasonal-trend decomposition to obtain the original seasonal components, trend components and predicted seasonal components of the second layer.

[0106] This process continues until the trend component and predicted seasonal component of the final layer are obtained.

[0107] Specifically, the original seasonal components of the first layer are sequentially subjected to frequency domain enhancement and seasonal-trend decomposition to obtain the original seasonal components, trend components, and predicted seasonal components of the second layer, including:

[0108] The original seasonal components of the first layer are enhanced in the frequency domain using the frequency domain enhancement module. The multiplexed tensor is obtained by converting from the time domain to the frequency domain. The multiplexed tensor is compressed and then filtered across the channel frequency. The filtered result is reconstructed into a time domain signal to obtain the industrial control enhancement features of the second layer.

[0109] The seasonal-trend decomposition module is used to decompose the industrial control enhancement features of the second layer to obtain the original trend component and the original seasonal component of the first decomposition block of the second layer.

[0110] The original seasonal components of the first decomposition block of the second layer are processed by the feedforward fully connected layer, and then the output of the feedforward fully connected layer is decomposed by the seasonal-trend decomposition module to obtain the original trend components and original seasonal components of the second decomposition block of the second layer. The original seasonal components of the second decomposition block of the second layer are used as the original seasonal components of the second layer.

[0111] After linear processing of the original seasonal components of the second layer, the predicted seasonal components of the second layer are obtained.

[0112] The trend components of the second layer are obtained by weighting the trend components of the first layer, the original trend components of the first decomposition block of the first layer, and the original trend components of the second decomposition block of the first layer.

[0113] This step uses the frequency domain enhancement module within the frequency domain enhancement decomposition module to obtain a frequency domain mapping sequence capable of capturing important structural features. It then combines this with the seasonal-trend decomposition module within the frequency domain enhancement decomposition module. This seasonal component is extracted by removing the trend, thus resolving the distribution shift problem. The frequency domain enhancement decomposition module comprises... layer.

[0114] Based on industrial control coding characteristics The input is then fed into the frequency domain enhancement decomposition module to obtain the trend component and the predicted seasonal component. The process is as follows:

[0115] The trend component is generated through multiple weighted fusions, rather than a single separate calculation. This allows for the capture of deeper and more nuanced features. This process can be defined as follows:

[0116] (3);

[0117] in, The frequency domain enhancement decomposition module is represented by the first... The first in the layer Seasonal components of each decomposition block The frequency domain enhancement decomposition module is represented by the first... The first in the layer Trend components of each decomposition block , These are linear transformation parameters used to weight and synthesize the final trend term. It is the final generated trend component. It is an intermediate variable representing the seasonal component of the last decomposition block. It is a single-layer linear layer. It predicts the seasonal component, FEB ( This is the frequency domain enhancement module. It is a seasonal-trend decomposition module. It is a feedforward fully connected layer. Ultimately, the stable components are generated through all the stacked decomposition blocks.

[0118] Taking industrial control coding features as the input to the frequency domain enhancement decomposition module as an example, the working process of the frequency domain enhancement module FEB is explained. Figure 2 As shown, it includes:

[0119] Industrial control coding characteristics By converting from the time domain to the frequency domain using the discrete Fourier transform, a complex tensor is obtained. , It is the Discrete Fourier Transform function.

[0120] To reduce computational complexity and focus on key frequency components, a selection operator will... Randomly reserved in each frequency domain mode Each dominant pattern generates a compressed frequency representation. Subsequently, a parameterized three-dimensional complex kernel was used. Cross-channel frequency filtering is performed, a process defined by element-wise multiplication and summation, as shown in the following formula:

[0121] (4);

[0122] in, , and These represent the indices of the input channel, output channel, and frequency mode, respectively. The filtered result... Restored to the original dimension by zero-padding. Then through inverse Fourier transform The signal is reconstructed into a time-domain signal, and the final output is the enhanced feature, i.e., the industrial control enhancement feature. This design preserves the global temporal periodic patterns while achieving cross-channel interactions by frequency-selective filtering and parametric kernel learning, and its final output is fused with the original time-domain signal through inverse transformation and residual connection.

