Industrial control anomaly detection method based on iterative reasoning
The industrial control system anomaly detection method, which combines iterative reasoning with feature extraction, rollback, and classification networks, resolves the contradiction between detection accuracy and hardware resource consumption in resource-constrained environments, and achieves high-precision industrial control system anomaly detection.
Patent Information
- Application Number
- CN202511728968.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-24
- Publication Date
- 2026-03-06
AI Technical Summary
Existing industrial control anomaly detection methods face a trade-off between detection accuracy and hardware resource consumption in embedded or edge computing environments, making it difficult to guarantee high-precision anomaly detection under limited resources.
An industrial control anomaly detection method based on iterative reasoning is adopted. By combining feature extraction network, feature rollback network and classification network, the model is trained with diversity loss and cross-entropy loss to achieve multi-round sample feedback reasoning, thereby reducing hardware resource consumption and improving detection accuracy.
Under limited resources, multi-round iterative inference improves detection accuracy, significantly reduces GPU and memory overhead, and ensures detection stability and accuracy.
Smart Images
Figure CN121614930A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial control system security, and in particular to an industrial control system anomaly detection method based on iterative reasoning. Background Technology
[0002] With the widespread application of Industrial Control Systems (ICS), their security has become a crucial safeguard for national critical infrastructure and industrial production. Abnormal operation or attacks on ICS can lead to production stoppages, equipment damage, and even safety accidents, posing significant economic and security risks to enterprises and society. Therefore, how to detect abnormal behavior in ICS in real time and accurately has become an important research topic in the field of industrial information security.
[0003] Existing methods for anomaly detection in industrial control systems mainly include rule-based detection, statistical analysis methods, and detection methods based on machine learning and deep learning. While deep learning methods have achieved good results in feature extraction and anomaly detection, they typically require large-scale network structures and substantial computing resources, resulting in high GPU and system memory consumption and heavy computational load. This makes these methods unsuitable for the often resource-constrained embedded or edge computing environments common in industrial control systems, creating a trade-off between detection accuracy and hardware resource consumption. Summary of the Invention
[0004] The technical problem to be solved by the present invention is to provide a stable industrial control anomaly detection method that can guarantee anomaly detection accuracy and reduce resource consumption.
[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:
[0006] A method for detecting industrial control system anomalies based on iterative reasoning, the key of which includes the following steps:
[0007] S1. Data Acquisition Stage: Collect data and form a dataset;
[0008] S2, Model Training Phase: Train the anomaly detection model using the training dataset and joint loss to obtain the optimal anomaly detection model;
[0009] S3, Anomaly Detection Stage: Real-time acquisition of data samples to be detected, input into the optimal anomaly detection model, and the optimal anomaly detection model obtains the prediction vector after iterative reasoning on the input samples.
[0010] S4. Threshold Judgment Stage: Based on the prediction vector of the best anomaly detection model, the anomaly detection result is determined by comparing it with a threshold.
[0011] Preferably, the collected data forms a dataset, as follows:
[0012] Industrial control system monitoring data, including both normal and abnormal samples, is collected from the mirrored traffic ports of the switch to form a sample. ,in Indicates sample features, This indicates the corresponding category label.
