Time series dual-view imaging driven industrial control system anomaly detection method

Abstract

The application discloses a time sequence double-view imaging driven industrial control system anomaly detection method, relates to the technical field of industrial automation system state monitoring, and comprises the following steps: constructing a short field of view and a long field of view 1D sequence for each to-be-detected time point; converting into a 2D image through time-dependent context view imaging and time-independent numerical correlation view imaging, and forming a fine-grained time point level double-view image representation; constructing a framework of an anomaly detection model, learning a short field of view-long field of view mode difference as an anomaly criterion through comparison between a short field of view image reconstructed target time point and a long field of view image reconstructed same time point; and aggregating the mode difference at a multivariate level to generate a robust anomaly score. The application expands 1D time sequence into complementary 2D double-view representation, improves anomaly detection precision while ensuring timeliness and resource consumption through joint multi-view learning and time sequence imaging, and realizes high-precision, fine-grained time point level anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of industrial automation system condition monitoring technology, and in particular to an anomaly detection method for industrial control systems driven by time-series dual-view imaging. Background Technology

[0002] Industrial control systems typically employ various sensors, actuators, and controllers to continuously monitor and control underlying industrial equipment. However, industrial control systems operate in harsh and dynamically changing environments, such as high humidity, corrosion, electromagnetic interference, mechanical vibration, and dust, often leading to frequent anomalies in signals from underlying equipment or sensors. These anomalies manifest as periodic fluctuations, data drift, or sudden deviations from normal operating conditions. These anomalies can range from causing instability in the industrial control system to triggering equipment failures, production shutdowns, and significant economic losses and personnel casualties. Therefore, anomaly detection is crucial for protecting the safety and stability of industrial control systems. Due to the inherent high nonlinearity and strong coupling of industrial control systems, directly constructing mathematical models for anomaly detection is impractical. Therefore, data-driven methods, especially unsupervised deep learning methods that do not rely on external labels, have become the core approach for constructing anomaly detection models for industrial control systems. Moreover, traditional coarse-grained anomaly detection (detecting anomalies in entire sequences or segments) is no longer sufficient to meet the needs of refined monitoring.

[0003] Existing unsupervised, point-in-time fine-grained time series anomaly detection models typically perform anomaly detection directly on the raw 1D time series signal. However, the variable production environment and complex control commands result in industrial control systems containing various complex feature patterns, such as long and short periodicity, seasonality, trends, contextual evolution, and multivariate coupling. When these complex feature patterns are compressed into a 1D time series, multiple normal patterns intertwine, making feature pattern extraction difficult and reducing the discriminability of information. Furthermore, these intertwined normal feature patterns exhibit frequent numerical fluctuations in the 1D sequence. These fluctuations are similar to the data fluctuations exhibited by noise / abnormal behavior, making it easy to confuse abnormal behavior with complex normal patterns, increasing the risk of false positives and false negatives.

[0004] Therefore, existing time series anomaly detection models for industrial control systems face a common challenge: in 1D time series with very low information discriminability, it is difficult to accurately identify or separate anomaly patterns from complex normal behavior.

[0005] Existing solutions mainly follow two technical routes:

[0006] (1) The first approach is based on multi-view learning. This type of method is represented by multi-period modeling and time-frequency joint modeling. They take the original 1D time series as input, treat the diverse feature patterns hidden in the sequence as different views, and design an independent learning path for each view, thereby identifying anomalies in a single feature pattern and reducing the difficulty of anomaly identification. However, the detection performance of this type of method depends to a large extent on the quality of view construction and the stability of the multi-view fusion mechanism, and often exhibits instability in complex industrial scenarios.

[0007] (2) The second approach is based on time-series imaging. This type of method maps 1D time series to 2D image representations and enhances the discriminability of information through feature dimensionality expansion, thereby improving the distinguishability of abnormal patterns. For example, ImagenTime maps 1D sequences to 2D image space and combines a diffusion model to perform time series generation tasks to generate higher-quality synthetic sequences; ImageAE and TimeMixer++ use time-series imaging to transform 1D data to 2D space and use customized deep neural networks for time series prediction; IMTS further combines time-series imaging with GAN and bidirectional RNN to perform time series classification. TimesNet further maps 1D time series to 2D periodic representations from a multi-period perspective, thereby improving the accuracy of time-series tasks such as anomaly detection and prediction. Similarly, TIAN combines time-series imaging with generative adversarial learning to construct a deep association network to support anomaly detection in human activity recognition scenarios. Related research has been widely explored in multiple tasks such as time series generation, time series prediction, and time series classification. Time-series imaging has shown good results in various time-series analysis tasks. However, existing work focuses primarily on time series tasks such as generation, prediction, or classification. Research specifically applying time series imaging techniques to time series anomaly detection is still very limited, leaving significant room for expansion. Furthermore, current anomaly detection methods based on time series imaging still employ coarse-grained imaging strategies, directly converting the entire sequence or a fixed-length subsequence into a 2D image. In this case, multiple time points often share the same 2D image, resulting in insufficient characterization of feature information at individual time points, difficulty in highlighting differences, and an inability to achieve accurate time-point-level anomaly identification.

[0008] In summary, industrial control systems increasingly demand more refined control over their operational status. To meet this demand, industrial control systems often employ more and denser networks of sensors and controllers, along with higher sampling frequencies and more complex control strategies. This results in 1D time series exhibiting greater pattern diversity and dynamic non-stationarity; simultaneously, abnormal behaviors occur more frequently and are more complex in industrial control systems, significantly increasing the difficulty of anomaly identification and precise localization. Therefore, mapping 1D time series to a 2D representation space and combining multiple complementary view learning is an effective means to reasonably improve fine-grained, unsupervised time-series anomaly detection. Currently, there is no work on combining multi-view learning and time series imaging for time-series fine-grained time series anomaly detection. Summary of the Invention

[0009] This invention provides an anomaly detection method for industrial control systems driven by time-series dual-view imaging. It uses innovative dual-view imaging technology to convert low-discrimination 1D time-series signals into information-rich 2D images, and combines a "short field of view - long field of view" contrastive learning mechanism to achieve high-precision and high-efficiency time-point fine-grained anomaly detection under unsupervised conditions.

[0010] To solve the above-mentioned technical problems, the technical solution proposed by this invention is as follows:

[0011] An anomaly detection method for an industrial control system driven by time-series dual-view imaging includes the following:

[0012] Acquire time series data from multiple sensors in an industrial control system, and construct corresponding short-field-of-view and long-field-of-view sequences for each time point to be detected;

[0013] The short-field-of-view sequence and the long-field-of-view sequence are converted from 1D time series into 2D images by time-dependent context view imaging and time-independent numerical correlation view imaging, respectively, to form a fine-grained time-point-level dual-view image representation.

