Industrial control system-oriented cross-working-condition physical twin modeling and anomaly detection method

Abstract

The invention discloses a cross-working-condition physical twin modeling and anomaly detection method oriented to an industrial control system, a data-physics fused physical twin model is constructed and applied to an industrial control system anomaly detection framework, the framework takes the physical twin model as a core, an industrial physical process is expressed through a differential equation set, and an anomaly detection result is obtained. A physical constraint is introduced by a PINN; meanwhile, the model is continuously calibrated through real-time operation data, and dynamic updating is achieved; and the cross-working-condition, cross-stage and cross-scene adaptive capability is realized through parameter sharing and transfer learning. And comparing the trained physical twinborn model with real-time data, and judging whether the system is abnormal or not by analyzing the deviation between a predicted value and an observed value. According to the framework, high fitting of data driving and interpretability of physical driving are organically combined, and high-precision, interpretable and transferable anomaly detection capability is provided for an industrial control system.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security anomaly detection technology, and in particular to a physical twin modeling and anomaly detection method for cross-operating conditions in industrial control systems. Background Technology

[0002] Industrial control systems (ICS) are the core support for critical infrastructure in industries such as power, metallurgy, and petrochemicals. Their safe and stable operation is directly related to production safety and public safety. With the deep integration of information and communication technologies and operational technologies, ICS are increasingly exposed to cyberattack risks. Currently, cyberattacks against ICS mainly focus on two key components: actuators and sensors. On the one hand, attackers interfere with actuator operation by tampering with or forging control commands, such as forcibly shutting down equipment that should be turned on, or maintaining the current state when switching operating conditions, directly disrupting control logic and endangering system stability. On the other hand, attackers maliciously modify sensor data, including abrupt, threshold-exceeding tampering to induce system malfunctions or crashes, as well as covert attacks with subtle, gradual shifts. Such attacks are difficult to detect in the short term but can accumulate over time, leading to serious process deviations and safety hazards. The high degree of concealment and harm of these attack methods makes the detection of anomalies in ICS face higher requirements for accuracy and real-time response.

[0003] Deep learning technology has been widely applied in anomaly detection research for the massive and time-series operational data in industrial control systems. Existing solutions primarily rely on training models using neural networks on normal system operational data, and then using prediction or model reconstruction to identify abnormal datasets. These methods mainly include the following categories:

[0004] 1. Time-series prediction-based models utilize structures such as RNN, LSTM, and GRU to learn the time dependencies between industrial process variables, predict future states, and determine anomalies based on deviations from predicted sensor values. This strategy is suitable for control systems with significant dynamic characteristics.

[0005] 2. Unsupervised models based on reconstruction learning, such as autoencoders (AEs), variational autoencoders (VAEs), and deep generative models, learn the latent space of normal data to compress sensor measurement results into lower-dimensional embeddings and reconstruct them. Inputs that cannot be effectively reconstructed are considered anomalous. This approach is suitable for industrial scenarios where anomalous samples are extremely rare.

[0006] 3. The graph neural network (GNN) method is based on the complex coupling relationship between various sensor and actuator variables in industrial control systems. By modeling the graph structure, the consistency detection of dependencies between devices or physical quantities can be realized, thereby improving the detection capability in multi-sensor joint attack and defense scenarios.

[0007] 4. Adversarial learning-based methods employ GANs and various variant models, using adversarial approaches to train the model's feature representation and anomaly discrimination capabilities, adapting to more complex data distributions.

[0008] Currently, anomaly detection methods for network attacks on industrial control systems mainly rely on data-driven strategies such as machine learning, judging anomalies through time-series prediction or reconstruction errors. While these methods possess strong fitting capabilities, they lack an understanding of the physical mechanisms, making it difficult to effectively identify progressive, covert attacks, and they cannot explain the specific technological causes and physical mechanisms underlying the anomalies. In contrast, detection methods based on physical-driven modeling, although offering some interpretability, struggle to maintain accuracy and adaptability in real-world industrial scenarios involving multiple operating conditions, complex coupled processes, and equipment aging. Furthermore, they cannot dynamically adjust to changes in data distribution. Therefore, existing methods cannot simultaneously meet the comprehensive requirements of high-reliability detection, physical consistency assurance, and dynamic environmental adaptation.

