Industrial control system anomaly detection method based on time sequence weighted comparison loss

Abstract

The invention relates to an industrial control system anomaly detection method based on time sequence weighted contrast loss, and the method comprises the following specific steps: in a data collection and preprocessing stage, collecting and preprocessing multi-source operation data, constructing a time sequence sample set, and generating positive and negative sample pairs; in the model training stage, weighting factors changing along with time intervals are introduced into the comparison loss, and the characterization capacity of the model to the short-time continuous state is enhanced. In an anomaly detection stage, an anomaly score is generated through embedding similarity among samples, and anomaly judgment is completed. According to the method, the time sequence continuity priori explicit is fused into the loss function, the detection capacity for early and hidden anomalies is effectively improved, the problems that an existing method is insufficient in time sequence characteristic modeling and poor in engineering adaptability are solved, and the industrial control system anomaly detection method based on the time sequence weighted comparison loss is provided.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of industrial control safety, more particularly, to an industrial control system anomaly detection method based on time sequence weighted contrast loss. BACKGROUND

[0002] Industrial control systems are widely used in power, energy, rail transportation and manufacturing industries, and their running state is directly related to production safety and system stability. With the continuous expansion of the scale of industrial control systems and the improvement of communication network and intelligence, the state quantity data, control instruction data and measurement data generated during system operation show high dimensionality and strong time sequence correlation. Once abnormal behavior occurs during system operation, such as device failure, parameter drift or network attack, it will have a serious impact on the production process. Therefore, continuous monitoring of the running state of industrial control systems and timely detection of abnormal behavior have become an important technical means to ensure the safe and reliable operation of industrial systems.

[0003] In recent years, anomaly detection methods based on contrast learning have gradually attracted attention. Such methods usually construct sample pairs or sample triplets, learn the potential representation of data using the similarity or distance relationship between samples, and thus distinguish abnormal samples. However, existing contrast learning methods mostly assume that samples are independent of each other, mainly focus on the distribution relationship of samples in the feature space, and do not fully consider the inherent time sequence continuity characteristics of industrial control system running data. In actual industrial scenarios, the normal running state of the system usually presents smooth and continuous changes along the time axis, and adjacent samples within a short period of time have strong correlation. The existing methods do not distinguish the time interval between samples when constructing sample pairs and designing loss functions, and are prone to treating normal samples far apart in time and short-term adjacent samples equally, resulting in insufficient ability of the model to distinguish between normal short-term fluctuations and subtle time sequence discontinuity behaviors caused by anomalies, thereby reducing the detection effect of early and hidden anomalies.

[0004] To solve the above problems, the present application proposes an industrial control system anomaly detection method based on time sequence weighted contrast loss, which introduces a weighting mechanism that varies with the time interval of samples into the contrast learning framework, explicitly incorporates the prior information of the time sequence continuity and local smoothness of the normal running state of the industrial control system into the model training process. By constructing a time sequence weighted contrast loss function, the feature encoding model is guided to learn the local continuous structure that conforms to the normal running trajectory in the embedding space, and in the anomaly detection stage, the sliding time window is combined to analyze the similarity of online data, realizing high sensitivity detection of the abnormal state of the industrial control system. SUMMARY

[0005] The embodiment of the application aims to provide an industrial control system anomaly detection method based on a time sequence weighted contrast loss, effectively solves the problems of insufficient time sequence characteristic modeling and poor engineering adaptability of the prior art, and provides an industrial control system anomaly detection method based on a time sequence weighted contrast loss, which has the characteristics of strong time sequence feature capturing capability, high abnormality perception sensitivity and high abnormality detection precision.

[0006] To achieve the above object, the application provides the following technical scheme.

[0007] S1: Obtain multi-source running data of the industrial control system in a continuous running process, and collect at multiple continuous time steps to obtain an original observation vector sequence at a corresponding time step.

