An industrial control abnormality detection method and system based on high and low frequency feature similarity

Abstract

The application discloses an industrial control abnormality detection method based on high-low frequency feature similarity, which firstly carries out periodic collection of monitoring data from an industrial control system field, and constructs corresponding low-frequency feature vectors and high-frequency feature sets. Through repeated data collection, a training data set containing multiple samples is formed. In the initialization process of the abnormality detection network, a combination of a feature transformation network and a projection network is adopted to ensure effective mapping and fusion of the low-frequency features and the high-frequency features. Specifically, the low-frequency feature vectors are mapped to a unified dimension through a linear transformation matrix, and the high-frequency features are directly input into an attention fusion mechanism to calculate the dynamic correlation degree of the high-frequency features to the low-frequency features. Finally, the projection network is used to map the fused features and the low-frequency features to generate a vector pair for similarity learning. The application can solve the technical problems of the deficiencies of the conventional industrial control system abnormality detection method in feature processing and fusion.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial control network, and more particularly to an industrial control abnormality detection method and system based on high and low frequency feature similarity. BACKGROUND

[0002] With the wide application of industrial control systems (ICS), it plays a core role in key fields such as power, petrochemical industry, manufacturing industry, etc. However, the openness and interconnection of industrial control systems have gradually become an important target of network attacks. Building an efficient and accurate industrial control network anomaly detection method has become an important research direction to protect the security of industrial control systems. In the field of industrial control network security, anomaly detection is an important means to identify and prevent security threats.

[0003] The current commonly used industrial control system anomaly detection schemes mainly include the following:

[0004] 1. Rule-based anomaly detection method: it monitors the behavior of industrial control network through pre-defined rules or strategies, such as rule matching based on communication protocol or blacklist detection of specific behavior;

[0005] 2. Statistical analysis-based anomaly detection method: it analyzes the traffic characteristics, device communication behavior, etc. in the industrial control network, establishes a normal behavior model, and detects abnormal behavior deviating from the model. For example, use statistical characteristics of traffic anomaly changes or device state for monitoring;

[0006] 3. Machine learning-based anomaly detection method: it uses classification models or clustering algorithms to model data, for example, supervised learning method identifies normal and abnormal behavior by training model, while unsupervised learning method discovers abnormal patterns through clustering analysis;

[0007] 4. Deep learning-based anomaly detection method: it automatically extracts data features through deep neural networks and is widely used in industrial network anomaly detection. Common methods include convolutional neural network to extract spatial features, recurrent neural network to capture time series features, etc.

[0008] However, the above several existing industrial control system anomaly detection methods have some defects that cannot be ignored:

[0009] First, the existing rule-based anomaly detection method relies on manual preset rules, which is difficult to describe the internal relationship between high and low frequency features in the running process of industrial control system, resulting in insufficient adaptability to complex or unknown abnormal behavior;

[0010] Second, the existing abnormality detection method based on statistical analysis is usually based on single time scale statistical feature modeling, which is difficult to reflect the rapid change characteristics and long-term running trend of the running state of the industrial control system at the same time, resulting in limited abnormality detection precision;

[0011] Third, the existing abnormality detection method based on machine learning usually adopts independent modeling mode in high and low frequency feature processing, lacks joint constraint on consistency of multi-time scale features, and results in unstable detection effect in no-label or weak-label scene.

[0012] Fourth, the existing abnormality detection method based on deep learning has strong feature representation ability, but the model structure is complex, is not specially designed for collaborative modeling of high and low frequency features in the industrial control system, and is difficult to guarantee detection effect while taking into account real-time performance and engineering deployment requirements.

[0013] Fifth, the above four methods generally fail to effectively establish unified representation and consistency discrimination mechanism between high frequency features and low frequency features of the industrial control system, resulting in difficulty in timely and accurately identifying abnormal state under complex working conditions. SUMMARY

[0014] In view of the above defects or improvement needs of the prior art, the present application provides an industrial control abnormality detection method and system based on high and low frequency feature similarity, which aims to solve the technical problems that the existing rule-based abnormality detection method relies on artificial preset rules, is difficult to depict the internal correlation between high and low frequency features in the running process of the industrial control system, and has insufficient adaptability to complex or unknown abnormal behaviors, and the existing abnormality detection method based on statistical analysis is usually based on single time scale statistical feature modeling, which is difficult to reflect the rapid change characteristics and long-term running trend of the running state of the industrial control system at the same time, resulting in limited abnormality detection precision, and the existing abnormality detection method based on machine learning usually adopts independent modeling mode in high and low frequency feature processing, lacks joint constraint on consistency of multi-time scale features, and results in unstable detection effect in no-label or weak-label scene, and the existing abnormality detection method based on deep learning has strong feature representation ability, but the model structure is complex, is not specially designed for collaborative modeling of high and low frequency features in the industrial control system, and is difficult to guarantee detection effect while taking into account real-time performance and engineering deployment requirements, and the existing four methods generally fail to effectively establish unified representation and consistency discrimination mechanism between high frequency features and low frequency features of the industrial control system, resulting in difficulty in timely and accurately identifying abnormal state under complex working conditions.

[0015] To achieve the above purpose, according to one aspect of the present application, an industrial control abnormality detection method based on high and low frequency feature similarity is provided, comprising the following steps:

[0016] (1) acquire low-frequency monitoring quantities of the industrial control system periodically All the acquired low-frequency monitoring quantities constitute a low-frequency feature vector , acquire high-frequency sub-windows periodically , acquire a high-frequency feature vector of the industrial control system in the high-frequency sub-window , and all the high-frequency feature vectors corresponding to the acquired high-frequency sub-windows constitute a high-frequency feature vector set ; wherein the low-frequency feature vector , is a low-frequency feature dimension, represents a set of all real numbers, the sampling period ranges from 1 second to 60 seconds, and the sampling period ranges from 100 milliseconds to 800 milliseconds; the high-frequency feature vector set , is a high-frequency feature dimension, ∈[1, ];

[0017] (2) input the low-frequency feature vector and the high-frequency feature vector set obtained in step (1) into a feature transformation network of a pre-trained anomaly detection model, respectively, to acquire a mapped low-frequency feature vector and an online fusion feature vector , respectively;

[0018] (3) input the online fusion feature vector and the mapped low-frequency feature vector obtained in step (2) into a projection network of the pre-trained anomaly detection model, to acquire an anomaly detection result of the industrial control system.