[0014] The framework for constructing an anomaly detection model is based on the collaboration of short-field dual-view images and long-field dual-view images at the target time point. By extracting features and sharing the learning of differences between short-field and long-field patterns, the identifiability of anomaly patterns is enhanced.

[0015] Based on the learned pattern differences, aggregate scoring is performed at the multivariate level to generate robust anomaly scores for each time point, and time-point anomaly detection is achieved based on the anomaly scores.

[0016] A further improvement to the above technical solution is as follows:

[0017] Preferably, the construction of the short field-of-view sequence and the long field-of-view sequence involves taking the current time point t to be judged as the end point, extracting L consecutive time points in the historical direction to form the short field-of-view sequence corresponding to time point t; and taking time point t as the end point, performing G samplings in the historical direction at fixed intervals of L to generate the long field-of-view sequence corresponding to time point t.

[0018] Preferably, a feature extractor based on a bidirectional large convolutional kernel is used to extract features from the 2D image. The feature extractor uses a large convolutional kernel to simulate the feature pattern to be learned. The large convolutional kernel is shared in both short-field learning and long-field learning processes, so that the two learning processes learn the same feature pattern. The feature extractor uses bidirectional feature extraction to capture features.

[0019] Preferably, the feature extraction module is a feature extractor based on bidirectional large kernel convolution, which performs the following operations:

[0020] The first 1D large convolution kernel is used to convolve along the horizontal direction of the input two-dimensional image to obtain the first direction feature map;

[0021] The second 1D large convolution kernel is used to convolve along the vertical direction of the input 2D image to obtain the second direction feature map;

[0022] By fusing the first-direction feature map and the second-direction feature map, a bidirectional feature representation of the input 2D image is obtained.

[0023] Preferably, the anomaly detection model consists of three components: time-point dual-view time-series imaging, short-field-long-field contrastive learning with dual-view coupling, and multivariate joint anomaly scoring.

[0024] The time-point-level dual-view time-series imaging component maps the 1D short field of view and long field of view sequence modes corresponding to each time point from two views to 2D images, namely a time-dependent context view and a time-independent relational view.

[0025] The dual-view coupled short-field-long-field contrastive learning component captures the short-field-long-field pattern differences at each time point through comparative learning between two branches: the reconstruction of the short-field 2D image to a certain time point and the reconstruction of the long-field 2D image to the same time point.

[0026] The multivariate joint anomaly scoring component aggregates short-field-long-field pattern differences across all variables to generate a final anomaly score for each time point.

[0027] Preferably, the time-point-level dual-view time-series imaging component covers the local behavior and long-term patterns at each time point, including the following:

[0028] Complementary dual-view construction simultaneously characterizes feature information from two perspectives at each time point, including a time-dependent context view and a time-independent relational view, forming a dual-view representation from two complementary paths.

[0029] Short field-of-view and long field-of-view combined imaging generates short field-of-view and long field-of-view 2D images at each time point under each view;

[0030] Bidirectional information embedding explicitly embeds bidirectional pattern information into each 2D image, enhancing the extractable features contained within the 2D image.

[0031] Preferably, the dual-view coupled short-field-to-long-field contrastive learning component consists of three modules, including:

[0032] The reconstruction learning from short-field 2D images to a single time point uses a short-field 2D image under dual views at a single time point as input, and reconstructs the observation value at that time point by performing bidirectional convolution using a shared 1D large convolution kernel.

[0033] Reconstruction learning from long-field 2D images to a single time point: Using long-field 2D images with dual views at the same time point as input, the observations at that time point are reconstructed using bidirectional shared large convolutional kernels.

[0034] Short-field-long-field contrastive learning jointly optimizes the two learning branches and introduces a contrastive learning process without negative samples to guide the learning of the entire framework.

[0035] Preferably, the training loss of the anomaly detection model framework includes contrast loss, short field-of-view reconstruction loss, and long field-of-view reconstruction loss; the short field-of-view reconstruction loss constrains the short field-of-view reconstruction value and the reconstruction error of its corresponding input image; the long field-of-view reconstruction loss constrains the long field-of-view reconstruction value and the reconstruction error of its corresponding input image.

[0036] The time-series dual-view imaging-driven anomaly detection method for industrial control systems provided by this invention has the following advantages compared with existing technologies:

[0037] (1) The time-series dual-view imaging driven industrial control system anomaly detection method of the present invention converts 1D time series into 2D feature images from time-dependent context view and time-independent numerical correlation view respectively, and improves detection accuracy and stability by combining dual-view learning and time series imaging, and realizes time-point level fine-grained anomaly detection under unsupervised conditions.

[0038] (2) The time-series dual-view imaging-driven anomaly detection method for industrial control systems of the present invention designs a "short field of view - long field of view" contrastive learning framework, which consists of two contrastive learning branches: one branch is used to perform "reconstruction of the short field of view 2D image to the target time point", and the other branch is used to perform "reconstruction of the long field of view 2D image to the same target time point". The "short field of view - long field of view" pattern difference at each time point is generated through contrastive learning. In addition, the feature extraction capability and anomaly detection accuracy of the framework are further improved by designing customized time-point imaging, 1D large kernel shared convolution and bidirectional feature extraction strategies. Attached Figure Description

[0039] Figure 1 This is an example diagram of anomaly detection in an industrial control system.

[0040] Figure 2 This refers to the time-point-level short-field-of-view versus long-field-of-view mode difference in this invention.

[0041] Figure 3 This refers to the difference between short-field-of-view and long-field-of-view modes in time-point dual-view imaging in this invention.

[0042] Figure 4 This is the short-field-long-field comparative learning method for dual-view coupling in this invention.

[0043] Figure 5 This is a bidirectional convolutional feature extractor based on a shared large convolutional kernel in this invention, wherein (a) is a learnable mode with a large convolutional kernel, (b) is a shared mode, and (c) is bidirectional learning.

[0044] Figure 6 The present invention provides an anomaly detection model framework, wherein (a) is time-point dual-view time series imaging, (b) is short-field-long-field contrastive learning coupled with dual views, and (c) is multivariate joint anomaly scoring.

[0045] Figure 7 To experimentally verify the discriminability of short-field-long-field pattern differences in 1D and 2D spaces in a drift anomaly scene.

[0046] Figure 8 To experimentally verify the discriminability of short-field-long-field pattern differences in 1D and 2D spaces for periodic anomaly scenes.