[0008] As a preferred embodiment of the embodiment, S1 includes the following sub-steps:

[0009] S11: In the continuous running process of the industrial control system, obtain multi-source running data in multiple continuous sampling periods through a master station server or an edge collection device, wherein the multi-source running data includes state quantity data obtained through a GOOSE message, control instruction data obtained through SetPoint interaction, analog measurement data obtained through Write operation, etc.

[0010] S12: At each sampling time step , combine the multi-source running data corresponding to the same time step to obtain an original observation vector.

[0011]

[0012] wherein, represents the dimension of the running data, represents one piece of data in the observation vector.

[0013] S13: Repeat sub-steps S11-S12 for multiple continuous time steps to obtain an original observation vector set:

[0014]

[0015] wherein, represents the number of collected time steps.

[0016] S2: Obtain the original observation vector set obtained in step S1 , normalize each original observation vector in it to obtain a time sequence sample set for model training.

[0017] As a preferred implementation of the embodiment, S2 comprises the following sub-steps:

[0018] S21: Obtain the original observation vector sequence obtained in step S1 , calculate the normalization parameters according to the feature dimension, including the mean vector and the standard deviation vector .

[0019] S22: Obtain each original observation vector in the original observation vector sequence , based on the mean vector and the standard deviation vector obtained in step S21, normalize each original observation vector to obtain a normalized feature vector:

[0020]

[0021] S24: Combine the normalized feature vector with the corresponding timestamp to obtain a sample:

[0022]

[0023] and form a time series sample set in chronological order:

[0024]

[0025] S3: Obtain the time series sample set obtained in step S2 , perform anchor iteration sampling processing on the sample set to construct a training sample pair dataset for contrastive learning .

[0026] As a preferred implementation of the embodiment, S3 comprises the following sub-steps:

[0027] S31: According to the chronological order of the timestamps corresponding to the samples, select one sample from the time series sample set as the current anchor sample.

[0028] S32: For the current anchor sample , within the time window , traverse or randomly select no more than samples from the time series sample set to construct a positive sample pair set:

[0029]

[0030] wherein, A short-time window threshold indicating that two samples are adjacent in time, and the embodiment takes seconds. is the sample label.

[0031] S33: For the current anchor sample , randomly select no more than samples from the sample set that meet the time interval condition , and construct a negative sample pair set:

[0032]

[0033] , wherein is a long-time window threshold indicating that two samples are not adjacent in time, and satisfies , and the embodiment takes seconds. is the sample label.

[0034] S34: Merge the positive sample pair set obtained in sub-step S32 and the negative sample pair set obtained in sub-step S33 , and add the training sample pair dataset:

[0035]

[0036] , wherein the symbol “ ” represents a set update operation.

[0037] S35: Update the anchor sample to the next sample in time sequence, and repeat the execution of sub-steps S31-S34 until the preset sampling round is completed or the entire time sequence sample set is traversed, and finally obtain the training sample pair dataset:

[0038]

[0039] , wherein is the size of the training sample pair dataset, and is the sample, is the corresponding sample label.

[0040] Step S4: Obtain the training sample pair dataset obtained in step S3, and train the model based on the time sequence weighted contrast loss function to obtain the trained feature encoding model.

[0041] As a preferred embodiment of the present embodiment, S4 includes the following sub-steps:

[0042] S41: Initialize the feature encoding model ​The feature encoding model adopts a convolutional neural network structure and is used for representation learning of time series features of the industrial control system. is a model parameter and is initialized randomly or based on pre-training parameters.

[0043] The convolutional neural network includes a plurality of convolutional layers, non-linear activation layers, and fully connected layers, and the output is a fixed-dimension embedding vector is the dimension of the embedding vector.

[0044] S42: Obtain sample pairs in batches from the training sample pair dataset

[0045]

[0046] S43: Based on the embedding vectors and timestamps corresponding to the sample pairs obtained in step S42, use the time series weighted contrastive loss function

[0047]

[0048] S44: According to the batch loss value obtained in step S43, update the model parameters using the stochastic gradient descent algorithm, and the update formula is:

[0049]

[0050]

[0051] S45: Repeat steps S42 to S44 until the preset training round is completed or the batch loss value reaches the set threshold, and obtain the trained feature encoding model

[0052] S5: The construction of the time series weighted contrastive loss function

[0053] ​​​​​​​​​​​​​​​​​​S51: Obtain the embedding vector of the input loss function With And calculate the embedding distance:

[0054]

[0055] Wherein, Indicates the two-norm of the orientation vector.