[0019] Preferably, the low-frequency monitoring quantities include voltage effective value, current effective value, active power, reactive power, device temperature, on-off state, pressure plate state, and SetPoint instruction quantity.

[0020] The high-frequency monitoring quantities include instantaneous sampling value, high-frequency harmonic feature, and phasor measurement unit (PMU) data.

[0021] Preferably, step (2) includes the following sub-steps:

[0022] (2-1) acquire a linear transformation matrix from the feature transformation network, and acquire the low-frequency feature vector obtained in step (1) from the linear transformation matrix .With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector. ,in Represents the mapped low-frequency feature vector Dimensions:

[0023] ;

[0024] (2-2) Obtaining the linear transformation matrix from the feature transformation network And the mapped low-frequency feature vector obtained in step (2-1) With the linear transformation matrix Multiply to obtain the query vector :

[0025] ;

[0026] in Represents the internal dimensions of the attention mechanism, and has ;

[0027] (2-3) Obtain the linear transformation matrix from the feature transformation network and The set of high-frequency feature vectors obtained in step (1) Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the key vector set respectively Sum value vector set ,in:

[0028] ;

[0029] ;

[0030] (2-4) The query vector obtained in step (2-2) The first key vector in the set of key vectors obtained in step (2-3) Key vectors Similarity is calculated, and the results are normalized using the softmax function to obtain the first similarity vector in the key vector set. Attention weights corresponding to each key vector :

[0031] ;

[0032] in Indicates matrix transpose;

[0033] (2-5) obtaining the attention weight corresponding to the key vector in the key vector set obtained in step (2-4) and the corresponding value vector in the value vector set to obtain an online fusion feature vector :

[0034]

[0035] .

[0036] Preferably, step (3) specifically comprises the following sub-steps:

[0037] (3-1) inputting the online fusion feature vector obtained in step (2-5) into a projection network to obtain an online high-frequency projection vector :

[0038]

[0039] wherein is a learnable parameter in the projection network ;

[0040] (3-2) inputting the mapped low-frequency feature vector obtained in step (2-1) into a projection network to obtain an online low-frequency projection vector :

[0041]

[0042] (3-3) calculating the cosine similarity between the online high-frequency projection vector obtained in step (3-1) and the online low-frequency projection vector obtained in step (3-2) :

[0043]

[0044] wherein represents the two-norm of a vector;

[0045] (3-4) judging whether the cosine similarity obtained in step (3-3) is greater than or equal to a preset anomaly detection threshold , if yes, it indicates that the industrial control system is in a normal working condition, and the process ends, otherwise, it indicates that the industrial control system is in an abnormal working condition, and an abnormal alarm is output, and the process ends.

[0046] ​​Preferably, the anomaly detection model includes sequentially connected feature transformation networks. and projection network Two parts;

[0047] The specific structure of the feature transformation network is as follows:

[0048] The first layer is the dimension transformation module, whose input is a dimension of... low-frequency feature vectors This module utilizes a dimension as The linear transformation matrix and the low-frequency eigenvector Multiply to obtain a dimension of low-frequency feature vectors And output;

[0049] The second layer is the feature fusion module, whose input includes... Each dimension is The set of high-frequency feature vectors and the low-frequency feature vector output by the dimension transformation module. This module uses this low-frequency feature vector For query objects, and utilize attention mechanisms from the collection The attention weights are dynamically calculated and the most relevant feature information is aggregated in a weighted manner to obtain a dimension of 1. fusion feature vector And output it.

[0050] Preferably, the projection network adopts a one-dimensional convolutional neural network (1DCNN), and its specific structure is as follows:

[0051] The first layer is a convolutional layer, whose input is the dimension of the output of the feature fusion module. The low-frequency feature vector output by the feature vector or dimension transformation module This layer treats the feature vector as having a length of For sequences with 1 channel, use The sequence is convolved using a 3x3 one-dimensional convolution kernel, and the result is processed using the ReLU activation function to obtain a one-dimensional... The feature map is output, where The value range is from 1 to 10;

[0052] The second layer is a pooling layer, whose input is the dimension of the output of the convolutional layer. The feature map is used in this layer, which employs max pooling to downsample the feature map along its length dimension, using one dimension as the feature map. The feature map is generated and output;

[0053] The third layer is a flattening layer, whose input is the dimension of the pooling layer's output. characteristic map, the layer performs a flattening operation on the characteristic map to obtain a one-dimensional vector with a dimension of and outputs;

[0054] The fourth layer is a fully connected layer, the input of which is the one-dimensional vector output by the flattening layer, and the layer uses a weight matrix with a dimension of to linearly transform the one-dimensional vector into a projection vector with a dimension of to obtain the projection vector and output, wherein The value range of is 128 to 4096, when the input of the first layer is , the output of the present fully connected layer is the low-frequency projection vector ; when the input of the first layer is , the output of the present fully connected layer is the high-frequency projection vector .

[0055] Preferably, the anomaly detection model is trained by the following steps:

[0056] A. Obtain the low-frequency monitoring quantity of the industrial control system periodically at a collection period , all the collected low-frequency monitoring quantities constitute a low-frequency feature vector , obtain high-frequency sub-windows at a collection period , obtain the high-frequency feature vector of the industrial control system in the th high-frequency sub-window , all the high-frequency feature vectors corresponding to the collected high-frequency sub-windows constitute a high-frequency feature vector set , repeat the present collection process for a total of times to obtain low-frequency feature vectors and their corresponding N high-frequency feature vector sets ; wherein N is any natural number, i∈[1,N];

[0057] B. Obtain the training data set from all the low-frequency feature vectors and their corresponding high-frequency feature vector sets obtained in step A;

[0058] C. Randomly initialize the model parameters , , , and of the linear transformation matrix and the projection network in the feature transformation network to obtain the initialized feature transformation network and the projection network ;

[0059] D. For each sample in the training dataset Dataset obtained in step B In this case, the sample is input into the initialized feature transformation network obtained in step C. In order to obtain the mapped low-frequency feature vector corresponding to the sample. and online fusion feature vectors , where idx is the sample index, and idx∈[1,2N];

[0060] E. The online fusion feature vector obtained in step D. and the mapped low-frequency feature vector The projection network in the anomaly detection model after input initialization Training loss calculation and parameter optimization are performed to obtain the optimized feature transformation network parameters. and optimized projection network parameters ;

[0061] F. Repeat steps D to E above until the training loss reaches the set threshold T or the maximum number of training iterations are reached, in order to obtain a well-trained anomaly detection model.