[0047] Figure 9 To verify the discriminability of short-field-long-field pattern differences in 1D and 2D spaces during sudden abnormal scenarios in experiments. Detailed Implementation

[0048] The following provides a detailed description of specific embodiments of the present invention. It should be understood that the specific embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit the scope of the invention.

[0049] The time-series dual-view imaging-driven anomaly detection method for industrial control systems of the present invention includes the following three key components:

[0050] (1) Design an anomaly recognition mechanism that is more suitable for time series imaging.

[0051] Ideally, time-series imaging generates 2D feature images for each timestamp. These generated 2D images should make it easier to identify anomalous behavior in industrial control systems. In real-world industrial scenarios, anomalous patterns in industrial control systems often persist across multiple time points and differ significantly from normal operating patterns. Based on this observation, it's clear that relying solely on observations at a single time point is insufficient to reliably determine whether an anomalous pattern exists; observation of the pattern at each time point is necessary. Due to the inherent repetitiveness of industrial production, the short-field-of-view pattern at a normal time point is often similar to the long-field-of-view pattern. Therefore, this invention proposes an anomaly identification mechanism based on the difference between "short-field-of-view" and "long-field-of-view" patterns to guide the time-series imaging process at the time-point level. Specifically, two types of sequences are generated for each time point: one is a short-field-of-view 1D sequence composed of neighboring samples, mapped to a short-field-of-view 2D image; the other is a long-field-of-view 1D sequence composed of distant samples, mapped to a long-field-of-view 2D image. By comparing the differences between the two 2D images, anomalies can be better identified.

[0052] (2) Enhanced time-series imaging.

[0053] Time series data in industrial control systems simultaneously exhibit complex feature patterns such as periodicity, trend, contextual evolution, and multivariate coupling. These feature patterns can be summarized into two complementary feature perspectives: one is a time-dependent contextual perspective, used to characterize dynamic behavior evolving over time; the other is a time-independent numerical correlation perspective, used to describe the numerical correlation structure between variables. Therefore, this invention performs time series imaging for each time point from both the contextual view and the correlation view, generating corresponding short-field and long-field 2D images respectively. Specifically: First, from the time-dependent contextual perspective, delayed embedding (DE) technology is used to directly map the short-field and long-field sequences at each time point into short-field and long-field 2D contextual images, respectively; then, from the numerical correlation perspective, Gramian Angular Field (GAF) technology is used to map the short-field and long-field sequences at each time point into short-field and long-field 2D correlation images, respectively. This dual-view imaging strategy can provide complementary information from both temporal dynamics and numerical correlation levels, improving the discriminability of the data and the stability of detection.

[0054] (3) Use time series imaging to achieve final anomaly detection.

[0055] Based on an anomaly recognition mechanism utilizing the contrast difference between short-field-of-view and long-field-of-view patterns, this invention designs a dual-view coupled contrastive learning framework. This framework comprises two contrastive learning branches: "reconstruction from a short-field-of-view 2D image to a single time point" and "reconstruction from a long-field-of-view 2D image to the same time point." Each learning branch utilizes high-dimensional 2D input to provide rich learnable information and simplifies the learning process through single-time-point reconstruction, thereby better capturing the pattern differences between the short and long fields of view. Furthermore, during the contrastive learning process, the 2D images of the two views are adaptively fused at the feature layer, and a large 1D convolutional kernel is introduced to enhance the ability to capture pattern features in the 2D image. A bidirectional feature extraction strategy is used to improve the recognition effect of boundary anomalies.

[0056] like Figure 1As shown, in modern industrial control systems, production processes are typically composed of multiple heterogeneous interconnected mechanical and electromechanical devices working together to form a strongly coupled closed-loop operation link. To monitor the real-time status and dynamic evolution of the production process, industrial control systems often deploy multi-source heterogeneous sensors at key stages, such as pressure, flow, temperature, vibration, and valve position sensors. First, each sensor collects the operating status of different devices at a certain frequency, forming a discrete 1D time series signal. Next, the data sampled by each sensor is transmitted to a PLC, RTU, or edge gateway through different industrial communication links, such as fieldbus, industrial Ethernet, industrial Wi-Fi, and corresponding communication protocols (such as Modbus, OPC-UA, PROFINET), forming a multivariate time series. Then, this multivariate time series is further transmitted to a SCADA server or cloud platform for in-depth data mining and analysis. In actual industrial scenarios, deep learning-based industrial control system anomaly detection models are deployed in the cloud to continuously detect anomalies in the uploaded multivariate time series. Finally, when an anomaly is detected, the anomaly result is sent back to the edge host or PLC for timely alarm, operational intervention, and control decision-making.

[0057] Suppose an industrial control system equipped with D sensors, which continuously collect system operating values. After N collections, the obtained observation data forms a multivariate time series. ,in Indicates size is This multivariate time series is a space of real matrix numbers. It contains two dimensions: the time dimension and the variable dimension. In the time dimension, this multivariate time series can be represented as... , where each vector This represents the observations from D sensors at time point n. In terms of variables, this multivariate time series can be represented as... ,in This represents the temporal evolution of the d-th sensor at N time points.

[0058] Specifically, the anomaly detection method for a time-series dual-view imaging driven industrial control system of the present invention includes the following steps:

[0059] Step S1: Design a time point anomaly detection mechanism based on the difference between the "short field of view - long field of view" modes.

[0060] This invention designs a fine-grained anomaly detection mechanism based on the difference between short-field-of-view and long-field-of-view modes to evaluate the anomalies of individual time points under unsupervised conditions. This mechanism is based on the fact that, under normal operating conditions, sensor signals in industrial control systems are subject to both physical constraints and control logic (inherent repeatability), and their dynamic behavior within their local temporal neighborhood typically maintains a high similarity to historical operating patterns over longer time scales. However, when an anomaly occurs in the system, this consistency is disrupted, manifesting as a significant deviation of the local pattern near the current time point from the long-term historical pattern. Based on this characteristic, this invention does not rely on single-point amplitude or instantaneous error as anomaly criteria. Instead, it determines whether a time point deviates from the normal operating state of the system by comparing the degree of difference between the short-field-of-view and long-field-of-view patterns corresponding to the target time point. This anomaly detection mechanism can better and more accurately identify time-point-level anomalies under complex and varied feature patterns, while also providing a stable and physically meaningful basis for subsequent time-point-level imaging and anomaly detection.