[0056] S52: Type identification based on sample pairs , Calculate the basic contrast loss:

[0057]

[0058] Wherein, Indicates the interval threshold in the contrast loss, Is the maximum value function.

[0059] S53: Obtain the timestamp of the input loss function And , Calculate the time interval corresponding to the sample pair:

[0060]

[0061] And calculate the timing weighting factor based on the time interval:

[0062]

[0063] Wherein, Is the basic weight term, Is the dynamic weighting coefficient, Is the time decay rate parameter. In this embodiment, , , .

[0064] S54: Apply the timing weighting factor to the basic contrast loss to obtain the timing weighted contrast loss function used for model training in step S43:

[0065]

[0066] Step S6: Obtain real-time running data in the online running process of the industrial control system, calculate the similarity between samples based on the trained feature encoding model, and output the anomaly detection result.

[0067] As a preferred embodiment of the present embodiment, S6 includes the following sub-steps:

[0068] S61: In the anomaly detection stage, a length of a sliding time window for storing the normalized feature vectors corresponding to the last time steps and the timestamps.

[0069] wherein the sliding time window is denoted as:

[0070]

[0071] the window length is pre-set according to the system sampling frequency and the business requirement.

[0072] S62: In the process of running the industrial control system, the original observation vector at the current time step is obtained in real time according to the same data collection and preprocessing process as steps S1 and S2. Based on the normalization parameters determined in the training phase and , the corresponding normalized feature vector is obtained.

[0073] The current sample is added to the sliding time window , and the earliest sample in the window is removed to realize sliding update.

[0074] S63: The sample feature vectors in the sliding time window are input into the trained feature encoding model to obtain the corresponding embedding vectors:

[0075]

[0076] The similarity or distance value between the embedding vector corresponding to the current time step and the remaining embedding vectors in the window is calculated with the embedding vector as a reference, and the distance is defined as:

[0077]

[0078] wherein denotes the two-norm of a vector.

[0079] S64: Based on the distance value obtained in step S63, the original anomaly score of the current sample is calculated, and the anomaly score is defined as:

[0080]

[0081] wherein denotes the size of the sliding time window.

[0082] S65: The anomaly score obtained in step S64 is compared with a preset anomaly decision threshold When the following condition is met the running state of the industrial control system corresponding to the current time step is determined to be an abnormal state, otherwise it is determined to be a normal state.

[0083] Compared with the prior art, the present application has the following beneficial effects:

[0084] The present application introduces a time interval varying time sequence weighting mechanism in the contrast learning framework based on the time sequence continuity and local smoothness of the industrial control system running data, guides the feature encoding model to learn the local continuous structure conforming to the normal running trajectory in the embedding space by constructing a time sequence weighted contrast loss function, and thus enhances the recognition ability of the time sequence discontinuous behavior. Compared with the traditional contrast learning method which only focuses on the similarity of sample distribution, the present application can more effectively distinguish the normal short-term fluctuation from the subtle time sequence deviation caused by abnormality, and significantly improves the detection sensitivity of early and hidden abnormality.

[0085] In addition, the present application adopts a similarity calculation method based on a sliding time window in the abnormality detection stage, without the need to construct a large-scale sample pair or retrain the model online, which can reduce the calculation and storage overhead while ensuring the detection accuracy, and is suitable for industrial control scenes with limited computing power such as host servers or edge devices. By explicitly introducing the time sequence prior in the industrial control system running process into the loss function modeling process, the present application effectively solves the problems of insufficient modeling of time sequence characteristics, insensitivity to subtle abnormalities and high engineering deployment cost of existing abnormality detection methods, and provides an industrial control system abnormality detection method based on time sequence weighted contrast loss. BRIEF DESCRIPTION OF DRAWINGS

[0086] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and other related drawings can also be obtained by those skilled in the art without creative labor.