[0062] Preferably, step B specifically includes the following sub-steps:

[0063] (B1) Combine each low-frequency feature vector from the same acquisition period with its corresponding high-frequency feature vector set from all low-frequency feature vectors obtained in step A to form a positive sample. All positive samples constitute the positive sample dataset.

[0064] ;

[0065] in Indicates the current sample Positive samples;

[0066] (B2) From all the low-frequency feature vectors and corresponding high-frequency feature vector sets obtained in step A, select the first... The low-frequency feature vector obtained from the second acquisition With the The set of high-frequency feature vectors obtained from the second collection Combined into negative samples, all negative samples constitute the negative sample dataset:

[0067] ;

[0068] in Indicates the current sample Negative samples;

[0069] (B3) merging the positive sample dataset obtained in step (B2) and the negative sample dataset obtained in step (B3) into a training dataset for similarity learning:

[0070]

[0071] is a set intersection operator.

[0072] Step D specifically comprises the following sub-steps:

[0073] (D1) for each sample in the training dataset Dataset obtained in step B, obtaining a linear transformation matrix from the feature transformation network, and multiplying the low-frequency feature vector in the sample by the linear transformation matrix to obtain a mapped low-frequency feature vector corresponding to the sample:

[0074]

[0075] (D2) for each sample in the training dataset Dataset obtained in step B, obtaining a linear transformation matrix from the feature transformation network, and multiplying the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) by the linear transformation matrix to obtain a query vector corresponding to the sample:

[0076]

[0077] wherein d denotes the internal dimension of the attention mechanism, and d has the meaning of:

[0078] (D3) for each sample in the training dataset Dataset obtained in step B, obtaining linear transformation matrices and from the feature transformation network, and multiplying each high-frequency feature vector in the set of high-frequency feature vectors in the sample by the linear transformation matrices and, respectively, to obtain a set of key vectors corresponding to the sample: ​​​​​​​​​​​​​​​​​​​​​​​​​​​a value vector set corresponding to the sample wherein

[0079] ;

[0080] ;

[0081] (D4) for each sample in the training data set Dataset obtained in step B , the query vector corresponding to the sample obtained in step (D2) is calculated with the key vector in the key vector set obtained in step (D3) , and the similarity calculation result is normalized by a softmax function to obtain the attention weight corresponding to the key vector in the key vector set :

[0082] ;

[0083] wherein denotes matrix transposition;

[0084] (D5) for each sample in the training data set Dataset obtained in step B , the attention weight corresponding to the key vector in the key vector set obtained in step (D4) and the corresponding value vector in the value vector set , the online fusion feature vector corresponding to the sample is obtained :

[0085] ;

[0086] wherein the online fusion feature vector .

[0087] Preferably, step E specifically comprises the following sub-steps:

[0088] (E1) for each sample in the training data set Dataset obtained in step B , the online fusion feature vector corresponding to the sample obtained in step (D5) is input into a projection network to obtain the online high-frequency projection vector corresponding to the sample :

[0089] ;

[0090] wherein, is the projection network​​​ parameters of the training data set Dataset obtained in step B;

[0091] (E2) for each sample in the training data set Dataset obtained in step B , the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) is input into the projection network to obtain the online low-frequency projection vector corresponding to the sample :

[0092] ;

[0093] (E3) for each sample in the training data set Dataset obtained in step B , the online high-frequency projection vector corresponding to the sample obtained in step (E1) and the online low-frequency projection vector corresponding to the sample obtained in step (E2) are obtained as the cosine similarity corresponding to the sample :

[0094] ;

[0095] wherein denotes the two-norm of a vector;

[0096] (E4) for each sample in the training data set Dataset obtained in step B , the cosine similarity corresponding to the sample obtained in step (E3) is used to calculate the training loss corresponding to the sample:

[0097] ;

[0098] wherein if the sample is from the positive sample data set , i.e. the low-frequency feature vector and the high-frequency feature vector set come from the same acquisition cycle, then the label of the sample ; if the sample is from the negative sample data set , i.e. the low-frequency feature vector and the high-frequency feature vector set come from different acquisition cycles, and the label of the sample is set to the similarity interval threshold, is the maximum value function;

[0099] (E5) according to the training loss obtained in step (E4) and the projection network parameters are jointly optimized by a gradient descent type optimization algorithm to obtain the optimized feature transformation network parameters and the optimized projection network parameters . .

[0100] According to another aspect of the present application, there is provided an industrial control abnormality detection system based on high-low frequency feature similarity, comprising the following modules:

[0101] The first module is configured to periodically obtain low-frequency monitoring quantities of the industrial control system at a sampling period All the collected low-frequency monitoring quantities constitute a low-frequency feature vector The second module is configured to obtain high-frequency sub-windows at a sampling period , and obtain a high-frequency feature vector of the industrial control system in the th high-frequency sub-window All the collected high-frequency sub-windows correspond to a high-frequency feature vector set ; wherein the low-frequency feature vector , is the low-frequency feature dimension, represents the set of all real numbers, the sampling period is in the range of 1 second to 60 seconds, and the sampling period is in the range of 100 milliseconds to 800 milliseconds; the high-frequency feature vector set , is the high-frequency feature dimension, ∈[1, ];

[0102] The second module is configured to input the low-frequency feature vector and the high-frequency feature vector set obtained by the first module into a feature transformation network of a pre-trained abnormality detection model, respectively, to obtain a mapped low-frequency feature vector and an online fusion feature vector , respectively.

[0103] The third module is configured to input the online fusion feature vector and the mapped low-frequency feature vector obtained by the second module into a projection network of the pre-trained abnormality detection model, to obtain an abnormality detection result of the industrial control system.