[0123] Correspondingly, the working process of the Season-Trend Decomp module, the core mechanism of which contains two parts:

[0124] (1) A multi-scale average pooling filter bank which extracts multiple potential trend components from the input signal using varying window sizes;

[0125] (2) A data-driven dynamic weight generation network for adaptively fusing these components.

[0126] This process can be formally represented as:

[0127] (5);

[0128] where denotes a set of average pooling operations with multiple window sizes, is a weight coefficient matrix generated based on the enhanced features of the industrial control. After normalization by Softmax, it adaptively fuses each trend component through weighted summation. The final output is the refined trend representation . By separating this trend representation, the seasonal component is obtained.

[0129] Step S2.3: Based on the diffusion-based noise modulation mechanism, the predicted seasonal component is processed to obtain the noisy predicted seasonal component, including:

[0130] First, to address the information bottleneck trade-off problem, a diffusion-based noise modulation mechanism is introduced to add noise to clean data, forcing the model to learn more essential and robust features in the data. Next, the multi-period fusion reconstruction module converts the features into a two-dimensional space, enabling simultaneous representation of intra-period and inter-period changes to address complex temporal problems caused by multi-period changes.

[0131] Noise injection is used as a bottleneck control mechanism to add noise to the extracted seasonal component based on diffusion theory, optimizing the information bottleneck and forcing the model to focus on important features.

[0132] Starting from the predicted seasonal component , Gaussian noise is sequentially added through steps to generate a series of damaged data . In this process, the state of each step only depends on the state of the previous step , and the strength of the noise added at each step is controlled by a hyperparameter .

[0133] Based on the diffusion-based noise modulation mechanism, the noisy data is generated after the seasonal component is damaged by steps of noise:

[0134] (6);

[0135] where is the proportion of the predicted seasonal component, is the proportion of the noise, is the hyperparameter of step , and represents the noise term. .

[0136] The noisy data is converted into a noisy embedding representation to obtain a noisy predicted seasonal component . The process can be represented as:

[0137] (8);

[0138] where represents the embedding network.

[0139] Step S2.4: The noisy predicted seasonal component is fused and reconstructed with the trend component to obtain the industrial control reconstruction data, including:

[0140] The amplitude of the noisy predicted seasonal component is obtained, the frequency of the estimated period is selected according to the amplitude, the estimated period is obtained based on the estimated frequency, and the noisy predicted seasonal component is converted into a two-dimensional space using the estimated period to obtain a plurality of two-dimensional predicted seasonal components of the period.

[0141] The plurality of two-dimensional predicted seasonal components of the period are converted into one-dimensional seasonal components, and the plurality of one-dimensional seasonal components are aggregated based on the amplitude to obtain a one-dimensional aggregated seasonal component.

[0142] The one-dimensional aggregated seasonal component is fused with the trend component to obtain the industrial control reconstruction data.

[0143] This step is to capture two-dimensional time series using a multi-period fusion reconstruction module, which has layers. Based on the estimated period, the one-dimensional time series is converted into a two-dimensional space.

[0144] The noisy predicted seasonal component As the initial input of the multi-cycle fusion reconstruction module The amplitude of the noisy predicted seasonal component is obtained, the frequency of the estimation period is selected based on the amplitude, the estimation period is obtained based on the frequency of the estimation period, and the noisy predicted seasonal component is transformed into a two-dimensional space using the estimation period to obtain two-dimensional predicted seasonal components with multiple periods. This process can be represented as:

[0145] (9);

[0146] in, Indicates Fourier transform, Indicates the calculation of amplitude value. This indicates the operation of averaging. To represent one dimension, Representing two dimensions, Indicates the number of time steps. Indicates the first An estimated cycle length. This indicates the multi-cycle fusion reconstruction module. The amplitude of each frequency in the layer is determined by... function pairs The average of the dimensions is obtained. Indicates the frequency as The amplitude and corresponding period length Considering the sparsity of the spectrum and to avoid meaningless high-frequency noise, only the top-k frequencies with the highest amplitudes are selected, thus obtaining the set of frequencies with the most significant estimated period. , It is a hyperparameter, and these frequencies correspond to estimated period length .