[0013] Preferably, the anomaly detection model is trained using the training dataset and joint loss to obtain the optimal anomaly detection model, as follows:
[0014] The anomaly detection model includes a feature extraction network. Feature rollback network and classification networks Feature extraction network Feature rollback network and classification networks The network parameters are respectively expressed as: ;
[0015] S11. First, divide the dataset D into training sets. and test set Randomly initialize the network parameter set Set the number of inference iteration rounds for the anomaly detection model. Loss weighting coefficient and diversity constraint margin ;
[0016] S12, and then the training set The samples in the order as initial input Set the current inference iteration step As the initial input to the anomaly detection model, and setting the current inference iteration step. ;
[0017] S13, then restore the sample from the previous round. Input Feature Extraction Network The feature representation is obtained as follows:
[0018]
[0019] Represent the features Input features into the rollback network and classification networks The restored samples were obtained respectively. With the predicted probability vector :
[0020]
[0021] in, , Indicates the first In round-robin reasoning, the predicted probability that the input sample belongs to the normal state. Indicates the first The predicted probability that the input sample belongs to an abnormal state in round-robin reasoning;
[0022] Then calculate the diversity loss of this round of inference iteration. :
[0023]
[0024] in Represents the original sample With restored sample The Euclidean distance between them
[0025] S14, if this round Then As input for the next round, let Repeat S12 and S13; if Then proceed to S15;
[0026] S15. Calculate the cross-entropy loss for the current round. The specific formula is as follows:
[0027]
[0028] in, The true label of the current sample. For the model in the first The predicted probability of a sample during rounds of inference iteration;
[0029] And the joint loss is obtained by weighted summation:
[0030]
[0031] in, and These are the loss weighting coefficients;
[0032] S16, Regarding joint losses Perform backpropagation and update the parameters using the gradient descent algorithm. After completing one round of training iterations, the model parameters are adjusted. The update rules are as follows:
[0033]
[0034] in, For learning rate, The joint loss is expressed with respect to the parameters. The gradient;
[0035] S17. Repeat steps S12–S16 until the training set is complete. All samples are used for model training;
[0036] S18. Input the test set into the anomaly detection model and calculate the model's loss on the test set. :
[0037]
[0038] in, Indicates the parameters of the current model. Indicates the size of the test set. Represents the loss calculation function;
[0039] S19. Repeat steps S12-S18 until the test set loss of the model training is reached. Drop to the set loss threshold To obtain the optimal model parameters Load the parameter into the model The optimal anomaly detection model is obtained. .
[0040] Preferably, the ratio of the training set to the test set is 7:3.
[0041] Preferably, the real-time acquisition of the data samples to be detected is input into the optimal anomaly detection model. The optimal anomaly detection model then performs iterative inference on the input samples to obtain a prediction vector, as detailed below:
[0042] S21. Real-time acquisition of industrial control system monitoring data, including normal and abnormal samples, from the switch's mirrored traffic port to obtain the sample to be tested. ;
[0043] Use the best anomaly detection model To perform anomaly detection in industrial control systems, the sample to be tested... As the initial input to the model, set ;
[0044] repeat Sub-feature extraction and rollback operations yield the predicted vector sequence. ;
[0045] S22. Take a weighted average of all prediction results to obtain the final prediction vector. :
[0046] .
[0047] Preferably, the anomaly detection result is determined by comparing the predicted vector of the optimal anomaly detection model with a threshold, as follows:
[0048] Compare The system calculates the probability values for the normal and abnormal categories and outputs the anomaly detection results. , which represents the predicted probability that the input sample belongs to an abnormal state;
[0049]
[0050] in, This indicates a system malfunction. This indicates that the system is operating normally. This is the preset detection threshold.
[0051]
[0052] in, This indicates a system malfunction. This indicates that the system is operating normally. This is the preset detection threshold.
[0053] The beneficial effects of adopting the above technical solution are as follows:
[0054] This invention achieves a gradual improvement in prediction accuracy through multiple inference iterations when the model parameter scale is small and the number of parameters is limited, thereby ensuring detection performance while significantly reducing hardware overhead such as video memory and system memory.
[0055] This invention introduces diversity loss during training to constrain the restored samples generated by the feature rollback network to maintain a moderate difference from the original samples in the input space, while maintaining consistency in the discriminative feature space, thereby ensuring the stability and effectiveness of the iterative inference process. Attached Figure Description
[0056] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.
[0057] Figure 1 This is a flowchart of an industrial control anomaly detection method based on iterative reasoning proposed in this invention;
[0058] Figure 2 This is a model architecture diagram of the anomaly detection model in the industrial control anomaly detection method based on iterative reasoning proposed in this invention. Detailed Implementation
[0059] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. It should be noted that similar reference numerals and letters in the following drawings indicate similar items; therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.
[0060] An industrial control system anomaly detection method based on iterative reasoning, such as Figure 1 Includes the following steps:
[0061] S1. Data Acquisition Stage: Collect data and form a dataset;
[0062] S2, Model Training Phase: Train the anomaly detection model using the training dataset and joint loss to obtain the optimal anomaly detection model;
[0063] S3, Anomaly Detection Stage: Real-time acquisition of data samples to be detected, input into the optimal anomaly detection model, and the optimal anomaly detection model obtains the prediction vector after iterative reasoning on the input samples.