[0061] like Figures 2 to 4 As shown, the specific process of the time-point anomaly detection mechanism based on the difference between "short field of view" and "long field of view" modes is as follows:

[0062] Using the current time point t to be determined as the endpoint, L consecutive time points are extracted in the historical direction to form the short field-of-view sequence corresponding to time point t. At the same time, along the historical direction, G samples are taken at fixed intervals L over a longer time range to generate the long field-of-view sequence corresponding to time point t. Subsequently, the short field-of-view sequence and the long field-of-view sequence are respectively mapped in 2D through a designed dual-view imaging scheme to form a short field-of-view context 2D map, a short field-of-view correlation 2D map, a long field-of-view context 2D map, and a long field-of-view correlation 2D map corresponding to time point t.

[0063] Under normal operating conditions, the short-field and long-field 2D maps corresponding to time point t maintain a high degree of similarity in structural morphology and pattern distribution. However, when time point t is an anomaly, significant differences will appear between the corresponding short-field context map and long-field context map, or between the short-field correlation map and long-field correlation map. Utilizing these differences, fine-grained anomaly detection in industrial control systems at the time point level can be achieved.

[0064] Step S2: Construct a feature extractor based on bidirectional large convolutional kernels.

[0065] Two views were generated at each time point. Figure 2 Following the 2D image, this step further constructs a customized feature extractor based on bidirectional large convolutional kernels to more comprehensively extract features from the 2D image. For example... Figure 5 As shown, this feature extractor has the following features:

[0066] (I) The traditional small convolution kernel was abandoned, and a large convolution kernel was used to simulate the feature patterns that need to be learned, so as to better fit the time point-level anomaly discrimination mechanism based on the difference between the "short field of view - long field of view" patterns;

[0067] (II) This large convolutional kernel will be shared in both short-field learning and long-field learning processes, thus emphasizing that the two learning processes are learning the same feature pattern;

[0068] (III) Since each generated 2D image contains unique information in two directions, "from left to right" and "from top to bottom", the feature extractor adopts a bidirectional feature extraction strategy to replace the conventional unidirectional learning, thereby capturing more complete features and improving the overall detection accuracy.

[0069] Specifically, a 2D image generated at a certain point in time. For example, among them Indicates size is The bidirectional feature extraction process for a space of real matrix numbers is as follows:

[0070] S2-1, generate a space of size [size missing] along the "from left to right" direction. A large 1D convolutional kernel is used as the context pattern to be learned, and this large kernel is used to convolve the 2D image to obtain the feature map in the first direction:

[0071] (1)

[0072] in, A shared 1D large convolutional kernel of size K1; The first direction feature map generated, and , The number of pixels per row / column in a 2D image.

[0073] S2-2, along the "top to bottom" direction, generate another dimension of... 1D large convolution kernel pair Perform a second convolution to obtain the feature map in the second direction:

[0074] (2)

[0075] in, For a shared 1D large convolutional kernel of size K2, The generated second-direction feature map, and .

[0076] Joint consideration and This allows for the capture of more comprehensive feature information in 2D images.

[0077] Step S3: Construct an anomaly detection model for industrial control systems driven by time-series dual-view imaging.

[0078] S3-1, Design model framework.

[0079] like Figure 6 As shown, the overall framework of the industrial control system anomaly detection model of the present invention mainly consists of three components: time-point level dual-view time series imaging, short-field-long-field comparative learning with dual-view coupling, and multivariate joint anomaly scoring.

[0080] (I) Time-point level dual-view time series imaging component, which is responsible for mapping the 1D short field of view and long field of view sequence patterns corresponding to each time point from the two views to 2D images, namely time-dependent context view and time-independent relational view.

[0081] (II) The short-field-long-field contrast learning component coupled with dual views is responsible for capturing the differences between the short-field and long-field modes at each time point through contrast learning between the two branches of "reconstruction of the short-field 2D image to a certain time point" and "reconstruction of the long-field 2D image to the same time point".

[0082] (III) Multivariate joint anomaly scoring component, responsible for aggregating short-field-long-field pattern differences across all variables, generating a final robust anomaly score for each time point, and preventing noise interference on individual variables.

[0083] S3-2, Design a time-point level dual-view time series imaging component.

[0084] Mapping 1D time-series signals from industrial control systems to 2D image representations is an effective way to enhance the discriminative power of anomalous patterns in complex time-series behaviors. Existing time-series imaging methods, such as heatmaps, spectrograms, GAF, DE, and recurrence plots (RP), can be broadly classified into two categories: sequence-level imaging and time-point-level imaging. Sequence-level imaging typically maps an entire sequence or a fixed-length subsequence to a single image, which can easily lead to multiple time points sharing the same 2D representation, making it difficult to characterize fine-grained time-point differences. Time-point-level imaging, on the other hand, focuses on describing the local morphology of the neighborhood of the target time point, but often lacks explicit modeling of long-range time-series structures, resulting in limited discriminative information contained in the 2D image and difficulty in supporting robust anomaly identification.

[0085] To address the aforementioned problems, this invention proposes a customized time-point-level dual-view time-series imaging scheme. This scheme simultaneously generates short-field and long-field 2D images from two complementary views at each time point to more comprehensively cover the local behavior and long-term patterns at each time point. It includes three aspects:

[0086] (1) Complementary dual-view construction: For each time point, feature information is characterized from two perspectives simultaneously: one is a time-dependent context view, used to characterize the dynamic changes of the time series; the other is a time-independent correlation view, used to characterize the correlation structure between values ​​within the model. Unlike traditional works that construct views from time-frequency, spatiotemporal, multi-period, or multi-scale perspectives, this scheme emphasizes forming a dual-view representation from two complementary paths: "time-dynamic context - correlation of model values".

[0087] (2) Short field of view-long field of view joint imaging: Under each view, short field of view and long field of view 2D images are generated for each time point to provide data support for subsequent anomaly detection.

[0088] (3) Bidirectional information embedding: When constructing each 2D image, bidirectional pattern information ("from left to right" and "from top to bottom") is explicitly embedded to enhance the extractable features contained in the 2D image, thereby improving the accuracy of anomaly detection.

[0089] Taking time point n of variable 1 as an example, the process of a customized time-point-level dual-view time series imaging scheme specifically includes three steps:

[0090] S3-2-1, Construction of 1D sequence patterns for short and long fields of view.

[0091] Using time point n as the endpoint, a continuous window of length L is extracted to form its short field-of-view 1D mode. ,in This represents the observed value of variable 1 at time point i. Subsequently, using... As the endpoint, samples are taken every L time points and repeated G times to obtain the long-field-of-view 1D mode. Under this setting, both short-view and long-view modes use only historical data, thus preventing future information leaks.

[0092] S3-2-2, Time-dependent Contextual View Figure 2 3D imaging.