[0147] Efficiently using a single parameter , This represents a multi-branch, multi-scale feature extraction network for predicting seasonal components in two dimensions. Perform convolution operations to obtain two-dimensional seasonal components. The two-dimensional seasonal components are then transformed back into one-dimensional space for aggregation to obtain the one-dimensional seasonal components. This process can be represented as:

[0148] (10);

[0149] in, Convert it back from two-dimensional data to one-dimensional data.

[0150] Based on amplitude fusion, A different one-dimensional seasonal component The one-dimensional seasonal components are fused to obtain the input of the next layer. The amplitudes reflect the relative importance of the selected frequencies and periods, and thus can be used as the weights of each transformed two-dimensional tensor. Therefore, the one-dimensional seasonal components are aggregated based on the amplitudes, and the formula is as follows:

[0151] (11);

[0152] The final output is obtained by adding the two decomposed components to obtain the industrial control reconstruction data, as follows:

[0153] (12);

[0154] wherein, is the industrial control reconstruction data, represents the hidden layer output of the last layer, i.e., the aggregated one-dimensional seasonal components of the last layer, is a linear transformation parameter that projects to the target dimension.

[0155] Step S2.5: Based on the anomaly score of the industrial control reconstruction data, an anomaly detection result is obtained, including:

[0156] The anomaly score of the industrial control reconstruction data is calculated;

[0157] If the anomaly score exceeds a preset score threshold, an anomaly detection result is obtained;

[0158] Otherwise, a normal detection result is obtained.

[0159] The anomaly detection model of the embodiment adopts a two-stage adversarial optimization strategy during training. The strategy first calculates the reconstruction error, which includes the seasonal component reconstruction error and the reconstruction error of the original data, and the dependence difference, and then combines them into the final loss. Finally, through the two adversarial stages of parameter self-adaptation and difference enhancement, the dependence difference between normal points and abnormal points is maximized without losing the reconstruction ability of normal modes. Thus, the anomaly score between normal points and abnormal points is expanded, making it easier to identify anomalies. Anomaly detection is to calculate the anomaly score, set a score threshold, and determine whether the data is abnormal by comparing the size of the anomaly score and the score threshold.

[0160] The frequency domain enhancement decomposition module obtains the predicted seasonal components from the non-stationary time series data , and the multi-period fusion reconstruction module reconstructs the data contaminated by the diffusion process, and the final industrial control reconstruction data is .

[0161] The total reconstruction loss function is the weighted sum of the optimization objectives of the frequency domain enhancement decomposition module and the multi-period fusion reconstruction module:

[0162] (13);

[0163] wherein, is the reconstruction loss and denote the true and predicted stable components of the th variable at the th time step, and represent the pre-processed results and reconstruction outputs of the same variable and time step.

[0164] The symmetric KL divergence is used to quantify the difference between the temporal distance dependency and the data dependency, and the point-wise dependency difference is obtained by averaging over all layers:

[0165] (14);

[0166] wherein, , is the number of time steps, computes the row-wise KL divergence between the discrete distribution (temporal distance dependency) and (data dependency). denotes the sequence the point-wise dependency difference between layers, and are the temporal distance dependency and data dependency of each layer, and are the temporal distance dependency and data dependency of all layers taken together.

[0167] The total loss is thus obtained as:

[0168] (15);

[0169] wherein, is the total loss, is a scaling factor, is the L1 norm, which denotes the sum of absolute values of all elements.

[0170] The two-stage adversarial optimization training is performed, which includes a parameter adaptation stage and a difference enhancement stage;

[0171] In the parameter adaptation stage, the separated gradient) is fixed, and the is optimized to approximate the :

[0172] (16);

[0173] where, is the parameter adaptation loss, represents the fixed .

[0174] the difference enhancement stage, the fixed (separated gradients) and optimized to expand diversity, encourage the model to focus on longer period dependencies:

[0175] (17);

[0176] where, is the difference enhancement loss, is the fixed .

[0177] Through training, the difference between the global data dependency and the local temporal distance dependency of normal points is significantly amplified. In contrast, for abnormal points, both dependencies exhibit locality, and the training process cannot expand the difference between them. Ultimately, the dependency difference between normal points and abnormal points is amplified.

