Industrial control anomaly detection method and system based on high and low frequency feature similarity

Abstract

The invention discloses an industrial control anomaly detection method based on high and low frequency feature similarity, and the method comprises the steps: carrying out the periodic collection of monitoring data from an industrial control system site, and constructing a corresponding low-frequency feature vector and a high-frequency feature set; through repeated data acquisition, a training data set containing multiple samples is formed. In the initialization process of the anomaly detection network, the combination of the feature transformation network and the projection network is adopted to ensure the effective mapping and fusion of the low-frequency features and the high-frequency features. Specifically, low-frequency feature vectors are subjected to unified-dimension mapping through a linear transformation matrix, and high-frequency features are directly input into an attention fusion mechanism so as to calculate the dynamic correlation degree of the high-frequency features to the low-frequency features. And finally, mapping the fusion feature and the low-frequency feature by using a projection network, and generating a vector pair for similarity learning. The technical problem that a traditional industrial control system anomaly detection method is insufficient in feature processing and fusion can be solved.

Description

Technical Field

[0001] This invention belongs to the field of industrial control network technology, and more specifically, relates to an industrial control anomaly detection method and system based on high and low frequency feature similarity. Background Technology

[0002] With the widespread application of Industrial Control Systems (ICS), they play a core role in key sectors such as power, petrochemicals, and manufacturing. However, the increasing openness and interconnectivity of ICS have also made them a prime target for cyberattacks. Developing efficient and accurate anomaly detection methods for ICS networks has become an important research direction for ensuring the security of ICS. In the field of ICS network security, anomaly detection is a crucial means of identifying and preventing security threats.

[0003] Currently, commonly used anomaly detection solutions for industrial control systems mainly include the following: 1. Rule-based anomaly detection method: It monitors the behavior of industrial control networks through predefined rules or policies, such as rule matching based on communication protocols or blacklist detection of specific behaviors; 2. Anomaly detection methods based on statistical analysis: These methods analyze data distribution such as traffic characteristics and device communication behavior in industrial control networks to establish normal behavior models and detect abnormal behaviors that deviate from the models. For example, they utilize the statistical characteristics of abnormal traffic changes or device status for monitoring. 3. Machine learning-based anomaly detection methods: These methods use classification models or clustering algorithms to model data. For example, supervised learning methods train models to identify normal and abnormal behaviors, while unsupervised learning methods discover abnormal patterns through cluster analysis. 4. Anomaly detection methods based on deep learning: These methods automatically extract data features through deep neural networks and are widely used in industrial network anomaly detection. Common methods include convolutional neural networks for extracting spatial features and recurrent neural networks for capturing time series features.

[0004] However, the aforementioned existing methods for detecting anomalies in industrial control systems all have some significant drawbacks: First, existing rule-based anomaly detection methods rely on manually preset rules, which makes it difficult to characterize the intrinsic relationship between high-frequency and low-frequency features during the operation of industrial control systems, resulting in insufficient adaptability to complex or unknown abnormal behaviors. Second, existing anomaly detection methods based on statistical analysis are usually based on statistical feature modeling on a single time scale, which makes it difficult to simultaneously reflect the rapid changes in the operating status of the industrial control system and the long-term operating trend, thus limiting the accuracy of anomaly detection. Third, existing machine learning-based anomaly detection methods mostly adopt independent modeling methods for high- and low-frequency feature processing, lacking joint constraints on the consistency of features across multiple time scales, resulting in unstable detection performance in unlabeled or weakly labeled scenarios. Fourth, although existing deep learning-based anomaly detection methods have strong feature representation capabilities, their model structures are complex and they are not specifically designed for the collaborative modeling of high-frequency and low-frequency features in industrial control systems. This makes it difficult to ensure detection performance while also meeting real-time and engineering deployment requirements. Fifth, the above four methods generally fail to effectively establish a unified representation and consistency discrimination mechanism between high-frequency and low-frequency features of industrial control systems, making it difficult to identify abnormal states in a timely and accurate manner under complex operating conditions. Summary of the Invention

[0005] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides an industrial control system anomaly detection method and system based on high- and low-frequency feature similarity. Its purpose is to solve the technical problems of existing rule-based anomaly detection methods, which rely on manually preset rules and struggle to characterize the intrinsic correlation between high-frequency and low-frequency features during industrial control system operation, resulting in insufficient adaptability to complex or unknown abnormal behaviors; existing statistical analysis-based anomaly detection methods, which typically model statistical features based on a single time scale, struggle to simultaneously reflect the rapid changes and long-term trends of the industrial control system's operating status, leading to limited anomaly detection accuracy; and existing machine learning-based anomaly detection methods... The existing methods for high- and low-frequency feature processing often employ independent modeling approaches, lacking joint constraints on the consistency of features across multiple time scales. This leads to unstable detection performance in unlabeled or weakly labeled scenarios. Furthermore, while existing deep learning-based anomaly detection methods possess strong feature representation capabilities, their complex model structures and lack of specific design for collaborative modeling of high-frequency and low-frequency features in industrial control systems make it difficult to balance real-time performance with engineering deployment requirements while ensuring detection effectiveness. Additionally, the four existing methods generally fail to effectively establish a unified representation and consistency discrimination mechanism between high-frequency and low-frequency features in industrial control systems, resulting in difficulties in timely and accurate identification of abnormal states under complex operating conditions.