[0087] Figure 1 A flowchart of an industrial control system abnormality detection method based on time sequence weighted contrast loss provided by the present application. DETAILED DESCRIPTION

[0088] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0089] The terms "comprise", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0090] The terms "first", "second", and the like are used only to distinguish one entity or operation from another, and do not indicate or imply relative importance or any such actual relationship or order between such entities or operations.

[0091] The basic idea of the present application is to realize high-precision detection of abnormal states of industrial control systems by introducing a time sequence weighting mechanism in a contrast learning framework. In the data acquisition and preprocessing stage, multi-source running data is collected and preprocessed to construct a time sequence sample set, anchor point iterative sampling is used to construct training sample pairs, and positive and negative sample pairs are distinguished according to the sample time interval. In the model training stage, sample similarity is calculated based on embedding distance, and a weighting factor that changes with time interval is introduced into the basic contrast loss to strengthen the model's ability to represent short-term continuous states. In the abnormality detection stage, a sliding time window is established for online data using the trained feature encoding model, and an abnormality score is generated by the embedding similarity between samples to complete the abnormality judgment. This method effectively improves the detection ability of early and hidden abnormalities by explicitly incorporating the time sequence continuity prior into the loss function. The present application effectively solves the problems of insufficient modeling of time sequence characteristics and poor engineering adaptability of existing methods, and provides an industrial control system anomaly detection method based on time sequence weighted contrast loss.

[0092] As shown in Figure 1 The present application provides an industrial control system anomaly detection method based on time sequence weighted contrast loss, comprising the following steps:

[0093] S1: Obtain multi-source running data of an industrial control system during continuous operation, and collect at multiple consecutive time steps to obtain an original observation vector sequence at the corresponding time step.

[0094] As a preferred embodiment of the present embodiment, S1 comprises the following sub-steps:

[0095] S11: In the process of continuous running of the industrial control system, through the master station server or the edge collection device, multi-source running data in multiple continuous sampling periods are acquired, the multi-source running data including state quantity data acquired through GOOSE messages, control instruction data acquired through SetPoint interaction, analog measurement data acquired through Write operation, etc.

[0096] S12: At each sampling time step , the multi-source running data corresponding to the same time step are combined to obtain an original observation vector:

[0097]

[0098] wherein, denotes the dimension of the running data, denotes one piece of data in the observation vector.

[0099] S13: The sub-steps S11-S12 are repeatedly executed for multiple continuous time steps to obtain a set of original observation vectors:

[0100]

[0101] wherein, denotes the number of collected time steps.

[0102] S2: The set of original observation vectors obtained in step S1 is normalized to obtain a set of time series samples for model training .

[0103] As a preferred embodiment of the present embodiment, S2 includes the following sub-steps:

[0104] S21: The sequence of original observation vectors obtained in step S1 is acquired, and normalization parameters are calculated according to feature dimensions, including a mean vector and a standard deviation vector .

[0105] S22: Each original observation vector in the sequence of original observation vectors is acquired, and each original observation vector is normalized based on the mean vector and the standard deviation vector obtained in step S21 to obtain a normalized feature vector:

[0106]

[0107] S24: The normalized feature vectors​ Combining with the corresponding timestamp, a sample is obtained:

[0108]

[0109] And form a time sequence sample set in chronological order:

[0110]

[0111] S3: Obtain the time sequence sample set obtained in step S2 , and perform anchor iteration sampling processing on the sample set to construct a training sample pair dataset for contrastive learning .

[0112] As a preferred embodiment of the embodiment, S3 includes the following sub-steps:

[0113] S31: Select a sample from the time sequence sample set in chronological order according to the timestamps corresponding to the samples as the current anchor sample.