[0178] Step 4: Constructing the anomaly score, for , the point-by-point anomaly score is calculated as follows:

[0179] (18);

[0180] where, represents element-wise multiplication, is the square of the L2 norm, representing the sum of squared errors. is the pre-processed result and the reconstructed output; is the true stable component and the predicted stable component. This design combines reconstruction error and dependency difference.

[0181] Finally, the test set is evaluated according to the anomaly score and the preset score threshold , the score threshold is generally determined by the anomaly score of the training set, the training set anomaly score is sorted from low to high, and the anomaly score at the pre-set abnormal proportion position is taken as the score threshold for evaluation. When the score exceeds the score threshold, an anomaly is detected, thus obtaining the result label set of all time steps in the industrial control data set , as follows:

[0182] (19);

[0183] where, represents the final decision result of the anomaly detection model at each time step, 1 represents abnormality, and 0 represents normality.

[0184] As Figure 3 shown, on the SWaT dataset, the learning rate is set to 0.0001, and the number of training rounds is 2.

[0185] The test results of the anomaly detection model (ADTCDA) on the validation set are: accuracy (precision) 94.84; recall 100.00; F1 score 97.35. Compared with the current advanced detection algorithm Anomaly Transformer, it has improved by 3.32%. Compared with the current advanced detection algorithm Anomaly TimeMixer++, it has improved by 2.86%.

[0186] On the MSL dataset, the learning rate is set to 0.0001, and the number of training rounds is 2.

[0187] The test results of the anomaly detection model on the validation set are: accuracy (precision) 92.21; recall 97.80; F1 score 94.92. Compared with the current advanced detection algorithm Anomaly Transformer, it has improved by 1.42%. Compared with the current advanced detection algorithm Anomaly TimeMixer++, it has improved by 10.60%.

[0188] On the SMAP dataset, the learning rate is set to 0.0001, and the number of training rounds is 2.

[0189] The test results of the anomaly detection model on the validation set are: accuracy (precision) 98.01; recall 96.70; F1 score 97.35. Compared with the current advanced detection algorithm Anomaly Transformer, it has improved by 0.76%. Compared with the current advanced detection algorithm Anomaly TimeMixer++, it has improved by 33.17%.

[0190] On the PSM dataset, the learning rate is set to 0.0001, and the number of training rounds is 2.

[0191] The test results of the anomaly detection model on the validation set are: accuracy (precision) 98.40; recall 98.27; F1 score 98.34. Compared with the current advanced detection algorithm anomaly Transformer, it achieves a 0.99% improvement. Compared with the current advanced detection algorithm anomaly TimeMixer++, it achieves a 0.76% improvement.

[0192] Embodiment two

[0193] The embodiment provides an industrial control anomaly detection system based on a double-path noise adjustment, comprising:

[0194] A data preprocessing module configured to obtain an industrial control dataset for preprocessing, and convert the preprocessed result into an industrial control embedding representation;

[0195] An anomaly detection module configured to perform anomaly detection based on the industrial control embedding representation using a trained anomaly detection model to obtain an anomaly detection result, comprising:

[0196] Parallelly performing time distance dependence and data dependence on the industrial control embedding representation to obtain an industrial control coding feature;

[0197] Decomposing the industrial control coding feature into a trend component and a predicted seasonal component;

[0198] Based on a diffusion-based noise modulation mechanism, the predicted seasonal component is processed to obtain a noisy predicted seasonal component;

[0199] The noisy predicted seasonal component and the trend component are fused and reconstructed for multiple periods to obtain industrial control reconstruction data;

[0200] Based on the anomaly score of the industrial control reconstruction data, an anomaly detection result is obtained.

[0201] The above modules and the corresponding steps achieve the same examples and application scenarios, but are not limited to the content disclosed in the above embodiment one. It should be noted that the above modules as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0202] The descriptions of various embodiments in the above embodiments have different focuses, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0203] The proposed system can be implemented in other manners. For example, the system embodiments described above are merely exemplary. Referring to the division of the modules, the division is merely a logical function division. There can be another division manner for the actual implementation. For example, multiple modules or features can be combined or integrated into another system, or some features can be ignored or not executed.