[0006] To achieve the above objectives, according to one aspect of the present invention, an industrial control anomaly detection method based on high- and low-frequency feature similarity is provided, comprising the following steps: (1) Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. ; where low-frequency feature vectors , For low-frequency feature dimensions, Denotes the set of all real numbers, with a sampling period. The value range is from 1 second to 60 seconds, and the sampling period is... The value range is from 100 milliseconds to 800 milliseconds; high-frequency feature vector set , For high-frequency feature dimensions, ∈[1, ]; (2) The low-frequency feature vector obtained in step (1) and high-frequency feature vector set Input the feature transformation network into the pre-trained anomaly detection model respectively In the process, the mapped low-frequency feature vectors are obtained respectively. and online fusion feature vectors ; (3) The online fusion feature vector obtained in step (2) and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain anomaly detection results for industrial control systems.

[0007] Preferably, the low-frequency monitoring quantities include the effective value of voltage, the effective value of current, active power, reactive power, equipment temperature, opening and closing status, pressure plate status, and SetPoint command quantity; High-frequency monitoring parameters include instantaneous sampled values, high-frequency harmonic characteristics, and phasor measurement unit (PMU) data.

[0008] Preferably, step (2) includes the following sub-steps: (2-1) Obtaining the linear transformation matrix from the feature transformation network and the low-frequency feature vector obtained in step (1) With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector. ,in Represents the mapped low-frequency feature vector Dimensions: ; (2-2) Obtaining the linear transformation matrix from the feature transformation network And the mapped low-frequency feature vector obtained in step (2-1) With the linear transformation matrix Multiply to obtain the query vector : ; in Represents the internal dimensions of the attention mechanism, and has ; (2-3) Obtain the linear transformation matrix from the feature transformation network and The set of high-frequency feature vectors obtained in step (1) Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the key vector set respectively Sum value vector set ,in: ; ; (2-4) The query vector obtained in step (2-2) The first key vector in the set of key vectors obtained in step (2-3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector : ; in Indicates matrix transpose; (2-5) Based on the key vector set obtained in step (2-4), the first... Attention weights corresponding to each key vector The corresponding value vector in the sum value vector set To obtain online fusion feature vectors :

[0009] Among them, online fusion feature vectors .

[0010] Preferably, step (3) specifically includes the following sub-steps: (3-1) The online fusion feature vector obtained in step (2-5) Input projection network To obtain the online high-frequency projection vector :

[0011] in, For projection networks Learnable parameters in; (3-2) Map the low-frequency feature vector obtained in step (2-1) Input projection network To obtain the online low-frequency projection vector :

[0012] (3-3) Calculate the online high-frequency projection vector obtained in step (3-1). The online low-frequency projection vector obtained in step (3-2) Cosine similarity between :

[0013] in, The second norm of the orientation quantity; (3-4) Determine the cosine similarity obtained in step (3-3). Is it greater than or equal to the preset anomaly detection threshold? If yes, it indicates that the industrial control system is in normal operating condition and the process ends; otherwise, it indicates that the industrial control system is in abnormal operating condition, outputs an abnormal alarm, and the process ends.

[0014] Preferably, the anomaly detection model includes sequentially connected feature transformation networks. and projection network Two parts; The specific structure of the feature transformation network is as follows: The first layer is the dimension transformation module, whose input is a dimension of... low-frequency feature vectors This module utilizes a dimension as The linear transformation matrix and the low-frequency eigenvector Multiply to obtain a dimension of low-frequency feature vectors And output; The second layer is the feature fusion module, whose input includes... Each dimension is The set of high-frequency feature vectors and the low-frequency feature vector output by the dimension transformation module. This module uses this low-frequency feature vector For query objects, and utilize attention mechanisms from the collection The attention weights are dynamically calculated and the most relevant feature information is aggregated in a weighted manner to obtain a dimension of 1. fused feature vector And output it.

[0015] Preferably, the projection network adopts a one-dimensional convolutional neural network (1DCNN), and its specific structure is as follows: The first layer is a convolutional layer, whose input is the dimension of the output of the feature fusion module. The low-frequency feature vector output by the feature vector or dimension transformation module This layer treats the feature vector as having a length of For sequences with 1 channel, use The sequence is convolved using a 3x3 one-dimensional convolution kernel, and the result is processed using the ReLU activation function to obtain a one-dimensional... The feature map is output, where The value range is from 1 to 10; The second layer is a pooling layer, whose input is the dimension of the output of the convolutional layer. The feature map is used in this layer, which employs max pooling to downsample the feature map along its length dimension, using one dimension as the feature map. The feature map is generated and output; The third layer is a flattening layer, whose input is the dimension of the pooling layer's output. The feature map is flattened by this layer to obtain a feature map with dimension 1. Output a one-dimensional vector; The fourth layer is a fully connected layer, whose input is a one-dimensional vector output from the flattened layer. This layer uses a dimension of... A weight matrix of dimension 1 transforms the one-dimensional vector linearly into a one-dimensional vector. The projection vector is obtained and output, where The value range is from 128 to 4096, when the input of the first layer is At that time, the output of this fully connected layer is a low-frequency projection vector. When the input of the first layer is At that time, the output of this fully connected layer is a high-frequency projection vector. .