[0104] ​Overall, compared with the prior art, the above technical solutions conceived by the present application can achieve the following beneficial effects:

[0105] 1、The present application adopts steps (1) to (2), which synchronously constructs a low-frequency feature vector and a plurality of high-frequency sub-window feature vectors in the same low-frequency acquisition period, and fuses the high-frequency features based on an attention mechanism, thereby solving the technical problems of the existing rule-based anomaly detection method that is difficult to simultaneously utilize high-frequency and low-frequency features and has insufficient detection accuracy;

[0106] 2、The present application adopts steps (1) to (2-5), which maps the low-frequency features to a high-frequency feature space and dynamically weights and fuses a plurality of high-frequency sub-window features, thereby simultaneously representing short-time changes and long-time trends of the running state of an industrial control system, thereby solving the technical problems of the existing statistical analysis-based anomaly detection method that relies only on single-time-scale features and has limited anomaly recognition capability;

[0107] 3、The present application adopts steps (2) to (3-3), which calculates the similarity of the fused high-frequency features and low-frequency features in a unified feature space, thereby realizing anomaly discrimination without manual labeling of abnormal samples, thereby solving the technical problems of the existing machine learning-based anomaly detection method that has strong dependence on sample labels and insufficient generalization capability;

[0108] 4、The present application adopts steps (1) to (3), which uses a relatively simple feature transformation network, an attention fusion mechanism, and a similarity calculation method to complete anomaly detection, thereby solving the technical problems of the existing deep learning-based anomaly detection method that has a complex model, high deployment cost, and difficulty in meeting the real-time requirements of industrial sites;

[0109] 5、The anomaly detection process of the present application only relies on general monitoring data of an industrial control system, without limiting specific communication protocols, device types, or network topologies, thereby being applicable to a variety of industrial control system scenarios and having strong universality and applicability. BRIEF DESCRIPTION OF DRAWINGS

[0110] Figure 1 is a flowchart of the industrial control abnormality detection method of the present application based on high-low frequency feature similarity;

[0111] Figure 2 is a network architecture diagram of the anomaly detection model used by the present application. DETAILED DESCRIPTION

[0112] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application. In addition, the technical features involved in the various embodiments of the present application described below can be combined with each other as long as there is no conflict.

[0113] It should be noted that in the description of the embodiments of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the existence of other identical elements in the process, method, article or device comprising the element. The terms "upper", "lower" and the like indicate the orientation or positional relationship shown in the drawings, and are only used to facilitate the description of the present application and simplify the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. For those of ordinary skill in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0114] In addition, the technical solutions of various embodiments of the present application can be combined with each other, but must be based on the fact that a person of ordinary skill in the art can implement it, and when the combination of technical solutions appears contradictory or unimplementable, it should be considered that the combination of technical solutions does not exist, nor is it within the scope of protection required by the present application.

[0115] The basic idea of the present application is to provide an industrial control abnormality detection method based on high and low frequency feature similarity. The method implements a hierarchical feature processing mechanism, first collects monitoring data periodically from the industrial control system site, constructs a corresponding low frequency feature vector and a high frequency feature set. Through repeated data collection, a training data set containing multiple samples is formed. In the initialization process of the abnormality detection network, the combination of feature transformation network and projection network is adopted to ensure the effective mapping and fusion of low frequency features and high frequency features. Specifically, the low frequency feature vector is mapped to a unified dimension through a linear transformation matrix, while the high frequency feature is directly input into the attention fusion mechanism to calculate the dynamic correlation degree of the high frequency feature to the low frequency feature. Finally, the projection network is used to map the fused features and the low frequency features to generate a vector pair for similarity learning. The present application aims to solve the problems of traditional industrial control system abnormality detection methods in feature processing and fusion. On the one hand, through the effective fusion of high and low frequency features, the accuracy of abnormality detection is significantly improved, and the false positive rate is reduced; on the other hand, combined with the similarity learning mechanism, the system can timely identify and respond to potential abnormal situations, meeting the high requirements of real-time and accuracy in industrial control environment. In addition, since the present application adopts integrated design in feature processing, similarity calculation and model training, etc., not only the overall performance of the detection system is improved, but also the limitations of traditional methods in data processing efficiency and abnormality recognition ability are overcome.

[0116] As shown in Figure 1 , the present application provides an industrial control abnormality detection method based on high and low frequency feature similarity, comprising the following steps:

[0117] (1) periodically acquiring low frequency monitoring quantities of the industrial control system at a sampling period , all the acquired low frequency monitoring quantities constitute a low frequency feature vector , acquiring high frequency sub-windows at a sampling period , acquiring a high frequency feature vector of the industrial control system in the th high frequency sub-window, all the acquired high frequency feature vectors corresponding to the high frequency sub-windows constitute a high frequency feature vector set ; wherein the low frequency feature vector , is the low frequency feature dimension, represents the set of all real numbers, the sampling period ranges from 1 second to 60 seconds, preferably 10 seconds, and the sampling period ranges from 100 milliseconds to 800 milliseconds, preferably 500 milliseconds; the high frequency feature vector set , is the high frequency feature dimension, ∈ [1, ];

[0118] Specifically, the low-frequency monitoring quantities include, but are not limited to, voltage effective value, current effective value, active power, reactive power, device temperature, on-off state, pressure plate state, SetPoint instruction quantity, etc.; the high-frequency monitoring quantities include, but are not limited to, instantaneous sampling value, high-frequency harmonic feature, Phasor Measurement Unit (PMU) data, etc.

[0119] The step (1) has the advantages that: the low-frequency feature vector and the plurality of high-frequency sub-window feature vectors are synchronously acquired in the same low-frequency acquisition cycle, which provides basic data support for subsequent unified modeling and fusion analysis of the high-frequency and low-frequency features, and is beneficial to comprehensively depicting the operation state of the industrial control system.

[0120] (2) input the low-frequency feature vector and the high-frequency feature vector set into the feature transformation network of the pre-trained anomaly detection model respectively, to obtain the mapped low-frequency feature vector and the online fusion feature vector respectively;

[0121] The step specifically includes the following sub-steps:

[0122] (2-1) obtain a linear transformation matrix from the feature transformation network, and multiply the low-frequency feature vector obtained in step (1) by the linear transformation matrix to obtain the mapped low-frequency feature vector , wherein represents the dimension of the mapped low-frequency feature vector :

[0123] ;

[0124] (2-2) obtain a linear transformation matrix from the feature transformation network, and multiply the mapped low-frequency feature vector obtained in step (2-1) by the linear transformation matrix to obtain a query vector :

[0125] ;

[0126] wherein represents the internal dimension of the attention mechanism, and ;

[0127] (2-3) Obtain a linear transformation matrix from the feature transformation network and , respectively, to obtain a key vector set and a value vector set , respectively. and , respectively. and , where:

[0128] ;

[0129] ;

[0130] (2-4) Calculate the similarity between the query vector obtained in step (2-2) and the i-th key vector in the key vector set obtained in step (2-3) , and normalize the similarity calculation result by the softmax function to obtain the attention weight corresponding to the i-th key vector in the key vector set :

[0131] ;

[0132] where denotes matrix transposition;

[0133] (2-5) According to the attention weight corresponding to the i-th key vector in the key vector set obtained in step (2-4) and the corresponding value vector in the value vector set , obtain the online fusion feature vector :

[0134]

[0135] where the online fusion feature vector ;

[0136] The advantage of this step (2) is that by dimension mapping the low-frequency features and introducing the attention mechanism to weight the fusion of multiple high-frequency sub-window features, the effective fusion of features of different time scales in a unified feature space is realized, and the accuracy and robustness of feature expression are improved.