[0093] First, the short-field-of-view 1D mode is converted into a short-field-of-view context 2D image using delayed embedding imaging. For each time point within the short-field-of-view window, its corresponding short-field-of-view sequence is reversed in chronological order and stacked vertically to obtain... ,in This means converting a row vector into a column vector. This represents the observed value of variable 1 at time point j. Represents a short-field-of-view 2D image.

[0094] Secondly, the same process is used to construct long-field-of-view contextual 2D images. Unlike traditional delayed embeddings that only encode information in one direction, this scheme preserves bidirectional contextual features: it depicts temporal progression relationships from left to right and reverse temporal associations from top to bottom, thereby enhancing the expression of contextual information.

[0095] S3-2-3, Associative View Based on Pattern Values Figure 2 3D imaging.

[0096] S3-2-3-1 uses GAF imaging to construct a short-field-of-view 1D mode into a short-field-of-view associated 2D image.

[0097] Short field of view mode Mapping to the GAF domain yields the angle representation. .

[0098] For each pair of angles Calculating the Gramian Angular Summation Field (GASF) and the Gramian Angular Difference Field (GADF) yields two symmetric matrices. :

[0099] (3)

[0100] in, Let i be the angle of the i-th neighbor. From the perspective of the j-th neighbor, Let the gram sum and field value be the sum of the values ​​between the i-th neighbor and the j-th neighbor. Let be the Gram difference field value between the i-th neighbor and the j-th neighbor.

[0101] Using symmetry, The lower triangle and By fusing the upper triangle, a short-field-of-view associated 2D image is constructed. :

[0102] (4)

[0103] in, This indicates taking the absolute value.

[0104] S3-2-3-2, using the same process to construct long-field-of-view correlated 2D images. Unlike traditional GAF which mainly emphasizes unidirectional information, this fused 2D image retains bidirectional structural features: it emphasizes GASF information from left to right and GADF information from top to bottom.

[0105] S3-3, Design a short-field-long-field contrast learning component with dual-view coupling.

[0106] After generating the short-field and long-field 2D images under dual-view at each time point, this invention designs a customized dual-view coupled contrastive learning framework to more accurately capture the short-field-long-field pattern differences at each time point. This framework does not directly learn the pixel differences between the short-field and long-field 2D images. Instead, it generates contrastive differences as anomaly detection criteria through a two-branch contrastive learning process: "reconstruction from the short-field 2D image to a single time point" and "reconstruction from the long-field 2D image to the same time point." Each learning branch utilizes high-dimensional 2D input to provide rich learnable information and simplifies the learning process through single-time-point reconstruction, thereby better capturing the "short-field-long-field" pattern differences, simplifying the entire learning process, and ensuring detection stability. Simultaneously, this framework utilizes a feature extractor based on bidirectional large convolutional kernels designed in this invention to better extract features and improve detection accuracy.

[0107] Specifically, the framework consists of three modules: "reconstruction learning from short-field-of-view 2D images to a single time point", "reconstruction learning from long-field-of-view 2D images to a single time point", and "short-field-of-view versus long-field-of-view contrast learning". The learning processes of different variables are independent of each other and can be implemented in parallel.

[0108] S3-3-1, Reconstruction Learning from Short-Field-of-View 2D Images to a Single Time Point: Using a short-field-of-view 2D image under dual views at a single time point as input, bidirectional convolution is performed using a shared 1D large convolution kernel to reconstruct the observations at that time point.

[0109] Taking time point n of variable 1 as an example, the process is as follows:

[0110] S3-3-1-1, Short-field contextual pattern feature extraction.

[0111] First, the short-field context 2D image As input.

[0112] Secondly, use a 1D large convolution kernel in the top-down direction. ,in This indicates that the minimum value of global and local neighbors is used as the kernel size to extract short-field context patterns. The formula is:

[0113] (5)

[0114] in, Represents the first in the matrix Line number The elements of the column. Because A large 1D convolutional kernel is generated on the first row of a 2D image. Each feature is used to convolve all L rows to obtain a size of [value]. The output is as follows. Considering that each 2D image corresponds to a single time point reconstruction, this convolution has only one layer and does not introduce padding, pooling, or additional layers; if richer features are required, it can also be extended to a multi-head or multi-scale form.

[0115] Subsequently, another large 1D convolutional kernel is introduced from left to right. To extract complementary short-field context patterns The formula is:

[0116] (6)

[0117] Next, the feature maps from the two directions are concatenated to obtain the final short-field contextual pattern. The formula is:

[0118] (7)

[0119] in, This indicates transpose.

[0120] Finally, transposed convolution is used by Reconstructing short-field contextual images To ensure the accuracy of the extracted features:

[0121] (8)

[0122] in, For learnable transposed convolution kernels, This indicates the transpose convolution operation.

[0123] S3-3-1-2, Short-field association pattern feature extraction.

[0124] First, associate short field of view with 2D images. As input, a shared 1D large convolutional kernel is used along the top-down direction. ,in Capture GADF association features in short field of view The formula is:

[0125] (9)

[0126] Then, from left to right, a shared 1D large convolutional kernel is introduced. To capture GASF association features in short field of view The formula is:

[0127] (10)

[0128] Subsequently, the bidirectional correlation features are fused to obtain the final short-field correlation pattern. The formula is:

[0129] (11)

[0130] To ensure The correctness of the further employment of transposed convolution by Reconstructing short-field-of-view associated images :

[0131] (12)

[0132] in, This is a transposed convolution kernel.

[0133] S3-3-1-3, Dual-view fusion.

[0134] Short field of view features obtained from two views and Flatten and splice the parts to obtain the fusion feature. The formula is:

[0135] (13)

[0136] in, Indicates splicing, This means flattening the 2D feature matrix into a 1D vector.

[0137] S3-3-1-4, Time Point Reconstruction.

[0138] Hire a two-layer MLP network to utilize fused features Reconstruction Time Point Observed values The input layer of this MLP network contains 10 neurons, hidden layer contains There are 1 neuron in the output layer and 1 neuron in the output layer. The reconstruction process is represented as follows:

[0139] (14)

[0140] in, and For a trainable parameter matrix, and For bias terms, for Activation function.

[0141] S3-3-2, Reconstruction Learning from Long-Field 2D Images to the Same Time Point: Using long-field 2D images with dual views at the same time point as input, the numerical values ​​at that time point are reconstructed using bidirectional shared large convolutional kernels.

[0142] Using the time point of variable 1 For example, the reconstruction process is as follows:

[0143] S3-3-2-1, Long-field contextual pattern feature extraction.