[0016] Preferably, the anomaly detection model is trained through the following steps: A. Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. Repeat this collection process a total of Next, to obtain Low-frequency feature vectors and its corresponding set of N high-frequency feature vectors Where N is any natural number, i∈[1,N]; B. Obtain the training dataset based on all low-frequency feature vectors obtained in step A and their corresponding sets of all high-frequency feature vectors. ; C. Feature Transformation Network linear transformation matrix in , , , and projection network Model parameters Perform random initialization to obtain the initialized feature transformation network. and projection network ; D. For each sample in the training dataset Dataset obtained in step B In this case, the sample is input into the initialized feature transformation network obtained in step C. In order to obtain the mapped low-frequency feature vector corresponding to the sample. and online fusion feature vectors , where idx is the sample index, and idx∈[1,2N]; E. The online fusion feature vector obtained in step D. and the mapped low-frequency feature vector The projection network in the anomaly detection model after input initialization Training loss calculation and parameter optimization are performed to obtain the optimized feature transformation network parameters. and optimized projection network parameters ; F. Repeat steps D to E above until the training loss reaches the set threshold T or the maximum number of training iterations are reached, in order to obtain a well-trained anomaly detection model. Preferably, step B specifically includes the following sub-steps: (B1) Combine each low-frequency feature vector from the same acquisition period with its corresponding high-frequency feature vector set from all low-frequency feature vectors obtained in step A to form a positive sample. All positive samples constitute the positive sample dataset. ; in Indicates the current sample Positive samples; (B2) From all the low-frequency feature vectors and corresponding high-frequency feature vector sets obtained in step A, select the first... The low-frequency feature vector obtained from the second acquisition With the The set of high-frequency feature vectors obtained from the second collection Combined into negative samples, all negative samples constitute the negative sample dataset: ; in Indicates the current sample Negative samples; (B3) The positive sample dataset obtained in step (B2) Compared with the negative sample dataset obtained in step (B3) Merged into a training dataset for similarity learning: ; in, This is the intersection operator for sets.

[0017] Step D specifically includes the following sub-steps: (D1) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and the sample low-frequency feature vectors With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector corresponding to the sample. : ; (D2) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. And the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) With the linear transformation matrix Multiply to obtain the query vector corresponding to the sample. : ; in Represents the internal dimensions of the attention mechanism, and has ; (D3) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and The sample High-frequency feature vector set in Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the set of key vectors corresponding to each sample. The set of value vectors corresponding to this sample ,in: ; ; (D4) For each sample in the training dataset Dataset obtained in step B Specifically, the query vector corresponding to the sample obtained in step (D2) The first key vector in the set of key vectors obtained in step (D3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector : ; in Indicates matrix transpose; (D5) For each sample in the training dataset Dataset obtained in step B In other words, the set of key vectors obtained according to step (D4) is the first... Attention weights corresponding to each key vector The corresponding value vector in the sum value vector set Obtain the online fusion feature vector corresponding to the sample. : ; Among them, online fusion feature vectors .

[0018] Preferably, step E specifically includes the following sub-steps: (E1) For each sample in the training dataset Dataset obtained in step B Specifically, the online fusion feature vector corresponding to the sample obtained in step (D5) Input projection network To obtain the online high-frequency projection vector corresponding to the sample. : ; in, For projection networks Parameters; (E2) For each sample in the training dataset Dataset obtained in step B Specifically, the low-frequency feature vector corresponding to the sample obtained in step (D1) after mapping... Input projection network To obtain the online low-frequency projection vector corresponding to the sample. : ; (E3) For each sample in the training dataset Dataset obtained in step B Specifically, the online high-frequency projection vector corresponding to the sample obtained in step (E1) is... The online low-frequency projection vector corresponding to the sample obtained in step (E2) Cosine similarity between The cosine similarity corresponding to this sample : ; in, The second norm of the orientation quantity; (E4) For each sample in the training dataset Dataset obtained in step B In other words, the cosine similarity of the sample obtained from step (E3) Calculate the training loss for this sample: ; Where the sample is from the positive sample dataset That is, low-frequency feature vector With high-frequency feature vector set If the samples are from the same collection period, then the label of the sample is... If the sample comes from a negative sample dataset That is, low-frequency feature vector With high-frequency feature vector set When the samples are collected from different collection periods, set the label for the sample. This is the similarity interval threshold. This is a function to find the maximum value. (E5) The training loss obtained from step (E4) The feature transformation network parameters were optimized using a gradient descent-type optimization algorithm. and projection network parameters Joint optimization is performed to obtain the optimized feature transformation network parameters. and optimized projection network parameters .

[0019] According to another aspect of the present invention, an industrial control anomaly detection system based on high- and low-frequency feature similarity is provided, comprising the following modules: The first module is used for data acquisition cycles. Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. ; where low-frequency feature vectors , For low-frequency feature dimensions, Denotes the set of all real numbers, with a sampling period. The value range is from 1 second to 60 seconds, and the sampling period is... The value range is from 100 milliseconds to 800 milliseconds; high-frequency feature vector set , For high-frequency feature dimensions, ∈[1, ]; The second module is used to process the low-frequency feature vector obtained from the first module. and high-frequency feature vector set Input the feature transformation network into the pre-trained anomaly detection model respectively In the process, the mapped low-frequency feature vectors are obtained respectively. and online fusion feature vectors ; The third module is used to fuse the feature vectors obtained from the second module online. and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain anomaly detection results for industrial control systems.