[0137] ​​​The advantages of the above sub-steps (2-2) to (2-5) are: using low-frequency features as query vectors, multiple high-frequency features within the same time window are dynamically weighted, which effectively characterizes the correlation between high-frequency features and low-frequency operating states, and improves the sensitivity of high-frequency feature fusion results to changes in system state.

[0138] (3) The online fusion feature vector obtained in step (2) and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain anomaly detection results for industrial control systems.

[0139] This step specifically includes the following sub-steps:

[0140] (3-1) The online fusion feature vector obtained in step (2-5) Input projection network To obtain the online high-frequency projection vector :

[0141]

[0142] in, For projection networks Learnable parameters in;

[0143] (3-2) Map the low-frequency feature vector obtained in step (2-1) Input projection network To obtain the online low-frequency projection vector :

[0144]

[0145] (3-3) Calculate the online high-frequency projection vector obtained in step (3-1). The online low-frequency projection vector obtained in step (3-2) Cosine similarity between :

[0146]

[0147] in, The second norm of the orientation quantity;

[0148] (3-4) Determine the cosine similarity obtained in step (3-3). Is it greater than or equal to the preset anomaly detection threshold? If yes, it indicates that the industrial control system is in normal operating condition and the process ends; otherwise, it indicates that the industrial control system is in abnormal operating condition, outputs an abnormal alarm, and the process ends.

[0149] Specifically, the preset anomaly detection threshold The value range is from 0.1 to 0.9, preferably 0.5.

[0150] like Figure 2 As shown, the anomaly detection model of the present invention includes a series of connected feature transformation networks. and projection network Two parts.

[0151] The specific structure of the feature transformation network is as follows:

[0152] The first layer is the dimension transformation module, whose input is a dimension of... low-frequency feature vectors This module utilizes a dimension as The linear transformation matrix and the low-frequency eigenvector Multiply to obtain a dimension of low-frequency feature vectors And output;

[0153] This module maps low-frequency features to the same dimensional space as high-frequency features through matrix multiplication, preparing for subsequent similarity calculations.

[0154] The second layer is the feature fusion module, whose input includes... Each dimension is The set of high-frequency feature vectors and the low-frequency feature vector output by the dimension transformation module. This module uses this low-frequency feature vector For query objects, and utilize attention mechanisms from the set The attention weights are dynamically calculated and the most relevant feature information is aggregated in a weighted manner to obtain a dimension of 1. fusion feature vector And output;

[0155] The projection network uses a one-dimensional convolutional neural network (1DCNN), and its specific structure is as follows:

[0156] The first layer is a convolutional layer, whose input is the dimension of the output of the feature fusion module. The low-frequency feature vector output by the feature vector or dimension transformation module This layer treats the feature vector as having a length of For sequences with 1 channel, use The sequence is convolved using a 3x3 one-dimensional convolution kernel, and the result is processed using the ReLU activation function to obtain a one-dimensional... The feature map is output, where The value range is from 1 to 10, with 3 being the preferred value.

[0157] This layer aims to extract the local combination relationships between adjacent elements in the input feature vector.

[0158] The second layer is a pooling layer, whose input is the dimension of the output of the convolutional layer. The feature map is used in this layer, which employs max pooling to downsample the feature map along its length dimension, using one dimension as the feature map. The feature map is generated and output.

[0159] This layer aims to reduce the dimensionality of features, retain the most significant feature information, and improve the model's generalization ability.

[0160] The third layer is a flattening layer, whose input is the dimension of the pooling layer's output. The feature map is flattened by this layer to obtain a feature map with dimension 1. Output a one-dimensional vector;

[0161] The fourth layer is a fully connected layer, whose input is a one-dimensional vector output from the flattened layer. This layer uses a dimension of... A weight matrix of dimension 1 transforms the one-dimensional vector linearly into a one-dimensional vector. The projection vector is used to obtain the projection vector (where the input of the first layer is...). At that time, the output of this fully connected layer is a low-frequency projection vector. When the input of the first layer is At that time, the output of this fully connected layer is a high-frequency projection vector. And output, where The value range is from 128 to 4096, with 1024 being the preferred value.

[0162] The anomaly detection model of this invention is trained through the following steps:

[0163] A. Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. , repeat the acquisition process a total of times to obtain low-frequency feature vectors and their corresponding N sets of high-frequency feature vectors ; wherein the low-frequency feature vector , the subscript 1 in the low-frequency feature vector indicates that this step A is performed for the first time, is the low-frequency feature dimension, represents the set of all real numbers, the sampling period ranges from 1 second to 60 seconds, preferably 10 seconds, and the sampling period ranges from 100 milliseconds to 800 milliseconds, preferably 500 milliseconds, and the set of high-frequency feature vectors , is the high-frequency feature dimension, ∈[1, ], wherein N is any natural number, and i ∈ [1, N];

[0164] Specifically, the low-frequency monitoring quantities include but are not limited to: voltage effective value, current effective value, active power, reactive power, device temperature, on-off state, pressure plate state, SetPoint instruction quantity, etc.; the high-frequency monitoring quantities include but are not limited to: instantaneous sampling value, high-frequency harmonic feature, Phasor Measurement Unit (PMU) data, etc.

[0165] B, obtain a training data set from all the low-frequency feature vectors and their corresponding sets of high-frequency feature vectors obtained in step A;

[0166] This step specifically includes the following sub-steps:

[0167] (B1) Combine each low-frequency feature vector and its corresponding set of high-frequency feature vectors from the same acquisition period in all the low-frequency feature vectors and their corresponding sets of high-frequency feature vectors obtained in step A into a positive sample, and all the positive samples constitute a positive sample data set:

[0168] ;

[0169] wherein represents the current sample is a positive sample;

[0170] (B2) From all the low-frequency feature vectors and their corresponding sets of high-frequency feature vectors obtained in step A, combine the low-frequency feature vector obtained in the i-th acquisition with the set of high-frequency feature vectors obtained in the i-th acquisition to obtain a negative sample, and all the negative samples constitute a negative sample data set: ​Combined into negative samples, all negative samples constitute the negative sample dataset:

[0171] ;

[0172] in Indicates the current sample Negative samples;

[0173] (B3) The positive sample dataset obtained in step (B2) Compared with the negative sample dataset obtained in step (B3) Merged into a training dataset for similarity learning:

[0174] ;

[0175] in, This is the intersection operator for sets.