[0204] Embodiment three

[0205] The embodiment provides a computer readable storage medium, which stores a computer program. The program is executed by a processor to implement steps of the industrial control abnormality detection method based on double-path noise adjustment in the embodiment one.

[0206] Embodiment four

[0207] The embodiment provides a computer device, which includes a memory, a processor and a computer program stored in the memory and executable on the processor. The processor implements steps of the industrial control abnormality detection method based on double-path noise adjustment in the embodiment one when executing the program.

[0208] Embodiment five

[0209] The embodiment provides a computer program product or a computer program, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium. The processor executes the computer instructions, so that the computer device executes steps of the industrial control abnormality detection method based on double-path noise adjustment in the embodiment one.

[0210] Those skilled in the art should understand that the embodiments of the present application can provide methods, systems or computer program products. Therefore, the present application can take the form of hardware embodiments, software embodiments or embodiments combining software and hardware aspects. In addition, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer usable program code.

[0211] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams and the combination of the flows and / or blocks can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device for implementing the functions described in the flowcharts and / or block diagrams. The computer program instructions can also be stored in a computer readable storage medium that can guide the computer or other programmable data processing devices to work. The computer readable storage medium includes various types of memories, such as a semiconductor memory device, a disc memory, a compact disc memory, and the like.Figure 1 one or more processes and / or blocks Figure 1 an apparatus for performing the functions specified in the flowchart

[0212] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart Figure 1 one or more processes and / or blocks Figure 1 an apparatus for performing the functions specified in the flowchart

[0213] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart Figure 1 one or more processes and / or blocks Figure 1 an apparatus for performing the functions specified in the flowchart

[0214] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by computer programs instructing relevant hardware, and the programs can be stored in a computer-readable storage medium. When the programs are executed, they can include the processes of the above-mentioned embodiment methods. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), or the like.

[0215] Although the specific embodiments of the present application are described above with reference to the drawings, the description is not a limitation on the scope of protection of the present application. Those of ordinary skill in the art should understand that various modifications or variations can be made to the technical solutions of the present application without creative labor, and these modifications or variations are still within the scope of protection of the present application.

Claims

1. A method for detecting industrial control abnormality based on double-path noise adjustment, characterized in that, The method comprises the following steps: obtaining an industrial control dataset for preprocessing, and converting the preprocessed result into an industrial control embedding representation; based on the industrial control embedding representation, using a trained anomaly detection model for anomaly detection to obtain an anomaly detection result, comprising: parallel time distance dependence and data dependence are performed on the industrial control embedding representation to obtain an industrial control coding feature; the industrial control coding feature is decomposed into a trend component and a predicted seasonal component; based on the diffusion noise modulation mechanism, the predicted seasonal component is processed to obtain a noisy predicted seasonal component; the noisy predicted seasonal component and the trend component are fused and reconstructed in multiple cycles to obtain industrial control reconstruction data, comprising: obtain the amplitude of the noisy predicted seasonal component, select the frequency of the estimated period according to the amplitude, obtain the estimated period based on the estimated period, and convert the noisy predicted seasonal component to a two-dimensional space using the estimated period to obtain multiple two-dimensional predicted seasonal components; one-dimensional conversion is performed on the multiple two-dimensional predicted seasonal components to obtain multiple one-dimensional seasonal components, and the multiple one-dimensional seasonal components are aggregated based on the amplitude to obtain a one-dimensional aggregated seasonal component; the one-dimensional aggregated seasonal component and the trend component are weighted and fused to obtain the industrial control reconstruction data; based on the anomaly score of the industrial control reconstruction data, the anomaly detection result is obtained.

2. The method according to claim 1, wherein the method comprises: parallel time distance dependence and data dependence are performed on the industrial control embedding representation to obtain an industrial control coding feature, comprising: the industrial control embedding representation is processed using a feedforward layer to obtain the output of the feedforward fully connected layer; the output of the feedforward fully connected layer is parallelly processed using a double-path attention module to obtain time distance dependence and data dependence, and the industrial control coding feature is obtained.