[0020] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: 1. The present invention employs steps (1) to (2), which synchronously constructs low-frequency feature vectors and multiple high-frequency sub-window feature vectors within the same low-frequency acquisition cycle, and performs fusion processing on high-frequency features based on an attention mechanism. Therefore, it can solve the technical problem that existing rule-based anomaly detection methods are difficult to utilize high-frequency and low-frequency features simultaneously and have insufficient detection accuracy. 2. The present invention employs steps (1) to (2-5), which maps low-frequency features to high-frequency feature space and dynamically weights and fuses multiple high-frequency sub-window features, thereby simultaneously characterizing the short-term changes and long-term trends of the operating status of the industrial control system. Therefore, it can solve the technical problem that existing statistical analysis-based anomaly detection methods rely only on a single time scale feature and have limited anomaly recognition capabilities. 3. Since the present invention adopts steps (2) to (3-3), it performs similarity calculation on the fused high-frequency features and low-frequency features in a unified feature space, and realizes anomaly detection without manual labeling of anomaly samples. Therefore, it can solve the technical problems of existing machine learning-based anomaly detection methods having strong dependence on sample labels and insufficient generalization ability. 4. Since the present invention adopts steps (1) to (3), it uses a feature transformation network with a relatively simple structure, attention fusion mechanism and similarity calculation method to complete anomaly detection. Therefore, it can solve the technical problems of existing deep learning-based anomaly detection methods, such as complex models, high deployment costs and difficulty in meeting the real-time requirements of industrial sites. 5. Since the anomaly detection process of the present invention only relies on the general monitoring data of the industrial control system and is not limited to specific communication protocols, equipment types or network topologies, it can be applied to a variety of industrial control system scenarios and has strong versatility and applicability. Attached Figure Description

[0021] Figure 1 This is a flowchart of the industrial control anomaly detection method based on high and low frequency feature similarity according to the present invention; Figure 2 This is a network architecture diagram of the anomaly detection model used in this invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0023] It should be noted that in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.

[0024] Furthermore, the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0025] The basic idea of ​​this invention is to provide an industrial control anomaly detection method based on the similarity of high and low frequency features. This method implements a hierarchical feature processing mechanism. First, it periodically collects monitoring data from the industrial control system field to construct corresponding low-frequency feature vectors and high-frequency feature sets. Through repeated data collection, a training dataset containing multiple samples is formed. During the initialization of the anomaly detection network, a combination of feature transformation network and projection network is used to ensure effective mapping and fusion of low-frequency and high-frequency features. Specifically, low-frequency feature vectors are mapped to a unified dimension through a linear transformation matrix, while high-frequency features are directly input into an attention fusion mechanism to calculate the dynamic correlation between high-frequency and low-frequency features. Finally, the projection network maps the fused features to the low-frequency features, generating vector pairs for similarity learning. This invention aims to address the shortcomings of traditional industrial control system anomaly detection methods in feature processing and fusion. On the one hand, through the effective fusion of high and low frequency features, the accuracy of anomaly detection is significantly improved, and the false alarm rate is reduced. On the other hand, combined with a similarity learning mechanism, the system can promptly identify and respond to potential anomalies, meeting the high requirements for real-time performance and accuracy in industrial control environments. Furthermore, because the present invention adopts an integrated design in feature processing, similarity calculation and model training, it not only improves the overall performance of the detection system, but also overcomes the limitations of traditional methods in terms of data processing efficiency and anomaly recognition capabilities.

[0026] like Figure 1 As shown, this invention provides an industrial control anomaly detection method based on high- and low-frequency feature similarity, comprising the following steps: (1) Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. ; where low-frequency feature vectors , For low-frequency feature dimensions, Denotes the set of all real numbers, with a sampling period. The value range is from 1 second to 60 seconds, preferably 10 seconds, and the sampling period is... The value range is from 100 milliseconds to 800 milliseconds, preferably 500 milliseconds; high-frequency feature vector set , For high-frequency feature dimensions, ∈[1, ]; Specifically, low-frequency monitoring quantities include, but are not limited to: effective voltage value, effective current value, active power, reactive power, equipment temperature, opening and closing status, pressure plate status, SetPoint command quantity, etc.; high-frequency monitoring quantities include, but are not limited to: instantaneous sampled value, high-frequency harmonic characteristics, phasor measurement unit (PMU) data, etc.

[0027] The advantage of this step (1) is that by synchronously acquiring low-frequency feature vectors and multiple high-frequency sub-window feature vectors within the same low-frequency acquisition cycle, it provides basic data support for the unified modeling and fusion analysis of high and low frequency features, which is conducive to comprehensively depicting the operating status of the industrial control system.

[0028] (2) The low-frequency feature vector obtained in step (1) and high-frequency feature vector set Input the feature transformation network into the pre-trained anomaly detection model respectively In the process, the mapped low-frequency feature vectors are obtained respectively. and online fusion feature vectors ; This step specifically includes the following sub-steps: (2-1) Obtaining the linear transformation matrix from the feature transformation network and the low-frequency feature vector obtained in step (1) With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector. ,in Represents the mapped low-frequency feature vector Dimensions: ; (2-2) Obtaining the linear transformation matrix from the feature transformation network And the mapped low-frequency feature vector obtained in step (2-1) With the linear transformation matrix Multiply to obtain the query vector : ; in Represents the internal dimensions of the attention mechanism, and has ; (2-3) Obtain the linear transformation matrix from the feature transformation network and The set of high-frequency feature vectors obtained in step (1) Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the key vector set respectively Sum value vector set ,in: ; ; (2-4) The query vector obtained in step (2-2) The first key vector in the set of key vectors obtained in step (2-3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector : ; in Indicates matrix transpose; (2-5) Based on the key vector set obtained in step (2-4), the first... Attention weights corresponding to each key vector The corresponding value vector in the sum value vector set To obtain online fusion feature vectors :

[0029] Among them, online fusion feature vectors ; The advantage of this step (2) is that by mapping the dimensions of low-frequency features and introducing an attention mechanism to perform weighted fusion of multiple high-frequency sub-window features, the effective fusion of features at different time scales in a unified feature space is achieved, which improves the accuracy and robustness of feature representation.