[0176] Training dataset It contains both homologous high- and low-frequency feature samples and non-homologous high- and low-frequency feature samples.

[0177] The advantage of step B is that by recombining the low-frequency feature vectors and high-frequency feature vectors in the original collected data, a training dataset with positive and negative samples is constructed. The construction method is simple and applicable to subsequent similarity-based model training methods.

[0178] C. Feature Transformation Network linear transformation matrix in , , , and projection network Model parameters Perform random initialization to obtain the initialized feature transformation network. and projection network ;

[0179] D. For each sample in the training dataset Dataset obtained in step B In this case, the sample is input into the initialized feature transformation network obtained in step C. In order to obtain the mapped low-frequency feature vector corresponding to the sample. and online fusion feature vectors , where idx is the sample index, and idx∈[1,2N];

[0180] This step specifically includes the following sub-steps:

[0181] (D1) For each sample in the training dataset Dataset obtained in step B In particular, a linear transformation matrix is obtained from the feature transformation network , and the low-frequency feature vector in the sample is multiplied by the linear transformation matrix to obtain the mapped low-frequency feature vector corresponding to the sample :

[0182] ;

[0183] (D2) For each sample in the training data set Dataset obtained in step B , a linear transformation matrix is obtained from the feature transformation network , and the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) is multiplied by the linear transformation matrix to obtain the query vector corresponding to the sample :

[0184] ;

[0185] wherein represents the internal dimension of the attention mechanism, and ;

[0186] (D3) For each sample in the training data set Dataset obtained in step B , a linear transformation matrix is obtained from the feature transformation network and , each high-frequency feature vector in the high-frequency feature vector set in the sample is multiplied by the linear transformation matrix and to obtain the key vector set corresponding to the sample and the value vector set corresponding to the sample , respectively, wherein:

[0187] ;

[0188] ;

[0189] (D4) For each sample in the training data set Dataset obtained in step B , the query vector corresponding to the sample obtained in step (D2) is multiplied by the th key vector in the key vector set obtained in step (D3) ​​The similarity is calculated, and the similarity calculation result is normalized by a softmax function to obtain the attention weight corresponding to the i-th key vector in the key vector set :

[0190] ;

[0191] wherein represents matrix transposition;

[0192] (D5) For each sample in the training data set Dataset obtained in step B , the attention weight corresponding to the i-th key vector in the key vector set obtained in step (D4) and the corresponding value vector in the value vector set are obtained , to obtain the online fusion feature vector corresponding to the sample :

[0193] ;

[0194] wherein the online fusion feature vector ;

[0195] E, the online fusion feature vector and the mapped low-frequency feature vector obtained in step D are input into the projection network of the initialized anomaly detection model to perform training loss calculation and parameter optimization, so as to obtain the optimized feature transformation network parameter and the optimized projection network parameter .

[0196] This step specifically includes the following sub-steps:

[0197] (E1) For each sample in the training data set Dataset obtained in step B , the online fusion feature vector corresponding to the sample obtained in step (D5) is input into the projection network to obtain the online high-frequency projection vector corresponding to the sample :

[0198] ;

[0199] wherein is the parameter of the projection network ;

[0200] (E2) For each sample in the training data set Dataset obtained in step B​ For each sample in the training data set Dataset obtained in step B, the online high-frequency projection vector corresponding to the sample obtained in step (E1) Input the projection network to obtain the online low-frequency projection vector corresponding to the sample :

[0201] ;

[0202] (E3) For each sample in the training data set Dataset obtained in step B, calculate the cosine similarity between the online high-frequency projection vector corresponding to the sample obtained in step (E1) and the online low-frequency projection vector corresponding to the sample obtained in step (E2) as the cosine similarity corresponding to the sample :

[0203] ;

[0204] wherein denotes the two-norm of a vector;

[0205] (E4) For each sample in the training data set Dataset obtained in step B, calculate the training loss corresponding to the sample according to the cosine similarity corresponding to the sample obtained in step (E3) :

[0206] Specifically, the training loss of the sample is obtained by the following formula:

[0207] ;

[0208] Specifically, if the sample is from the positive sample data set , i.e. the low-frequency feature vector and the high-frequency feature vector set come from the same acquisition period, the label of the sample is ; if the sample is from the negative sample data set , i.e. the low-frequency feature vector and the high-frequency feature vector set come from different acquisition periods, let the label of the sample be , the similarity interval threshold is used to limit the upper bound of the similarity of the negative sample, and the value is preferably ; is the maximum value function.

[0209] (E5) According to the training loss obtained in step (E4) ​​​And the feature transformation network parameters are optimized using a gradient descent-type optimization algorithm (stochastic gradient descent algorithm is used in this embodiment). ) and projection network parameters ( Joint optimization is performed to obtain the optimized feature transformation network parameters. ) and optimized projection network parameters ( );

[0210] F. Repeat steps D to E above until the training loss reaches the set threshold T (0.02 in this invention) or the maximum number of training iterations (200 in this invention) to obtain a trained anomaly detection model.

[0211] Experimental results

[0212] To demonstrate the effectiveness of the method and its improvement in classification performance, real operational data from a power industry control system was selected as the experimental dataset, and comparative experiments were conducted with several mainstream anomaly detection algorithms. The Isolation Forest method primarily identifies anomalies by randomly partitioning the feature space; the Autoencoder method judges anomalies through reconstruction errors; and the Long Short-Term Memory (LSTM) method detects anomalies by modeling the time-series variation patterns. The method of this invention, however, simultaneously fuses high-frequency and low-frequency features and characterizes the consistency relationship between high- and low-frequency features based on attention mechanisms and similarity learning, thereby achieving the discrimination of abnormal behavior.

[0213] The experimental results are shown in the table below. As can be seen from the table, under the same dataset and experimental conditions, the method of this invention outperforms the comparison algorithms in terms of anomaly detection accuracy, recall, and F1 score. This indicates that by fusing high-frequency and low-frequency features and performing anomaly discrimination based on similarity, this invention can effectively improve the overall performance of anomaly detection in industrial control systems.