3. The method according to claim 1, wherein the method comprises: the industrial control coding feature is decomposed into a trend component and a predicted seasonal component, comprising: the industrial control coding feature is enhanced in the frequency domain, and the complex tensor is obtained by converting from the time domain to the frequency domain, the complex tensor is compressed and then cross-channel frequency filtering is performed, the filtered result is reconstructed into a time domain signal, and the industrial control enhanced feature of the first layer is obtained; seasonal-trend decomposition is performed on the industrial control enhanced feature of the first layer to obtain the original seasonal component, the trend component and the predicted seasonal component of the first layer; the original seasonal component of the first layer is sequentially subjected to frequency domain enhancement and seasonal-trend decomposition to obtain the original seasonal component, the trend component and the predicted seasonal component of the second layer; by analogy, until the trend component and the predicted seasonal component of the last layer are obtained.

4. The method according to claim 3, wherein the method comprises: the original seasonal component of the first layer is sequentially subjected to frequency domain enhancement and seasonal-trend decomposition to obtain the original seasonal component, the trend component and the predicted seasonal component of the second layer, comprising: the original seasonal component of the first layer is enhanced in the frequency domain by using a frequency domain enhancement module, and the complex tensor is obtained by converting from the time domain to the frequency domain, the complex tensor is compressed and then cross-channel frequency filtering is performed, the filtered result is reconstructed into a time domain signal, and the industrial control enhanced feature of the second layer is obtained; the industrial control enhanced feature of the second layer is decomposed by using a seasonal-trend decomposition module to obtain the original trend component and the original seasonal component of the first decomposition block of the second layer; According to the processing of the original seasonal component of the first decomposition block of the second layer by the feedforward fully connected layer, the output of the feedforward fully connected layer is decomposed by the seasonal-trend decomposition module to obtain the original trend component and the original seasonal component of the second decomposition block of the second layer, and the original seasonal component of the second decomposition block of the second layer is taken as the original seasonal component of the second layer; After linear processing of the original seasonal component of the second layer, the predicted seasonal component of the second layer is obtained; The trend component of the second layer is obtained by weighting the trend component of the first layer, the original trend component of the first decomposition block of the first layer, and the original trend component of the second decomposition block of the first layer.

5. The method according to claim 1, wherein the method is characterized by, Based on the anomaly score of the industrial control reconstruction data, an anomaly detection result is obtained, including: calculating the anomaly score of the industrial control reconstruction data; if the anomaly score exceeds the preset score threshold, an anomaly detection result is obtained; otherwise, a normal detection result is obtained.

6. An industrial control abnormality detection system based on double-path noise adjustment, characterized by, including: a data preprocessing module configured to obtain an industrial control data set for preprocessing, and convert the preprocessed result into an industrial control embedding representation; an anomaly detection module configured to perform anomaly detection based on the industrial control embedding representation using a trained anomaly detection model to obtain an anomaly detection result, including: performing time distance dependence and data dependence on the industrial control embedding representation in parallel to obtain an industrial control coding feature; decomposing the industrial control coding feature into a trend component and a predicted seasonal component; processing the predicted seasonal component based on a diffusion-based noise modulation mechanism to obtain a noisy predicted seasonal component; performing multi-cycle fusion reconstruction on the noisy predicted seasonal component and the trend component to obtain the industrial control reconstruction data, including: obtaining the amplitude of the noisy predicted seasonal component, selecting the frequency of the estimated period according to the amplitude, obtaining the estimated period based on the estimated period, and converting the noisy predicted seasonal component to a two-dimensional space using the estimated period to obtain a two-dimensional predicted seasonal component of multiple periods; performing one-dimensional conversion on the two-dimensional predicted seasonal component of multiple periods to obtain one-dimensional seasonal components of multiple periods, and aggregating the one-dimensional seasonal components of multiple periods based on the amplitude to obtain an one-dimensional aggregated seasonal component; performing weighted fusion on the one-dimensional aggregated seasonal component and the trend component to obtain the industrial control reconstruction data; based on the anomaly score of the industrial control reconstruction data, an anomaly detection result is obtained.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps of the industrial control anomaly detection method based on double-path noise adjustment in any one of claims 1-5.

8. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the steps of the industrial control anomaly detection method based on double-path noise adjustment in any one of claims 1-5.

9. A computer program product, characterised in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the industrial control anomaly detection method based on double-path noise adjustment in any one of claims 1-5.

Images