[0009] To address the aforementioned issues, this invention proposes constructing a data-physical fusion physical twin model to enhance the security capabilities of industrial control systems. Digital twins, as an important emerging technology in recent years, have proven capable of achieving high-precision state modeling and risk prediction in industrial control environments. A typical digital twin model consists of four layers: a geometric model, a physical model, a behavioral model, and a rule model. These four layers work together to support the full lifecycle mapping and evolution of industrial systems. Among them, the physical model is responsible for depicting the internal mechanisms and dynamic laws of the industrial control system, and is a key component for achieving real-world physical process mapping, maintaining physical consistency, and conducting security analysis. By integrating data-driven and physical-driven approaches, the physical twin model can simultaneously possess high-precision fitting capabilities and physical interpretation capabilities, providing a more reliable technical foundation for anomaly detection in industrial control systems. Summary of the Invention

[0010] The purpose of this invention is to provide a physical twin modeling and anomaly detection method for cross-condition industrial control systems.

[0011] The present invention provides a physical twin modeling and anomaly detection method for cross-condition industrial control systems, which adopts the following technical solution:

[0012] A physical twin modeling and anomaly detection method for industrial control systems across operating conditions, specifically including:

[0013] S1. Based on the historical operation logs of the industrial scenario, equipment manuals, PLC control logic, and pump and valve operating conditions, a set of differential equations is constructed to describe the dynamic changes of the system and provide a source of physical constraints for the multi-task PINN model.

[0014] S2. Encode sensor and actuator data within the historical time window, extract the dynamic evolution characteristics of the system in the corresponding time period, and use them as a shared representation for subsequent models. Extract time features from multi-source industrial control data, obtain low-dimensional potential features, and capture the underlying system dynamics.

[0015] S3. Establish a shared temporal feature network and use it as a time encoder for task branches, and realize cross-stage sharing of dynamic patterns through the time encoder to eliminate redundant learning;

[0016] S4. Establish a derivative value prediction network and a prediction value network to provide derivative consistency constraints and physical consistency constraints for the multi-task PINN model.

[0017] S5. Establish a cross-domain transfer learning mechanism, which automatically extracts short-time window data as incremental data to fine-tune and update the physical twin model, so that the model can be continuously calibrated as the working conditions change dynamically.

[0018] S6. Establish an anomaly detection mechanism to compare real-time observation data with the prediction results of the physical twin model.

[0019] Furthermore, the system of differential equations in S1 includes:

[0020]

[0021]

[0022]

[0023]

[0024] in Represented as the first Water level values ​​in individual water storage tanks during water level changes This is expressed as the influent flow rate. This is indicated as the water inlet control switch. Expressed as outflow rate, This is indicated as a water flow switch. Represented as the cross-sectional area of ​​the storage tank . This indicates the pressure difference between the ultrafiltration and reverse osmosis stages. This represents the traffic volume during that phase. This represents the actuator state at this stage. This is represented by the intrinsic membrane resistance at this stage. This is represented as the dirt resistance at this stage. The concentration is expressed as the concentration produced by chemical addition. Indicates impact Unknown injection dose, This indicates the volume of the storage tank where chemical reagents are added. This is expressed as a change in the concentration of free chlorine. Represented as unknown light intensity, This is expressed as the effect on the reaction constant.

[0025] Furthermore, the prediction network shares temporal feature vectors. As input, the state values ​​of each physical variable are processed through a lightweight multilayer feedforward neural network. Modeling is performed to directly predict key state variables, including water level, concentration, and pressure difference. The prediction network is responsible for data fitting, ensuring numerical accuracy by minimizing the error between observed and predicted values, and combining physical residual constraints to ensure that the prediction results meet data consistency and conform to the physical laws of the system.