[0214]

[0215] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An industrial control abnormality detection method based on high and low frequency feature similarity, characterized in that, The method comprises the following steps: (1) acquire low-frequency monitoring quantities of the industrial control system periodically All acquired low-frequency monitoring quantities constitute a low-frequency feature vector , acquire high-frequency sub-windows periodically , acquire a high-frequency feature vector of the industrial control system in the th high-frequency sub-window , and all acquired high-frequency sub-windows correspond to a high-frequency feature vector set ; wherein the low-frequency feature vector , is a low-frequency feature dimension, represents a set of all real numbers, the sampling period ranges from 1 second to 60 seconds, and the sampling period ranges from 100 milliseconds to 800 milliseconds; the high-frequency feature vector set , is a high-frequency feature dimension, ∈ [1, ]. (2) The low-frequency feature vector obtained in step (1) and high-frequency feature vector set Input the feature transformation network into the pre-trained anomaly detection model respectively In the process, the mapped low-frequency feature vectors are obtained respectively. and online fusion feature vectors Step (2) includes the following sub-steps: (2-1) obtaining a linear transformation matrix from the feature transformation network and multiplying the low-frequency feature vector obtained in step (1) by the linear transformation matrix to obtain a mapped low-frequency feature vector wherein denotes the dimension of the mapped low-frequency feature vector . ； (2-2) Obtain a linear transformation matrix from the feature transformation network and multiply the mapped low-frequency feature vector obtained in step (2-1) by the linear transformation matrix to obtain a query vector : ； wherein represents the internal dimension of the attention mechanism, and has ; (2-3) Obtain the linear transformation matrix from the feature transformation network and The set of high-frequency feature vectors obtained in step (1) Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the key vector set respectively Sum value vector set ,in: ； ； (2-4) performing similarity calculation on the query vector obtained in step (2-2) and each of the key vector set obtained in step (2-3) :​​​​ ； wherein denotes matrix transposition; (2-5) obtaining an attention weight corresponding to a key vector in the set of key vectors obtained in step (2-4) and a value vector in the set of value vectors corresponding to the key vector to obtain an online fusion feature vector ​ ； wherein the online fusion feature vector ; (3) The online fusion feature vector obtained in step (2) and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is input. To obtain the anomaly detection results of the industrial control system; step (3) specifically includes the following sub-steps: (3-1) obtaining the online fusion feature vector from step (2-5) input projection network to obtain the online high-frequency projection vector : ； wherein, are learnable parameters in the projection network ​ (3-2) mapping the low-frequency feature vector obtained in step (2-1) to obtain an online low-frequency projection vector input projection network to obtain an online low-frequency projection vector : ； (3-3) calculating the cosine similarity between the online high-frequency projection vector obtained in step (3-1) and the online low-frequency projection vector obtained in step (3-2) :​ ； wherein denotes the two-norm of the orientation vector; (3-4) judging the cosine similarity obtained in step (3-3) whether greater than or equal to a preset abnormality detection threshold if yes, it indicates that the industrial control system is in a normal working condition, and the process ends, otherwise, it indicates that the industrial control system is in an abnormal working condition, and an abnormal alarm is output, and the process ends.

2. The industrial control abnormality detection method based on high and low frequency feature similarity according to claim 1, characterized in that, The low frequency monitoring quantities comprise voltage effective value, current effective value, active power, reactive power, equipment temperature, closing and opening state, pressure plate state and SetPoint instruction quantity. The high frequency monitoring quantities comprise instantaneous sampling value, high frequency harmonic feature and phasor measurement unit (PMU) phasor.

3. The industrial control abnormality detection method based on high and low frequency feature similarity according to claim 1, characterized in that, The anomaly detection model comprises a feature transformation network connected in sequence and a projection network two parts; The specific structure of the feature transformation network is as follows: The first layer is a dimension transformation module, whose input is a low-frequency feature vector with dimension The module multiplies a low-frequency feature vector with a linear transformation matrix with dimension to obtain a low-frequency feature vector with dimension and outputs.​​​ The second layer is the feature fusion module, whose input includes... Each dimension is The set of high-frequency feature vectors and the low-frequency feature vector output by the dimension transformation module. This module uses this low-frequency feature vector For query objects, and utilize attention mechanisms from the collection The attention weights are dynamically calculated and the most relevant feature information is aggregated in a weighted manner to obtain a dimension of 1. fused feature vector And output it.

4. The industrial control abnormality detection method based on high and low frequency feature similarity according to claim 3, characterized in that, The projection network adopts one-dimensional convolutional neural network (1DCNN) and its specific structure is as follows: The first layer is a convolutional layer, an input of which is a feature vector with a dimension of output by the feature fusion module or a low-frequency feature vector output by the dimension transformation module The layer takes the feature vector as a sequence with a length of and a channel number of 1, uses one-dimensional convolution kernels with a size of 3 to perform convolution operation on the sequence, and uses a ReLU activation function to process a result of the convolution operation, to obtain a feature map with a dimension of and output, wherein a value range of the dimension is 1 to 10; The second layer is a pooling layer, whose input is a feature map with dimensions of outputted by the convolution layer, the layer uses a max pooling operation to down-sample the feature map in the length dimension to a feature map with dimensions of and outputs; The third layer is a flattening layer, which takes as input a feature map of dimension output by the pooling layer, performs a flattening operation on the feature map to obtain a one-dimensional vector of dimension and outputs the one-dimensional vector. The fourth layer is a fully connected layer, which takes as input a one-dimensional vector from the flattened layer output, and uses a weight matrix of dimension to linearly transform the one-dimensional vector into a projection vector of dimension to obtain the projection vector and output, where The value of ranges from 128 to 4096, and when the input of the first layer is the output of the present fully connected layer is the low-frequency projection vector ; When the input to the first layer is the output of the present fully connected layer is the high frequency projection vector .