[0064] S4. Threshold Judgment Stage: Based on the prediction vector of the best anomaly detection model, the anomaly detection result is determined by comparing it with a threshold.
[0065] S1. During the data acquisition phase, monitoring data from the industrial control system, including both normal and abnormal samples, is collected from the mirrored traffic port of the switch to form a sample. ,in Indicates sample features, This represents the corresponding category label. The category label value ranges from 0 to 1. If the current industrial control system is functioning normally after manual review, the label for the current sample will be... ,otherwise .
[0066] Then, following the collection method in step S1, multiple samples were continuously collected and merged into a dataset. ,in The size of the dataset.
[0067] S2, Model training phase, such as Figure 2 As shown, the anomaly detection model includes a feature extraction network. Feature rollback network and classification networks Feature extraction network Feature rollback network and classification networks The network parameters are respectively expressed as: .
[0068] Feature extraction networks are used to extract high-dimensional representation features from input samples. In practice, to balance feature representation capability and computational efficiency, a lightweight network structure with multiple convolutional and normalization units is preferred to extract discriminative intermediate feature vectors.
[0069] Feature rollback networks are used to generate reconstructed samples that are comparable to the original input samples in the feature space, based on intermediate features output by the feature extraction network. In practice, neural network structures with feature recovery or reconstruction capabilities can be selected.
[0070] Classification networks are used to classify intermediate features output by feature extraction networks or reconstructed features generated by feature rollback networks. In practice, classification networks preferably employ one or more fully connected layers combined with a Softmax activation function to achieve linear transformation and normalized probability output of the input features, thereby outputting a class probability vector for the sample.
[0071] S11. First, divide the dataset D into training sets. and test set The training set and the test set are divided according to a random sampling method without replacement, with a size ratio of 7:3.
[0072] Obtain initial parameters: Randomly initialize the network parameter set. Set the number of inference iteration rounds for the anomaly detection model. Loss weighting coefficient and diversity constraint margin .
[0073] S12, and then the training set The samples in the order as initial input Set the current inference iteration step As the initial input to the anomaly detection model, and setting the current inference iteration step. ;
[0074] S13, then restore the sample from the previous round. Input Feature Extraction Network The feature representation is obtained as follows:
[0075]
[0076] Represent the features Input features into the rollback network and classification networks The restored samples were obtained respectively. With the predicted probability vector :
[0077]
[0078] in, , Indicates the first In round-robin reasoning, the predicted probability that the input sample belongs to the normal state. Indicates the first The predicted probability that the input sample belongs to an abnormal state in round-robin reasoning;
[0079] Then calculate the diversity loss of this round of inference iteration. To maintain the diversity of sample reconstruction:
[0080]
[0081] in, The diversity margin threshold is used to limit the minimum difference in sample reconstruction. In this embodiment... .when When the restored sample is too close to the original sample, a positive loss term will be generated to encourage the model to generate a differentiated restoration result; when When the loss is 0, it means that the current reconstruction result has sufficient diversity.
[0082] Represents the original sample With restored sample The Euclidean distance between them is used to measure the degree of difference between the two in the feature space, and it is calculated as follows:
[0083]
[0084] in, For sample feature dimensions, and The original sample and the restored sample are respectively in the 1st... The values in each feature dimension.
[0085] By introducing Euclidean distance, the differences in sample reconstruction can be measured in each iteration, preventing the network from overfitting the input samples and thus improving the generalization performance of the anomaly detection model.
[0086] S14, if this round Then As input for the next round, let Repeat S12 and S13; if Then proceed to S15;
[0087] S15. Calculate the cross-entropy loss for the current round. The specific formula is as follows:
[0088]
[0089] in, The true label of the current sample. For the model in the first The predicted probability of a sample during rounds of inference iteration;
[0090] And the joint loss is obtained by weighted summation:
[0091]
[0092] in, and These are the loss weight coefficients, used to balance the contribution ratios of classification loss and diversity loss in the joint optimization process; To optimize the degree of control over classification accuracy, Control the diversity constraint strength of sample reconstruction. By reasonably setting the weight relationship between the two, a dynamic balance between recognition accuracy and generalization ability can be achieved during model training.