[0114] S32: For the current anchor sample , within the time window , traverse or randomly select no more than samples from the time sequence sample set to construct a positive sample pair set:

[0115]

[0116] wherein, represents a short time window threshold in which two samples are adjacent in time, and the embodiment takes seconds. is the sample label.

[0117] S33: For the current anchor sample , randomly select no more than samples from the sample set that satisfies the time interval condition to construct a negative sample pair set:

[0118]

[0119] wherein, represents a long time window threshold in which two samples are not adjacent in time, and satisfies , and the embodiment takes seconds. is the sample label.

[0120] S34: Convert the set of positive sample pairs obtained in sub-step S32 The set of negative sample pairs obtained from sub-step S33 Merge and add the training sample pairs to the dataset:

[0121]

[0122] Among them, the symbol " " indicates a set update operation.

[0123] S35: Update the anchor sample with the next sample in chronological order, and repeat sub-steps S31 to S34 until the preset sampling rounds are completed or the entire time series sample set is traversed, finally obtaining the training sample pair dataset:

[0124]

[0125] in, The size of the training sample pair dataset, and As a sample, These are the corresponding sample labels.

[0126] Step S4: Obtain the training sample pair dataset obtained in Step S3. The model is trained based on the time-weighted contrastive loss function to obtain the trained feature encoding model.

[0127] In a preferred embodiment of this example, S4 includes the following sub-steps:

[0128] S41: Initialize the feature coding model The feature encoding model employs a convolutional neural network structure for learning representations of the temporal features of industrial control systems. The model parameters can be initialized randomly or based on pre-trained parameters.

[0129] The convolutional neural network includes several convolutional layers, non-linear activation layers, and fully connected layers, and its output is a fixed-dimensional embedding vector. ,in is the dimension of the embedding vector.

[0130] S42: From the training sample pair dataset Samples were obtained in batches. Obtain the samples from it. and With timestamp and and the sample and eigenvectors in With Input into the feature encoding model, respectively, to obtain embedding vectors:

[0131]

[0132] S43: Based on the embedding vectors and timestamps corresponding to the sample pairs obtained in step S42, a time sequence weighted contrastive loss function is used to calculate the batch loss value, which is calculated by the following formula:

[0133]

[0134] S44: According to the batch loss value obtained in step S43, the model parameters are updated using the stochastic gradient descent algorithm, and the update formula is:

[0135]

[0136] wherein, represents the model parameters at the i-th iteration, represents the learning rate.

[0137] S45: Repeat steps S42 to S44 until the preset training round is completed or the batch loss value reaches the set threshold, and obtain the trained feature encoding model .

[0138] S5: The construction of the time sequence weighted contrastive loss function of step S43 specifically includes the following sub-steps:

[0139] S51: Obtain the embedding vectors input into the loss function and , and calculate the embedding distance:

[0140]

[0141] wherein, represents the two-norm of the orientation vector.

[0142] S52: Based on the type identification of the sample pair , calculate the basic contrastive loss:

[0143]

[0144] wherein, represents the interval threshold in the contrastive loss, is the maximum value function.

[0145] S53: Obtain the timestamps input into the loss function​ With , the time interval corresponding to the sample pair is calculated:

[0146]

[0147] and a timing weighting factor is calculated based on the time interval:

[0148]

[0149] wherein, is a base weight term, is a dynamic weighting coefficient, is a time decay rate parameter. In this embodiment, , , .

[0150] S54: The timing weighting factor is applied to the base contrast loss to obtain a timing weighted contrast loss function used for model training in step S43:

[0151]

[0152] Step S6: Real-time running data in the online running process of the industrial control system is obtained, similarity between samples is calculated based on the trained feature encoding model, and an anomaly detection result is output.

[0153] As a preferred embodiment of the present embodiment, S6 includes the following sub-steps:

[0154] S61: In the anomaly detection stage, a sliding time window with a length of is established on the side of the main station server or the edge device, used to store the normalized feature vectors and time stamps corresponding to the last time steps.

[0155] Wherein, the sliding time window is represented as:

[0156]

[0157] The window length is pre-set according to the system sampling frequency and business requirements.