5. The industrial control abnormality detection method based on high and low frequency feature similarity according to claim 4, characterized in that, The abnormality detection model is obtained through the following steps: A. Based on the collection cycle Low-frequency monitoring data from the industrial control system are periodically acquired, and all collected low-frequency monitoring data constitute a low-frequency feature vector. According to the collection cycle Get The high-frequency sub-window, at the... High-frequency feature vectors of industrial control systems are obtained from high-frequency sub-windows. The high-frequency feature vectors corresponding to all the high-frequency sub-windows collected constitute a high-frequency feature vector set. Repeat this collection process a total of Next, to obtain Low-frequency feature vectors and its corresponding set of N high-frequency feature vectors Where N is any natural number, i∈[1,N]; B. obtaining a training dataset from all low frequency eigenvectors obtained in step A and their corresponding set of all high frequency eigenvectors ; C. Feature Transformation Network linear transformation matrix in , , , and projection network Model parameters Perform random initialization to obtain the initialized feature transformation network. and projection network ; D. For each sample in the training dataset Dataset obtained in step B The sample is input into the initialized feature transformation network obtained in step C to obtain the mapped low-frequency feature vector corresponding to the sample and the online fusion feature vector where idx is the sample index, and idx∈[1, 2N]. E、the online fusion feature vector obtained in step D and the mapped low-frequency feature vector input the projection network in the initialized anomaly detection model perform training loss calculation and parameter optimization to obtain optimized feature transformation network parameters and the optimized projection network parameters ; F. Repeat steps D to E until the training loss reaches the set threshold T or the maximum training number is reached to obtain the trained abnormality detection model.

6. The industrial control abnormality detection method based on high and low frequency feature similarity according to claim 5, characterized in that, Step B specifically comprises the following sub-steps: (B1) Each low frequency feature vector and its corresponding high frequency feature vector set from the same collection period are combined into a positive sample, and all positive samples constitute a positive sample data set. ； wherein represents the current sample is a positive sample; (B2) From all the low-frequency feature vectors and corresponding high-frequency feature vector sets obtained in step A, select the first... The low-frequency feature vector obtained from the second acquisition With the The set of high-frequency feature vectors obtained from the second collection Combined into negative samples, all negative samples constitute the negative sample dataset: ； wherein represents the current sample is a negative sample; (B4) The positive sample dataset obtained in step (B2) Compared with the negative sample dataset obtained in step (B3) Merged into a training dataset for similarity learning: ； wherein is a set intersection operator; Step D specifically comprises the following sub-steps: (D1) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and the sample low-frequency feature vectors With the linear transformation matrix Multiply to obtain the mapped low-frequency feature vector corresponding to the sample. : ； (D2) for each sample in the training dataset Dataset obtained in step B In terms of obtaining a linear transformation matrix from the feature transformation network , and multiplying the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) by the linear transformation matrix to obtain the query vector corresponding to the sample : ； wherein represents the internal dimension of the attention mechanism, and has ; (D3) For each sample in the training dataset Dataset obtained in step B In other words, obtaining the linear transformation matrix from the feature transformation network. and The sample High-frequency feature vector set in Each high-frequency feature vector in Multiply by the linear transformation matrix respectively and To obtain the set of key vectors corresponding to each sample. The set of value vectors corresponding to this sample ,in: ； ； (D4) For each sample in the training data set Dataset obtained in step B In terms of the sample corresponding to the query vector obtained in step (D2) The first key vector in the key vector set obtained in step (D3) Similarity calculation is performed, and the similarity calculation result is normalized by a softmax function to obtain the attention weight corresponding to the first key vector in the key vector set : ； wherein denotes matrix transposition; (D5) For each sample in the training dataset Dataset obtained in step B , the attention weight corresponding to the k-th key vector in the key vector set obtained in step (D4) , and the value vector corresponding to the k-th key vector in the value vector set obtained in step (D4) , the online fusion feature vector corresponding to the sample is obtained as follows: ； where the online fusion feature vector .

7. The industrial control abnormality detection method based on high and low frequency feature similarity according to claim 6, characterized in that, Step E specifically comprises the following sub-steps: (E1) for each sample in the training dataset Dataset obtained in step B In this regard, the online fusion feature vector corresponding to the sample obtained in step (D5) input projection network to obtain the online high-frequency projection vector corresponding to the sample : ； wherein, parameters of the projection network ; (E2) for each sample in the training dataset Dataset obtained in step B In this regard, the mapped low-frequency feature vector corresponding to the sample obtained in step (D1) input projection network to obtain the online low-frequency projection vector corresponding to the sample : ； (E3) for each sample in the training dataset Dataset obtained in step B the cosine similarity between the online high-frequency projection vector corresponding to the sample obtained in step (El) and the online low-frequency projection vector corresponding to the sample obtained in step (E2) as the cosine similarity corresponding to the sample :​ ； wherein denotes the two-norm of the orientation vector; (E4) For each sample in the training dataset Dataset obtained in step B In terms of the cosine similarity corresponding to the sample obtained in step (E3) Calculate the training loss corresponding to the sample: ； wherein if the sample is from the positive sample dataset i.e. the low frequency feature vector and the high frequency feature vector set from the same acquisition cycle, then the label of the sample is ; if the sample is from the negative sample dataset i.e. the low frequency feature vector and the high frequency feature vector set from different acquisition cycles, let the label of the sample be the similarity interval threshold, is the max function. (E5) the training loss obtained according to step (E4) and the feature transformation network parameters and the projection network parameters are jointly optimized by a gradient descent type optimization algorithm to obtain the optimized feature transformation network parameters and the optimized projection network parameters .

8. An industrial control abnormality detection system based on high and low frequency feature similarity, which is implemented according to the industrial control abnormality detection method based on high and low frequency feature similarity in claim 1, characterized in that, The industrial control abnormality detection system comprises the following modules: The first module is configured to acquire low-frequency monitoring data of the industrial control system at a sampling period The low-frequency monitoring data acquired at the sampling period The high-frequency sub-window The high-frequency feature vector of the industrial control system is acquired in the high-frequency sub-window The high-frequency feature vector corresponding to each high-frequency sub-window acquired at the sampling period The high-frequency feature vector corresponding to each high-frequency sub-window acquired at the sampling period The high-frequency feature vector corresponding to each high-frequency sub-window acquired at the sampling period The low-frequency feature vector , The low-frequency feature dimension is a set of all real numbers, and the sampling period is in the range of 1 second to 60 seconds, and the sampling period is in the range of 100 milliseconds to 800 milliseconds; the high-frequency feature vector set , The high-frequency feature dimension ∈[1, ]. The second module is configured to input the low-frequency feature vector obtained by the first module and the high-frequency feature vector set into a feature transformation network of a pre-trained anomaly detection model, respectively, to obtain a mapped low-frequency feature vector and an online fusion feature vector, respectively. ;​​​​ The third module is configured to obtain the online fusion feature vector from the second module and the mapped low-frequency feature vector The projection network in the pre-trained anomaly detection model is inputted to obtain the anomaly detection result of the industrial control system.

Images