[0144] Long-field context image As input. Using a shared large convolutional kernel. and Extract bidirectional long-field context features along both directions. and :

[0145] (15)

[0146] in, This indicates that the minimum value of the global and local neighbors is used as the kernel size.

[0147] The two convolutions are only single layers and do not use padding or pooling.

[0148] Subsequently, the features from the two directions are concatenated to form a long-field context representation. :

[0149] (16)

[0150] Finally, by transpose convolution... Reconstructing long-field contextual images :

[0151] (17)

[0152] in, This is a transposed convolution kernel.

[0153] S3-3-2-2, Long-field-of-view (LAV) correlation pattern feature extraction. Long-field-of-view correlation images. Process in the same way. Use a shared large convolutional kernel. and Extracting long-field-of-view related features along two directions and :

[0154] (18)

[0155] The features from the two directions are fused to obtain the long-field-of-view related features. :

[0156] (19)

[0157] Using transposed convolution Reconstruct the corresponding long-field-of-view associated image :

[0158] (20)

[0159] in, This is a transposed convolution kernel.

[0160] S3-3-2-3, Dual-view fusion.

[0161] Long field of view features obtained from two views and The parts are flattened and spliced ​​together to form a fused long-field feature. :

[0162] (twenty one)

[0163] S3-3-2-4, Time Point Reconstruction.

[0164] Hire another two-layer MLP network to The observations at time point n are used as input for reconstruction. The input layer of this MLP network contains 10 neurons, hidden layer contains There are 1 neuron in the output layer and 1 neuron in the output layer. The entire reconstruction process is described as follows:

[0165] (twenty two)

[0166] in, , For a trainable parameter matrix, , This corresponds to the bias term.

[0167] S3-3-3, Short-field-long-field contrastive learning: Since both the short-field and long-field branches aim to reconstruct the same time point, they naturally constitute two contrastive views. To jointly optimize the two learning branches, a contrastive learning process without negative samples is introduced to guide the learning of the entire framework.

[0168] The training loss of this framework consists of three parts:

[0169] ① Comparison of losses This loss encourages the two learning branches to maintain as much consistency as possible in their reconstruction results at the same time point, as shown in the formula:

[0170] (twenty three)

[0171] in, and represents the reconstruction values ​​of the short-field learning branch and the long-field learning branch at time point n, respectively, where N represents the number of reconstruction time points.

[0172] ② Short field of vision reconstruction loss This loss simultaneously constrains the reconstruction errors of the time point values ​​and the two short-field-of-view 2D images, and the formula is as follows:

[0173] (twenty four)

[0174] in, For the true value at time point n, A real-world example of a short-field-of-view context map. A real-world example of a short-field-of-view correlation diagram.

[0175] ③Long-field reconstruction loss This loss is symmetrical to the short-field reconstruction loss and is responsible for constraining the time point values ​​and the reconstruction errors of the two long-field 2D images.

[0176] (25)

[0177] in, This is a real-world image of a long-field context view. This is a real-world example of a long-field-of-view correlation graph.

[0178] Combining the above three factors, the overall training loss of this framework is... for:

[0179] (26)

[0180] Among them, comparative loss The values ​​are considered as the difference between short-field and long-field modes at each time point.

[0181] Finally, it should be noted that different variables have different 1D large convolutional kernels, representing the learning of different patterns, while the two MLP networks share them among all variables, thus balancing the ability to extract individual patterns within variables with lightweight model complexity.

[0182] Step S4, multivariate joint anomaly scoring.

[0183] In industrial control systems, the coupling strength among multiple variables varies significantly: some variables exhibit strong coupling relationships, while others show weak or no correlation. Based on this fact, this invention employs a multi-variable joint anomaly scoring strategy to generate robust final anomaly scores for each time point, preventing noise interference from individual variables.

[0184] For a time point t to be detected that contains D variables, the process of generating anomaly scores using the trained anomaly detection model is as follows:

[0185] S4-1, for each variable Using historical data as time point t to construct dual-view Figure 2 D-images, including short-field context map, long-field context map, short-field association map, and long-field association map.

[0186] S4-2, Input these four 2D images into the trained anomaly detection model to obtain the short-field reconstruction values ​​respectively. Reconstruction value with long field of view The difference between the two can be represented as the short-field-long-field pattern difference on variable d.

[0187] S4-3, the above process is carried out in all Execute in parallel on each variable to obtain Differences between short field of vision and long field of vision patterns These pattern variance values ​​are sorted from largest to smallest, and the largest Q-value is selected to highlight the most significant evidence of multivariate anomalies. The average of the selected Q variance values ​​is then used as the final anomaly score at time point t to prevent interference from high anomaly scores on individual variables. Final outlier score for:

[0188] (27)

[0189] S4-4, compare the final anomaly score with the preset threshold. A comparison is made to determine whether the time point is abnormal; the determination formula is as follows:

[0190] (28)

[0191] like Then the observation vector at the time point is considered to be If it is abnormal, it is considered normal; otherwise, it is considered normal.

[0192] Experimental verification:

[0193] To comprehensively evaluate the applicability and generalization ability of the proposed method in industrial control system scenarios, eight publicly available multivariate industrial control system datasets were selected, as shown in Table 1. Specifically, SKAB is collected from an industrial test bench and includes multi-sensor time-series data generated under controllable fault injection conditions; GECCO is a 9-dimensional industrial control system dataset released by the GECCO 2018 Challenge, recording the dynamic changes of the water treatment process under normal and abnormal operating conditions; Genesis comes from a modular industrial cyber-physical system, providing high-frequency measurement data with a sampling period of 50 ms, including programmable logic controller state machine information, labeled anomalies, and unlabeled but progressively degraded operating data; PSM contains 25-dimensional monitoring signals from a real industrial server system; SWaT is a widely used benchmark dataset from a physical water treatment control system, covering 51 sensor and actuator signals; PUMP provides multi-sensor monitoring data from an industrial pump system; HAI contains heterogeneous control system signals from various industrial components such as pumps, valves, and pressure sensors; and WaDi is a large-scale dataset from a real water distribution control system, containing 127-dimensional monitoring signals.

[0194] Table 1 Dataset

[0195]

[0196] Nine advanced models were selected as benchmark models for comparison. The selection criteria for all benchmark models included three aspects: ① 1D vs 2D driven modeling: 2DTSAD (the model of this invention) and TimesNet use 2D driven modeling; GNNAD, CST-GL, and GDCMAD are based on high-dimensional graph structure modeling; the remaining methods use traditional 1D time series modeling; ② Multi-view learning: CST-GL, 2DTSAD, CrossAD, TransDe, and GDCMAD are multi-view anomaly detection models, while the remaining benchmark models are single-view learning models; ③ Deep vs shallow structure: SimAD and COUTA use shallow lightweight structures, while the remaining models are based on deep neural network architectures.