[0030] The advantages of the above sub-steps (2-2) to (2-5) are: using low-frequency features as query vectors, multiple high-frequency features within the same time window are dynamically weighted, which effectively characterizes the correlation between high-frequency features and low-frequency operating states, and improves the sensitivity of high-frequency feature fusion results to changes in system state.

[0031] (3) The online fusion feature vector obtained in step (2) and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain anomaly detection results for industrial control systems.

[0032] This step specifically includes the following sub-steps: (3-1) The online fusion feature vector obtained in step (2-5) Input projection network To obtain the online high-frequency projection vector :

[0033] in, For projection networks Learnable parameters in; (3-2) Map the low-frequency feature vector obtained in step (2-1) Input projection network To obtain the online low-frequency projection vector :

[0034] (3-3) Calculate the online high-frequency projection vector obtained in step (3-1). The online low-frequency projection vector obtained in step (3-2) Cosine similarity between :

[0035] in, The second norm of the orientation quantity; (3-4) Determine the cosine similarity obtained in step (3-3). Is it greater than or equal to the preset anomaly detection threshold? If yes, it indicates that the industrial control system is in normal operating condition and the process ends; otherwise, it indicates that the industrial control system is in abnormal operating condition, outputs an abnormal alarm, and the process ends.

[0036] Specifically, the preset anomaly detection threshold The value range is from 0.1 to 0.9, preferably 0.5.

[0037] like Figure 2 As shown, the anomaly detection model of the present invention includes a series of connected feature transformation networks. and projection network Two parts.

[0038] The specific structure of the feature transformation network is as follows: The first layer is the dimension transformation module, whose input is a dimension of... low-frequency feature vectors This module utilizes a dimension as The linear transformation matrix and the low-frequency eigenvector Multiply to obtain a dimension of low-frequency feature vectors And output; This module maps low-frequency features to the same dimensional space as high-frequency features through matrix multiplication, preparing for subsequent similarity calculations.

[0039] The second layer is the feature fusion module, whose input includes... Each dimension is The set of high-frequency feature vectors and the low-frequency feature vector output by the dimension transformation module. This module uses this low-frequency feature vector For query objects, and utilize attention mechanisms from the collection The attention weights are dynamically calculated and the most relevant feature information is aggregated in a weighted manner to obtain a dimension of 1. fused feature vector And output; The projection network uses a one-dimensional convolutional neural network (1DCNN), and its specific structure is as follows: The first layer is a convolutional layer, whose input is the dimension of the output of the feature fusion module. The low-frequency feature vector output by the feature vector or dimension transformation module This layer treats the feature vector as having a length of For sequences with 1 channel, use The sequence is convolved using a 3x3 one-dimensional convolution kernel, and the result is processed using the ReLU activation function to obtain a one-dimensional... The feature map is output, where The value range is from 1 to 10, with 3 being the preferred value.

[0040] This layer aims to extract the local combination relationships between adjacent elements in the input feature vector.

[0041] The second layer is a pooling layer, whose input is the dimension of the output of the convolutional layer. The feature map is used in this layer, which employs max pooling to downsample the feature map along its length dimension, using one dimension as the feature map. The feature map is generated and output.

[0042] This layer aims to reduce the dimensionality of features, retain the most significant feature information, and improve the model's generalization ability.

[0043] The third layer is a flattening layer, whose input is the dimension of the pooling layer's output. The feature map is flattened by this layer to obtain a feature map with dimension 1. Output a one-dimensional vector; The fourth layer is a fully connected layer, whose input is a one-dimensional vector output from the flattened layer. This layer uses a dimension of... A weight matrix of dimension 1 transforms the one-dimensional vector linearly into a one-dimensional vector. The projection vector is obtained by using the projection vector (where the input of the first layer is...). At that time, the output of this fully connected layer is a low-frequency projection vector. When the input of the first layer is At that time, the output of this fully connected layer is a high-frequency projection vector. And output, where The value range is from 128 to 4096, with 1024 being the preferred value.

[0044] The anomaly detection model of this invention is trained through the following steps: A. Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. Repeat this collection process a total of Next, to obtain Low-frequency feature vectors and its corresponding set of N high-frequency feature vectors ; where low-frequency feature vectors Low-frequency feature vector The subscript 1 in the text indicates that step A is being executed for the first time. For low-frequency feature dimensions, Denotes the set of all real numbers, with a sampling period. The value range is from 1 second to 60 seconds, preferably 10 seconds, and the sampling period is... The value range is from 100 milliseconds to 800 milliseconds, preferably 500 milliseconds, a set of high-frequency feature vectors. , For high-frequency feature dimensions, ∈[1, ], where N is any natural number, i∈[1,N]; Specifically, low-frequency monitoring quantities include, but are not limited to: effective voltage value, effective current value, active power, reactive power, equipment temperature, opening and closing status, pressure plate status, SetPoint command quantity, etc.; high-frequency monitoring quantities include, but are not limited to: instantaneous sampled value, high-frequency harmonic characteristics, phasor measurement unit (PMU) data, etc.