[0093] Despite the diversity loss item Encourage the restoration of samples Compared with the original sample To prevent overfitting, certain differences are maintained between the classification losses during joint optimization. Will to The feature representation is constrained so that it can still retain the characteristics of the original sample. Consistency in the discriminative feature space. Through the synergistic effect of these two loss terms, the model can maintain feature diversity while ensuring the stability and accuracy of class discrimination performance, thereby achieving more robust detection of anomalous samples.
[0094] S16, Regarding joint losses Perform backpropagation and update the parameters using the gradient descent algorithm. After completing one round of training iterations, the model parameters are adjusted. The update rules are as follows:
[0095]
[0096] in, For learning rate, The joint loss is expressed with respect to the parameters. The gradient;
[0097] S17. Repeat steps S12–S16 until the training set is complete. All samples are used for model training;
[0098] S18. Input the test set into the anomaly detection model and calculate the model's loss on the test set. :
[0099]
[0100] in, Indicates the parameters of the current model. Indicates the size of the test set. This represents the loss calculation function; this metric is used to evaluate the model's generalization performance on unseen samples.
[0101] S19. Repeat steps S12-S18 until the test set loss of the model training is reached. Drop to the set loss threshold To obtain the optimal model parameters Load the parameter into the model The optimal anomaly detection model is obtained. .
[0102] S3, Anomaly Detection Phase, the specific steps are as follows:
[0103] S21. Real-time acquisition of the data to be tested and input into the trained optimal anomaly detection model, specifically as follows: Real-time acquisition of industrial control system monitoring data containing normal and abnormal samples from the switch's mirror traffic port to obtain the samples to be tested. ;
[0104] Use the best anomaly detection model To perform anomaly detection in industrial control systems, the sample to be tested... As the initial input to the model, set ;
[0105] repeat Sub-feature extraction and rollback operations yield the predicted vector sequence. .
[0106] S22. Take a weighted average of all prediction results to obtain the final prediction vector. :
[0107]
[0108] The final predicted vector output by the model is ,in This represents the predicted probability that the input sample belongs to the normal state. This represents the predicted probability that the input sample belongs to an abnormal state.
[0109] S4. In the threshold determination stage, based on the prediction vector of the best anomaly detection model, the anomaly detection result is determined by threshold comparison, as follows:
[0110] Comparison The system calculates the probability values for the normal and abnormal categories and outputs the anomaly detection results. , which represents the predicted probability that the input sample belongs to an abnormal state;
[0111]
[0112] in, This indicates a system malfunction. This indicates that the system is operating normally. The preset detection threshold is used, but in actual use, the specific threshold is set based on expert experience and historical data.
[0113] The basic idea of this invention is to achieve an iterative inference process for industrial control system anomaly detection by introducing a sample feedback mechanism. Specifically, this invention designs an anomaly detection model composed of a feature extraction network, a feature rollback network, and a classification network. In each iteration, the model uses the restored samples generated by the feature rollback network as input to the feature extraction network for the next iteration, achieving cyclic optimization of sample-level information. During training, by jointly minimizing classification loss and diversity loss, the model can maintain a stable expression of the discriminative features of the original samples while avoiding overfitting, thus obtaining an anomaly detection model with stronger generalization ability. During anomaly detection, the model can perform multiple feature feedback inferences on the samples to be detected during the inference phase and integrate the prediction results of each round to finally output a comprehensive anomaly probability, achieving accurate identification of abnormal states in industrial control systems.
[0114] This scheme employs a multi-round sample feedback inference approach, enabling the prediction accuracy to be gradually improved through multiple inference iterations even with a small model parameter size and limited parameter quantity. This significantly reduces hardware overhead such as GPU memory and system memory while maintaining detection performance. Furthermore, this scheme introduces diversity loss during training to constrain the restored samples generated by the feature rollback network to maintain a moderate difference from the original samples in the input space, while maintaining consistency in the discriminative feature space. This ensures the stability and effectiveness of the iterative inference process.