[0197] To comprehensively evaluate model performance, Accuracy (ACC), Recall, and F1 score (F1) are used as evaluation metrics. Specifically, ACC measures the percentage of time points that are correctly classified; Recall represents the proportion of successful detections among all real anomaly time points. F1 is calculated based on a point adjustment strategy, which can mitigate the evaluation bias caused by strict time point alignment, thus more closely reflecting actual industrial testing needs.

[0198] (a) Accuracy test.

[0199] The 2DTSAD of this invention was compared with nine state-of-the-art (SOTA) benchmark models on eight industrial control system datasets.

[0200] Table 2 Accuracy Analysis (Bold text indicates best performance, underlined text indicates second-best performance)

[0201]

[0202] Performance: Table 2 summarizes the detection results of all methods on eight datasets.

[0203] ① Stability: 2DTSAD exhibits the strongest overall stability across different datasets and evaluation metrics. Specifically, 2DTSAD ranks among the top two on most metrics across eight datasets, while some benchmark models show significant performance fluctuations. For example, on the SKAB dataset, 2DTSAD's ACC is 0.9998 and F1 is 0.9997, significantly outperforming TimesNet (ACC 0.9660, F1 0.9504) and CrossAD (ACC 0.9014, F1 0.8771). On the HAI dataset, although TransDe achieves an F1 of 0.9355 and is somewhat competitive, 2DTSAD maintains a more balanced and superior performance across multiple metrics, achieving an F1 of 0.9835. These results indicate that 2DTSAD has lower sensitivity to threshold settings and stronger robustness under different operating conditions.

[0204] ② Comparison of 1D, 2D, and graph modeling: Compared to 1D modeling methods (such as COUTA and SimAD), methods based on 2D or graph structure modeling (such as 2DTSAD, GNNAD, CST-GL, and GDCMAD) generally achieve higher detection performance. For example, on the SKAB dataset, 2DTSAD has an ACC of 0.9998 and GNNAD has an ACC of 0.9948, both higher than COUTA (0.9856) and SimAD (0.9487).

[0205] ③ Multi-view learning: Multi-view methods generally exhibit stronger and more stable detection capabilities than single-view methods. For example, on the SWAT dataset, 2DTSAD has an F1 score of 0.9436, which is significantly better than the F1 score of TimesNet (0.8311).

[0206] ④ Comparison of deep and shallow structures: Deep models generally outperform shallow, lightweight structures, providing higher-quality anomaly detection. On the WaDi dataset, 2DTSAD achieves an F1 score of 0.9279, while COUTA and SimAD achieve F1 scores of 0.8688 and 0.6374, respectively.

[0207] Visualization: To further verify the accuracy and discrimination ability of 2DTSAD, this experiment visualized the anomaly identifiability.

[0208] Figures 7 to 9 On the HAI, SKAB, and PUMP datasets, the anomaly identifiability in 1D and 2D spaces was compared for three typical patterns: drift anomalies, periodic anomalies, and sudden anomalies. The figures show that: First, among the three types of anomalies, the pattern differences between short and long fields of view can more clearly distinguish normal and anomalous time points; second, in 2D contextual and 2D related views, these differences are more easily identified than in 1D views; finally, for periodic anomalies, the two 2D views are complementary, with the differences being more prominent in the 2D related view; for sudden anomalies, the 2D contextual view provides clearer distinguishing boundaries.

[0209] These experimental results demonstrate that the 2DTSAD of this invention can maintain high detection accuracy and stability under different industrial control system datasets and various anomaly types.

[0210] (b) Real-world scenario analysis experiment.

[0211] To evaluate the practicality of the 2DTSAD invention in real-world industrial scenarios, a case study was conducted on a physical test bench for simulating industrial control system faults. The physical test bench consisted of a motor, gearbox, magnetic powder brake for load regulation, motor controller, and edge-side data acquisition unit, all coordinated by industrial control software. To comprehensively monitor system behavior, the platform deployed various sensors, including torque sensors, triaxial accelerometers, and current and voltage probes. These sensors simultaneously acquired mechanical and electrical signals during system operation, forming a typical multi-sensor industrial control system monitoring environment.

[0212] Based on this physical test bench, 50 seconds of multi-sensor signals were acquired at a sampling rate of 10 kHz. Each data record contained six synchronous channels: x, y, and z-axis vibration signals, torque, current, and voltage measurements, resulting in a total of 500,000 time points. To construct anomalous behavior under controllable and reproducible conditions, fault injection was performed using control software. Specifically, a 2.5-second anomalous segment was injected every 10 seconds, repeated five times in each record. Two datasets were generated following this process: the first dataset contained only a single fault type, corresponding to gear tooth breakage; the second dataset contained composite anomalies, combining gear tooth breakage with bearing outer race failure. For each dataset, 70% of the time points were used for model training, and the remaining data were used for testing.

[0213] Table 3 presents the detection performance of all comparative models on single and composite anomaly datasets:

[0214] ① Single anomaly scenario: 2DTSAD achieved the best overall performance among all methods, with an ACC of 0.9881 and an F1 score of 0.9825, indicating that it can accurately and stably detect local faults. In contrast, some benchmark models such as CST-GL and GDCMAD showed significant performance degradation, especially in recall.

[0215] ② Complex anomaly scenarios: When multiple anomaly types coexist, detection becomes more difficult, but 2DTSAD still maintains its advantage, achieving an ACC of 0.9972 and an F1 score of 0.9948. Compared with other methods, it has a more significant advantage in recall, demonstrating stronger robustness in complex anomaly modes.

[0216] Table 3. Anomaly detection results for single and composite anomalies.

[0217]

[0218] The 2DTSAD of this invention can effectively handle complex time series data of industrial control systems in real industrial scenarios.

[0219] (c) Timeliness and resource consumption experiment.

[0220] Ten models were deployed on a PC platform (CPU: i7-10700KF, GPU: RTX 3090, RAM: 64G, VGA-RAM: 24G) and uniformly tested on the PUMP dataset. Eight efficiency metrics were used to measure the timeliness and resource consumption of all models, including training cycle time, testing time, number of model parameters, CPU and GPU utilization, memory and VRAM usage, and FLOPs. Table 4 shows the comparison results of the 10 models.

[0221] ① Timeliness: 2DTSAD's training and testing speeds are generally faster than most deep learning models. Its single training cycle takes only 207.8 seconds, while GNNAD, TimesNet, and CrossAD take significantly longer, approximately 411.9–476.6 seconds. During testing, 2DTSAD's inference time is 32.4 seconds, significantly faster than TimesNet (359.6 seconds) and DualTF (381.9 seconds).