[0045] B. Obtain the training dataset based on all low-frequency feature vectors obtained in step A and their corresponding sets of all high-frequency feature vectors. ; This step specifically includes the following sub-steps: (B1) Combine each low-frequency feature vector from the same acquisition period with its corresponding high-frequency feature vector set from all low-frequency feature vectors obtained in step A to form a positive sample. All positive samples constitute the positive sample dataset. ; in Indicates the current sample Positive samples; (B2) From all the low-frequency feature vectors and corresponding high-frequency feature vector sets obtained in step A, select the first... The low-frequency feature vector obtained from the second acquisition With the The set of high-frequency feature vectors obtained from the second collection Combined into negative samples, all negative samples constitute the negative sample dataset: ; in Indicates the current sample Negative samples; (B3) The positive sample dataset obtained in step (B2) Compared with the negative sample dataset obtained in step (B3) Merged into a training dataset for similarity learning: ; in, This is the intersection operator for sets.

[0046] Training dataset It contains both homologous high- and low-frequency feature samples and non-homologous high- and low-frequency feature samples.

[0047] The advantage of step B is that by recombining the low-frequency feature vectors and high-frequency feature vectors in the original collected data, a training dataset with positive and negative samples is constructed. The construction method is simple and applicable to subsequent similarity-based model training methods.

[0048] C. Feature Transformation Network linear transformation matrix in , , , and projection network Model parameters Perform random initialization to obtain the initialized feature transformation network. and projection network ; D. For each sample in the training dataset Dataset obtained in step B In this case, the sample is input into the initialized feature transformation network obtained in step C. In order to obtain the mapped low-frequency feature vector corresponding to the sample. and online fusion feature vectors , where idx is the sample index, and idx∈[1,2N]; This step specifically includes the following sub-steps: (D1) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and the sample low-frequency feature vectors With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector corresponding to the sample. : ; (D2) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. And the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) With the linear transformation matrix Multiply to obtain the query vector corresponding to the sample. : ; in Represents the internal dimensions of the attention mechanism, and has ; (D3) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and The sample High-frequency feature vector set in Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the set of key vectors corresponding to each sample. The set of value vectors corresponding to this sample ,in: ; ; (D4) For each sample in the training dataset Dataset obtained in step B Specifically, the query vector corresponding to the sample obtained in step (D2) The first key vector in the set of key vectors obtained in step (D3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector : ; in Indicates matrix transpose; (D5) For each sample in the training dataset Dataset obtained in step B In other words, the set of key vectors obtained according to step (D4) is the first... Attention weights corresponding to each key vector The corresponding value vector in the sum value vector set Obtain the online fusion feature vector corresponding to the sample. : ; Among them, online fusion feature vectors ; E. The online fusion feature vector obtained in step D. and the mapped low-frequency feature vector The projection network in the anomaly detection model after input initialization Training loss calculation and parameter optimization are performed to obtain the optimized feature transformation network parameters. ) and optimized projection network parameters ( ).

[0049] This step specifically includes the following sub-steps: (E1) For each sample in the training dataset Dataset obtained in step B Specifically, the online fusion feature vector corresponding to the sample obtained in step (D5) Input projection network To obtain the online high-frequency projection vector corresponding to the sample. : ; in, For projection networks Parameters; (E2) For each sample in the training dataset Dataset obtained in step B Specifically, the low-frequency feature vector corresponding to the sample obtained in step (D1) after mapping... Input projection network To obtain the online low-frequency projection vector corresponding to the sample. : ; (E3) For each sample in the training dataset Dataset obtained in step B Specifically, the online high-frequency projection vector corresponding to the sample obtained in step (E1) is... The online low-frequency projection vector corresponding to the sample obtained in step (E2) Cosine similarity between The cosine similarity corresponding to this sample : ; in, The second norm of the orientation quantity; (E4) For each sample in the training dataset Dataset obtained in step B In other words, the cosine similarity of the sample obtained from step (E3) Calculate the training loss for this sample: Specifically, this step uses the following formula to obtain the training loss of the samples: ; Specifically, if the sample comes from a positive sample dataset That is, low-frequency feature vector With high-frequency feature vector set If the samples are from the same collection period, then the label of the sample is... If the sample comes from a negative sample dataset That is, low-frequency feature vector With high-frequency feature vector set When the samples are collected from different collection periods, set the label for the sample. This is the similarity interval threshold, used to limit the upper bound of the similarity between negative samples. A preferred value is [value to be filled in]. ; This is the function for finding the maximum value.

[0050] (E5) The training loss obtained from step (E4) And the feature transformation network parameters are optimized using a gradient descent-type optimization algorithm (stochastic gradient descent algorithm is used in this embodiment). ) and projection network parameters ( Joint optimization is performed to obtain the optimized feature transformation network parameters. ) and optimized projection network parameters ( ); F. Repeat steps D to E above until the training loss reaches the set threshold T (0.02 in this invention) or the maximum number of training iterations (200 in this invention) to obtain a trained anomaly detection model.

[0051] Experimental results To demonstrate the effectiveness of the method and its improvement in classification performance, real operating data from a power industry control system was selected as the experimental dataset, and comparative experiments were conducted with several mainstream anomaly detection algorithms. The Isolation Forest method primarily identifies anomalies by randomly partitioning the feature space; the Autoencoder method judges anomalies through reconstruction errors; and the Long Short-Term Memory (LSTM) method detects anomalies by modeling the time series variation patterns. The method of this invention, however, simultaneously fuses high-frequency and low-frequency features and characterizes the consistency relationship between high- and low-frequency features based on attention mechanisms and similarity learning, thereby achieving the discrimination of abnormal behavior.