[0158] S62: In the running process of the industrial control system, the original observation vector at the current time step is obtained in real time according to the same data collection and preprocessing process as steps S1 and S2, and based on the normalization parameters and determined in the training stage, the corresponding normalized feature vector .

[0159] The current sample is added to the sliding time window , and the earliest sample in the window is removed, realizing sliding update.

[0160] S63: input the sample feature vectors in the sliding time window into the trained feature encoding model , to obtain the corresponding embedding vectors:

[0161]

[0162] With the embedding vector corresponding to the current time step as the reference, the similarity or distance value between it and the remaining embedding vectors in the window is calculated, and the distance is defined as:

[0163]

[0164] wherein, represents the two-norm of the vector.

[0165] S64: based on the distance value obtained in step S63, the original anomaly score of the current sample is calculated, and the anomaly score is defined as:

[0166]

[0167] wherein, represents the size of the sliding time window.

[0168] S65: obtain the anomaly score obtained in step S64 and compare it with the preset anomaly decision threshold When is satisfied, it is determined that the running state of the industrial control system corresponding to the current time step is an abnormal state, otherwise it is determined to be a normal state.

[0169] The above only describes the embodiments of the present application and does not limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An industrial control system anomaly detection method based on timing weighted contrastive loss, characterized in that, Comprise the following specific steps: S1: Obtain multi-source running data of the industrial control system in the continuous running process, and collect at multiple continuous time steps to obtain an original observation vector sequence at the corresponding time step; As a preferred embodiment of the present embodiment, S1 comprises the following sub-steps: S11: In the continuous running process of the industrial control system, obtain multi-source running data in multiple continuous sampling periods through the master station server or the edge collection device, wherein the multi-source running data includes state quantity data obtained through GOOSE messages, control instruction data obtained through SetPoint interaction, analog measurement data obtained through Write operation, etc. S12: At each sampling time step the multi-source operation data corresponding to the same time step is combined to obtain an original observation vector: ； wherein, denotes a dimension of the operational data, denotes a piece of data in the observation vector; S13: Repeat sub-steps S11-S12 at multiple continuous time steps to obtain an original observation vector set: ； wherein, denotes the number of time steps of the acquisition; S2: obtaining the original observation vector set obtained in step S1 , for each of the original observation vectors , performing normalization processing to obtain a time series sample set for model training ; As a preferred embodiment of the present embodiment, S2 comprises the following sub-steps: S21: obtaining the original observation vector sequence obtained in step S1 , calculating the normalization parameters including the mean vector and the standard deviation vector by the feature dimension ;​ S22: Obtain a sequence of original observation vectors Each original observation vector in the sequence Based on the mean vector and the standard deviation vector obtained in step S21, normalize each original observation vector to obtain a normalized feature vector: ； S24: normalizing the feature vector In combination with the corresponding timestamp, the sample is obtained: ； And form a time series sample set in time sequence: ； S3: obtaining the time sequence sample set obtained in step S2 performing anchor point iterative sampling processing on the sample set to construct a training sample pair dataset for contrastive learning ; As a preferred embodiment of the present embodiment, S3 comprises the following sub-steps: S31: Select one sample from the set of timing samples according to the chronological order of the time stamps corresponding to the samples as the current anchor sample ​ S32: For the current anchor sample , within a time window , from the set of temporal samples , iterate or randomly select no more than samples , construct the positive sample pair set: ； wherein, represents a short-time window threshold in which two samples are adjacent in time, and in this embodiment seconds. is a sample label; S33: For the current anchor sample From satisfying the time interval condition No more than 10 samples were randomly selected from the sample set. Sample Construct a set of negative sample pairs: ； wherein, represents a long-time window threshold that two samples are not adjacent in time, and satisfies In this embodiment, the value of T is taken as seconds. is a sample label; S34: merge the positive sample pair set obtained in sub-step S32 with the negative sample pair set obtained in sub-step S33 merge and add the training sample pair data set: ； wherein the symbol represents