[0222] ② Resource Consumption: 2DTSAD also demonstrates high efficiency in terms of resource usage. Its parameter count is only 7.9 K, significantly lower than DualTF (4954.9 K) and CrossAD (3296.0 K). Furthermore, 2DTSAD's CPU and GPU utilization rates are 41.5% and 28.1%, respectively, lower than most depth models. For example, CrossAD's CPU and GPU utilization rates are 60.0% and 90.1%, respectively, while COUTA reaches 82.7% and 96.6%.

[0223] ③ Computational cost: The computational cost of 2DTSAD is only 7.3 GFLOPs, which is significantly lower than that of SimAD (721.8 GFLOPs) and DualTF (164.4 GFLOPs).

[0224] Table 4 Timeliness and Resource Consumption Analysis

[0225]

[0226] The 2DTSAD of this invention is also applicable to industrial scenarios that are sensitive to real-time performance and deployment costs.

[0227] This invention proposes 2DTSAD, an unsupervised time-point anomaly detection framework for industrial control systems. This framework, driven by dual-view learning and time-series imaging, aims to overcome the shortcomings of existing research in combining fine-grained time-series imaging and multi-view learning for time-point TSAD tasks. Extensive experimental results on eight publicly available multi-sensor datasets for industrial control systems demonstrate that 2DTSAD exhibits strong and stable anomaly detection performance: it achieves state-of-the-art results on multiple datasets and across various evaluation metrics, and consistently maintains a leading position on other datasets. Furthermore, thanks to its small model size, 2DTSAD offers fast inference speed and low resource consumption during the testing phase. Finally, a case study based on a real industrial control system physical test bench further validates the reliability and engineering usability of 2DTSAD in real-world industrial scenarios.

[0228] The above embodiments are merely preferred examples of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Therefore, any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention should fall within the protection scope of the present invention.

Claims

1. An anomaly detection method for an industrial control system driven by time-series dual-view imaging, characterized in that, Includes the following: Acquire time series data from multiple sensors in an industrial control system, and construct corresponding short-field-of-view and long-field-of-view sequences for each time point to be detected; The short-field-of-view sequence and the long-field-of-view sequence are converted from 1D time series into 2D images by time-dependent context view imaging and time-independent numerical correlation view imaging, respectively, to form a fine-grained time-point-level dual-view image representation. The framework for constructing an anomaly detection model is based on the collaboration of short-field dual-view images and long-field dual-view images at the target time point. By extracting features and sharing the learning of differences between short-field and long-field patterns, the identifiability of anomaly patterns is enhanced. Based on the learned pattern differences, aggregate scoring is performed at the multivariate level to generate robust anomaly scores at each time point, and time-point anomaly detection is achieved based on the anomaly scores. Construct the short field-of-view sequence and the long field-of-view sequence, using the current time point to be judged. As the endpoint, extract continuous segments in the historical direction. A number of time points constitute a time point. The corresponding short field-of-view sequence; based on time points Using the endpoint as the starting point, perform G samples at fixed intervals L in the historical direction to generate time points. The corresponding long field-of-view sequence; A feature extractor based on a bidirectional large convolutional kernel is used to extract features from 2D images. The feature extractor uses a large convolutional kernel to simulate the feature patterns to be learned. The large convolutional kernel is shared in both short-field learning and long-field learning processes, so that the two learning processes learn the same feature patterns. The feature extractor uses bidirectional feature extraction to capture features. The anomaly detection model consists of three components: time-point dual-view time-series imaging, short-field-long-field contrastive learning with dual-view coupling, and multivariate joint anomaly scoring. The time-point-level dual-view time-series imaging component maps the 1D short field of view and long field of view sequence modes corresponding to each time point from two views to 2D images, namely a time-dependent context view and a time-independent relational view. The dual-view coupled short-field-long-field contrastive learning component captures the short-field-long-field pattern differences at each time point through comparative learning between two branches: the reconstruction of the short-field 2D image to a certain time point and the reconstruction of the long-field 2D image to the same time point. The multivariate joint anomaly scoring component aggregates short-field-long-field pattern differences across all variables to generate a final anomaly score for each time point.

2. The anomaly detection method for an industrial control system driven by time-series dual-view imaging according to claim 1, characterized in that, The feature extractor based on bidirectional large kernel convolution specifically performs the following operations: The first 1D large convolution kernel is used to convolve along the horizontal direction of the input two-dimensional image to obtain the first direction feature map; The second 1D large convolution kernel is used to convolve along the vertical direction of the input 2D image to obtain the second direction feature map; By fusing the first-direction feature map and the second-direction feature map, a bidirectional feature representation of the input 2D image is obtained.

3. The anomaly detection method for an industrial control system driven by time-series dual-view imaging according to claim 1, characterized in that, The time-point-level dual-view time-series imaging component covers the local behavior and long-term patterns at each time point, including the following: Complementary dual-view construction simultaneously characterizes feature information from two perspectives at each time point, including a time-dependent context view and a time-independent relational view, forming a dual-view representation from two complementary paths. Short field-of-view and long field-of-view combined imaging generates short field-of-view and long field-of-view 2D images at each time point under each view; Bidirectional information embedding explicitly embeds bidirectional pattern information into each 2D image, enhancing the extractable features contained within the 2D image.

4. The anomaly detection method for an industrial control system driven by time-series dual-view imaging according to claim 3, characterized in that, The dual-view coupled short-field-long-field contrast learning component consists of three modules, including: The reconstruction learning from short-field 2D images to a single time point uses a short-field 2D image under dual views at a single time point as input, and reconstructs the observation value at that time point by performing bidirectional convolution using a shared 1D large convolution kernel. Reconstruction learning from long-field 2D images to a single time point: Using long-field 2D images with dual views at the same time point as input, the observations at that time point are reconstructed using bidirectional shared large convolutional kernels. Short-field-long-field contrastive learning jointly optimizes the two learning branches and introduces a contrastive learning process without negative samples to guide the learning of the entire framework.

5. The anomaly detection method for an industrial control system driven by time-series dual-view imaging according to claim 4, characterized in that, The training loss of the anomaly detection model framework includes contrast loss, short field-of-view reconstruction loss, and long field-of-view reconstruction loss; the short field-of-view reconstruction loss constrains the short field-of-view reconstruction value and the reconstruction error of its corresponding input image; the long field-of-view reconstruction loss constrains the long field-of-view reconstruction value and the reconstruction error of its corresponding input image.

Images