[0052] The experimental results are shown in the table below. As can be seen from the table, under the same dataset and experimental conditions, the method of this invention outperforms the comparison algorithms in terms of anomaly detection accuracy, recall, and F1 score. This indicates that by fusing high-frequency and low-frequency features and performing anomaly discrimination based on similarity, this invention can effectively improve the overall performance of anomaly detection in industrial control systems.

[0053]

[0054] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An industrial control anomaly detection method based on high- and low-frequency feature similarity, characterized in that, Includes the following steps: (1) Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. ; where low-frequency feature vectors , For low-frequency feature dimensions, Denotes the set of all real numbers, with a sampling period. The value range is from 1 second to 60 seconds, and the sampling period is... The value range is from 100 milliseconds to 800 milliseconds; high-frequency feature vector set , For high-frequency feature dimensions, ∈[1, ]; (2) The low-frequency feature vector obtained in step (1) and high-frequency feature vector set Input the feature transformation network into the pre-trained anomaly detection model respectively In the process, the mapped low-frequency feature vectors are obtained respectively. and online fusion feature vectors ; (3) The online fusion feature vector obtained in step (2) and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain anomaly detection results for industrial control systems.

2. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 1, characterized in that, Low-frequency monitoring parameters include RMS voltage, RMS current, active power, reactive power, equipment temperature, circuit breaker status, circuit breaker status, and SetPoint command parameters. High-frequency monitoring parameters include instantaneous sampled values, high-frequency harmonic characteristics, and phasor measurement unit (PMU) data.

3. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 1, characterized in that, Step (2) includes the following sub-steps: (2-1) Obtaining the linear transformation matrix from the feature transformation network and the low-frequency feature vector obtained in step (1) With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector. ,in Represents the mapped low-frequency feature vector Dimensions: ； (2-2) Obtaining the linear transformation matrix from the feature transformation network And the mapped low-frequency feature vector obtained in step (2-1) With the linear transformation matrix Multiply to obtain the query vector : ； in Represents the internal dimensions of the attention mechanism, and has ; (2-3) Obtain the linear transformation matrix from the feature transformation network and The set of high-frequency feature vectors obtained in step (1) Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the key vector set respectively Sum value vector set ,in: ； ； (2-4) The query vector obtained in step (2-2) The first key vector in the set of key vectors obtained in step (2-3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector : ； in Indicates matrix transpose; (2-5) Based on the key vector set obtained in step (2-4), the first... Attention weights corresponding to each key vector The corresponding value vector in the sum value vector set To obtain online fusion feature vectors : ； Among them, online fusion feature vectors .

4. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 3, characterized in that, Step (3) specifically includes the following sub-steps: (3-1) The online fusion feature vector obtained in step (2-5) Input projection network To obtain the online high-frequency projection vector : ； in, For projection networks Learnable parameters in; (3-2) Map the low-frequency feature vector obtained in step (2-1) Input projection network To obtain the online low-frequency projection vector : ； (3-3) Calculate the online high-frequency projection vector obtained in step (3-1). The online low-frequency projection vector obtained in step (3-2) Cosine similarity between : ； in, The second norm of the orientation quantity; (3-4) Determine the cosine similarity obtained in step (3-3). Is it greater than or equal to the preset anomaly detection threshold? If yes, it indicates that the industrial control system is in normal operating condition and the process ends; otherwise, it indicates that the industrial control system is in abnormal operating condition, outputs an abnormal alarm, and the process ends.

5. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 1, characterized in that, The anomaly detection model consists of sequentially connected feature transformation networks. and projection network Two parts; The specific structure of the feature transformation network is as follows: The first layer is the dimension transformation module, whose input is a dimension of... low-frequency feature vectors This module utilizes a dimension as The linear transformation matrix and the low-frequency eigenvector Multiply to obtain a dimension of low-frequency feature vectors And output; The second layer is the feature fusion module, whose input includes... Each dimension is The set of high-frequency feature vectors and the low-frequency feature vector output by the dimension transformation module. This module uses this low-frequency feature vector For query objects, and utilize attention mechanisms from the collection The attention weights are dynamically calculated and the most relevant feature information is aggregated in a weighted manner to obtain a dimension of 1. fused feature vector And output it.

6. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 5, characterized in that, The projection network uses a one-dimensional convolutional neural network (1DCNN), and its specific structure is as follows: The first layer is a convolutional layer, whose input is the dimension of the output of the feature fusion module. The low-frequency feature vector output by the feature vector or dimension transformation module This layer treats the feature vector as having a length of For sequences with 1 channel, use The sequence is convolved using a 3x3 one-dimensional convolution kernel, and the result is processed using the ReLU activation function to obtain a one-dimensional... The feature map is output, where The value range is from 1 to 10; The second layer is a pooling layer, whose input is the dimension of the output of the convolutional layer. The feature map is used in this layer, which employs max pooling to downsample the feature map along its length dimension, using one dimension as the feature map. The feature map is generated and output; The third layer is a flattening layer, whose input is the dimension of the pooling layer's output. The feature map is flattened by this layer to obtain a feature map with dimension 1. Output a one-dimensional vector; The fourth layer is a fully connected layer, whose input is a one-dimensional vector output from the flattened layer. This layer uses a dimension of... A weight matrix of dimension 1 transforms the one-dimensional vector linearly into a one-dimensional vector. The projection vector is obtained and output, where The value range is from 128 to 4096, when the input of the first layer is At that time, the output of this fully connected layer is a low-frequency projection vector. ; When the input of the first layer is At that time, the output of this fully connected layer is a high-frequency projection vector. .

7. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 6, characterized in that, The anomaly detection model is trained through the following steps: A. Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. Repeat this collection process a total of Next, to obtain Low-frequency feature vectors and its corresponding set of N high-frequency feature vectors Where N is any natural number, i∈[1,N]; B. Obtain the training dataset based on all low-frequency feature vectors obtained in step A and their corresponding sets of all high-frequency feature vectors. ; C. Feature Transformation Network linear transformation matrix in , , , and projection network Model parameters Perform random initialization to obtain the initialized feature transformation network. and projection network ; D. For each sample in the training dataset Dataset obtained in step B In this case, the sample is input into the initialized feature transformation network obtained in step C. In order to obtain the mapped low-frequency feature vector corresponding to the sample. and online fusion feature vectors , where idx is the sample index, and idx∈[1,2N]; E. The online fusion feature vector obtained in step D. and the mapped low-frequency feature vector The projection network in the anomaly detection model after input initialization Training loss calculation and parameter optimization are performed to obtain the optimized feature transformation network parameters. and optimized projection network parameters ; F. Repeat steps D to E above until the training loss reaches the set threshold T or the maximum number of training iterations are reached, in order to obtain a well-trained anomaly detection model.

8. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 7, characterized in that, Step B specifically includes the following sub-steps: (B1) Combine each low-frequency feature vector from the same acquisition period with its corresponding high-frequency feature vector set from all low-frequency feature vectors obtained in step A to form a positive sample. All positive samples constitute the positive sample dataset. ； in Indicates the current sample Positive samples; (B2) From all the low-frequency feature vectors and corresponding high-frequency feature vector sets obtained in step A, select the first... The low-frequency feature vector obtained from the second acquisition With the The set of high-frequency feature vectors obtained from the second collection Combined into negative samples, all negative samples constitute the negative sample dataset: ； in Indicates the current sample Negative samples; (B3) The positive sample dataset obtained in step (B2) Compared with the negative sample dataset obtained in step (B3) Merged into a training dataset for similarity learning: ； in, The intersection operator for sets; Step D specifically includes the following sub-steps: (D1) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and the sample low-frequency feature vectors With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector corresponding to the sample. : ； (D2) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. And the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) With the linear transformation matrix Multiply to obtain the query vector corresponding to the sample. : ； in Represents the internal dimensions of the attention mechanism, and has ; (D3) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and The sample High-frequency feature vector set in Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the set of key vectors corresponding to each sample. The set of value vectors corresponding to this sample ,in: ； ； (D4) For each sample in the training dataset Dataset obtained in step B Specifically, the query vector corresponding to the sample obtained in step (D2) The first key vector in the set of key vectors obtained in step (D3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector : ； in Indicates matrix transpose; (D5) For each sample in the training dataset Dataset obtained in step B In other words, the set of key vectors obtained according to step (D4) is the first... Attention weights corresponding to each key vector The corresponding value vector in the sum value vector set Obtain the online fusion feature vector corresponding to the sample. : ； Among them, online fusion feature vectors .

9. The industrial control anomaly detection method based on high- and low-frequency feature similarity according to claim 8, characterized in that, Step E specifically includes the following sub-steps: (E1) For each sample in the training dataset Dataset obtained in step B Specifically, the online fusion feature vector corresponding to the sample obtained in step (D5) Input projection network To obtain the online high-frequency projection vector corresponding to the sample. : ； in, For projection networks Parameters; (E2) For each sample in the training dataset Dataset obtained in step B Specifically, the low-frequency feature vector corresponding to the sample obtained in step (D1) after mapping... Input projection network To obtain the online low-frequency projection vector corresponding to the sample. : ； (E3) For each sample in the training dataset Dataset obtained in step B Specifically, the online high-frequency projection vector corresponding to the sample obtained in step (E1) is... The online low-frequency projection vector corresponding to the sample obtained in step (E2) Cosine similarity between The cosine similarity corresponding to this sample : ； in, The second norm of the orientation quantity; (E4) For each sample in the training dataset Dataset obtained in step B In other words, the cosine similarity of the sample obtained from step (E3) Calculate the training loss for this sample: ； Where the sample is from the positive sample dataset That is, low-frequency feature vector With high-frequency feature vector set If the samples are from the same collection period, then the label of the sample is... If the sample comes from a negative sample dataset That is, low-frequency feature vector With high-frequency feature vector set When the samples are collected from different collection periods, set the label for the sample. This is the similarity interval threshold. This is a function to find the maximum value. (E5) The training loss obtained from step (E4) The feature transformation network parameters were optimized using a gradient descent-type optimization algorithm. and projection network parameters Joint optimization is performed to obtain the optimized feature transformation network parameters. and optimized projection network parameters .

10. An industrial control anomaly detection system based on high- and low-frequency feature similarity, characterized in that, Includes the following modules: The first module is used for data acquisition cycles. Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. ; where low-frequency feature vectors , For low-frequency feature dimensions, Denotes the set of all real numbers, with a sampling period. The value range is from 1 second to 60 seconds, and the sampling period is... The value range is from 100 milliseconds to 800 milliseconds; high-frequency feature vector set , For high-frequency feature dimensions, ∈[1, ]; The second module is used to process the low-frequency feature vector obtained from the first module. and high-frequency feature vector set Input the feature transformation network into the pre-trained anomaly detection model respectively In the process, the mapped low-frequency feature vectors are obtained respectively. and online fusion feature vectors ; The third module is used to fuse the feature vectors obtained from the second module online. and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain anomaly detection results for industrial control systems.

Images