[0115] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. An industrial control abnormality detection method based on iterative reasoning, characterized by, The method comprises the following steps: S1, a data collection stage: collecting data to form a data set; S2, a model training stage: training an anomaly detection model using a training data set and a joint loss to obtain an optimal anomaly detection model; S3, an anomaly detection stage: collecting real-time data samples to be detected, inputting the optimal anomaly detection model, and obtaining a prediction vector after the optimal anomaly detection model iteratively infers the input samples; S4, a threshold judgment stage: determining an anomaly detection result by comparing the prediction vector of the optimal anomaly detection model with a threshold.
2. The industrial control abnormality detection method based on iterative reasoning according to claim 1, characterized in that, The data is collected and the data set is formed as follows: The industrial control system monitoring data containing normal samples and abnormal samples are collected from the switch mirror flow port to form samples wherein represents sample features, represents corresponding class labels.
3. The industrial control abnormality detection method based on iterative reasoning according to claim 1, characterized in that, The training data set and the joint loss are used to train the anomaly detection model to obtain the optimal anomaly detection model as follows: The anomaly detection model comprises a feature extraction network , a feature rollback network , and a classification network , network parameters of the feature extraction network , the feature rollback network , and the classification network are respectively represented as ; S11、First, the data set D is divided into training set and test set , the network parameter set is randomly initialized , the inference iteration number of the anomaly detection model is set , the loss weight coefficient , and the diversity constraint margin ; S12, further arrange the samples in the training set in sequence as initial input , set the current inference iteration step as the initial input of the anomaly detection model, and set the current inference iteration step ; S13, the previous round of reduction samples are then obtained input feature extraction network to obtain a feature representation: ； The feature representation is input into a feature rollback network and a classification network , respectively, to obtain a restored sample and a predicted probability vector , respectively. ； in, , Indicates the first In round-robin reasoning, the predicted probability that the input sample belongs to the normal state. Indicates the first The predicted probability that the input sample belongs to an abnormal state in round-robin reasoning; further calculate a diversity loss for the current inference iteration : ； wherein denotes the Euclidean distance between the original sample and the restored sample , S14, if the current round , then set as the input of the next round, let , repeat S12 and S13; if , then go to S15; S15, calculate the cross-entropy loss of the current round The specific formula is: ； wherein, is the true label of the current sample, is the predicted probability of the sample by the model at the th inference iteration. The joint loss is obtained by weighted summation: ； wherein and is a loss weight coefficient; S16、to the joint loss performing back propagation, updating parameters using gradient descent algorithm , completing a round of training iteration, updating the model parameters ； wherein, is the learning rate, denotes the gradient of the joint loss with respect to the parameters ; S17, repeat performing steps S12-S16 until the training set all samples in the training set are applied to the model training; S18, inputting the test set into the anomaly detection model, calculating the loss of the model in the test set : ； wherein, denotes the parameters of the current model, denotes the size of the test set, denotes a loss computation function; S19, repeat steps S12-S18 until the model training test set loss drops to a set loss threshold , obtaining the optimal model parameters , loading the parameters to the model , obtaining the optimal anomaly detection model .
4. The industrial control abnormality detection method based on iterative reasoning according to claim 3, characterized in that, The ratio of the training set to the test set is 7:
3.
5. The industrial control abnormality detection method based on iterative reasoning according to claim 1, characterized in that, The real-time data samples to be detected are collected, input into the optimal anomaly detection model, and the prediction vector is obtained after the optimal anomaly detection model iteratively infers the input samples as follows: S21, collecting the industrial control system monitoring data containing normal samples and abnormal samples from the switch mirroring traffic port in real time to obtain a to-be-tested sample ; Using optimal anomaly detection model Anomaly detection is performed on the industrial control system, and a sample to be detected As the initial input of the model, set ; repetition sub-feature extraction and rollback operation, obtaining a predicted vector sequence ; S22, weight average all prediction results to obtain final prediction vector : 。 6. The industrial control abnormality detection method based on iterative reasoning according to claim 1, characterized in that, According to the prediction vector of the optimal anomaly detection model, the anomaly detection result is determined by comparing the threshold as follows: compare comparing the probability values of the normal category and the abnormal category, and outputting an abnormality detection result , indicating a prediction probability that the input sample belongs to an abnormal state; ； wherein, represents that the system is running abnormally, represents that the system is running normally, is a preset detection threshold.