a set update operation; S35: Update the anchor sample to the next sample in time sequence, repeat sub-steps S31-S34 until the preset sampling round is completed or the entire time series sample set is traversed, and finally obtain a training sample pair dataset: ； wherein, is the size of the training sample pair dataset, with is the sample, is the corresponding sample label; Step S4: obtaining the training sample pair data set obtained in step S3 and training the model based on the time sequence weighted contrast loss function to obtain the trained feature encoding model. As a preferred embodiment of the present embodiment, S4 comprises the following sub-steps: S41: initialize the feature encoding model The feature encoding model adopts a convolutional neural network structure and is used for representation learning of the time sequence features of the industrial control system. are model parameters, which are initialized randomly or based on pre-training parameters; The convolutional neural network comprises several convolutional layers, non-linear activation layers and fully connected layers, whose output is a fixed-dimensional embedding vector wherein is the dimension of the embedding vector; S42: obtaining sample pairs from the training sample pairs dataset in batches , obtaining samples in the batches with a timestamp with , and inputting the samples with feature vectors in the samples with to the feature encoding model to obtain embedding vectors, respectively ； S43: based on the sample pair obtained in step S42, corresponding embedding vectors and timestamps, using a time sequence weighted contrast loss function The batch loss value is calculated by the following formula: ； S44: According to the batch loss value obtained in step S43, update the model parameters using the stochastic gradient descent algorithm, and the update formula is: ； wherein, denotes the model parameters at the i-th iteration, denotes the model parameters at the i-th iteration, denotes the learning rate; S45: repeatedly performing steps S42 to S44 until a preset training round is completed or a batch loss value reaches a set threshold, obtaining a trained feature encoding model ; S5: The time-weighted contrastive loss function described in step S43 The construction process specifically includes the following sub-steps: S51 : Obtain embedding vectors for input loss function With and compute embedding distance: ； wherein denotes the two-norm of the orientation vector; S52: Identify the type of sample pair , calculate the basic contrast loss: ； wherein, denotes a gap threshold in the contrast loss, is a max function. S53: Acquire the timestamp of the input loss function With , calculate the time interval corresponding to the sample pair: ； And calculate a time series weighting factor based on the time interval: ； wherein, is a base weight term, is a dynamic weighting coefficient, is a time decay rate parameter. In this embodiment, it is taken as , , ; S54: Apply the time series weighting factor to the basic contrast loss to obtain a time series weighted contrast loss function for model training in step S43: ； Step S6: Obtain real-time running data of the industrial control system in the online running process, calculate the similarity between samples based on the trained feature encoding model, and output an anomaly detection result; As a preferred embodiment of the present embodiment, S6 comprises the following sub-steps: S61: In the anomaly detection stage, a sliding time window with a length of is established at the side of the master station server or the edge device, which is used to store the normalized feature vectors and time stamps corresponding to the last time steps; Wherein, the sliding time window is expressed as: ； Window length According to the system sampling frequency and service requirements are set in advance; S62: In the process of running the industrial control system, the original observation vector of the current time step is obtained in real time according to the same data acquisition and preprocessing process as steps S1 and S2 . Based on the normalization parameters determined in the training stage and , the corresponding normalized feature vector is obtained . add the current sample add a sliding time window and remove the oldest sample in the window, enabling sliding updates; S63: input the sample feature vectors within the sliding time window to the trained feature encoding model to obtain the corresponding embedding vectors: ； the embedding vector corresponding to the current time step For reference, the similarity or distance value is computed with respect to the remaining embedding vectors within the window, the distance being defined as: ； wherein denotes the two-norm of the orientation vector; S64: Calculate the original anomaly score of the current sample based on the distance value obtained in step S63, and the anomaly score is defined as: ； wherein, denotes taking the size of the sliding time window; S65: obtaining the abnormal score obtained in step S64 and a preset abnormal decision threshold value are compared, and when the condition is met , it is determined that the running state of the industrial control system corresponding to the current time step is an abnormal state, otherwise it is determined to be a normal state.

Images