[0026] Furthermore, the derivative value prediction network also uses shared features. First derivatives of physical variables independently modeled as input The derived numerical network is used to characterize the dynamic evolution trend of the system. By jointly constraining the numerical prediction results and the PDE operator, it can reveal the dynamic process of the system, enhance the model's ability to express the laws of physical change, and thus improve the stability and physical consistency under small sample and complex working conditions.

[0027] Furthermore, the fine-tuning fusion update process of the cross-domain learning mechanism in S5 is as follows:

[0028] S51. By performing industrial mechanism analysis on the log data of the source domain scenario, train the source domain physical twin model A;

[0029] S52. Extract parameters with cross-scene sharing value from the physical twin model A. The parameters with cross-scene sharing value include shared temporal feature coding layer parameters, basic physical structure parameters, weights and biases of intermediate layers. Use the parameters with cross-scene sharing value as the initialization parameter set Pshare of the target scene model.

[0030] S53. Initialize the target physical twin model B using the shared parameter set Pshare;

[0031] S54. Select a time window from the real-time data of the target scene to form an incremental dataset Dt;

[0032] S55. While keeping the physical equation constraint structure unchanged, maintain slight updates or freezes of the shared temporal feature layer and fine-tune the data-related task branch network.

[0033] S56. Train the physical twin model B using a loss function with regularization constraints;

[0034] S57. If the loss is greater than the threshold, return to step S55 to unfreeze the training model of part of the encoder layer. If the loss is less than the threshold, fuse the physical constraint parameters of the target scene with the feature representation, and calibrate each physical parameter to make it consistent with the features of the target device.

[0035] S58. Perform periodic incremental fine-tuning using real-time streaming data, and perform model fusion and updating in step S55, so that the physical twin model continuously updates the model when the working conditions change. When the model drifts too much, a cross-scene migration update cycle is triggered.

[0036] The anomaly detection mechanism in step S6 includes constructing a physical consistency detection by using the state prediction value and derivative prediction value output by the physical twin model through the industrial control system to determine whether it violates physical laws; when a situation does not satisfy the physical equation, it is determined to be an anomaly, and the residual between the model prediction value and the actual value is further calculated to determine whether the residual exceeds the threshold range, thus determining an anomaly.

[0037] The regularization loss function includes a first loss function and a second loss function, wherein the first loss function is: ,in For the first The total loss of each task For the first Data loss per task For the first The derivative loss for each task, For the first The parameters in the physical loss formula for each task , , These are hyperparameters of the various losses, used to balance the contributions of data fitting.

[0038] The second loss function is Used for fine-tuning updates, where This is represented as the total loss function ultimately used for optimization. This is represented as the original loss function for the target task. Represented as the first step in the training process of the target task The current values ​​of the parameters, This represents the first time the source task training is completed. Fixed values ​​for each parameter This indicates the importance weight of the source task parameters relative to the shared physical constraints. This is the balance coefficient.

[0039] The beneficial effects of the physical twin modeling and anomaly detection method for cross-condition industrial control systems provided by this invention are as follows:

[0040] 1. This invention proposes a multi-level verification mechanism for the consistency of prediction results from a physical twin model with real-time measurement data, including both data consistency and physical consistency. This mechanism effectively reduces noise interference and false alarm rates, enabling the system to maintain high detection accuracy even under minor sensor disturbances.

[0041] 2. This invention improves physical interpretability and enables the location and classification of anomalies. The detection mechanism judges the consistency of physical laws based on physical deviation and derivative deviation, making anomalies interpretable, locatable, and categorizable, thus avoiding the uncertainties brought about by black-box models.

[0042] 3. This invention proposes to dynamically fuse real-time sensor data, predicted state, derivatives and physical constraints to achieve real-time consistency analysis and anomaly decision-making, thereby improving the stability and robustness of the physical twin model.

[0043] 4. This invention proposes to achieve the sharing of the basic layer, fine-tuning of the domain layer, and regularization constraints of the physical twin model through a cross-domain transfer learning strategy, so that the anomaly detection mechanism can quickly adapt to new working conditions or new industrial scenarios, reduce data dependence and improve generalization ability, and maintain high detection accuracy. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the process of the present invention;

[0045] Figure 2 This is a schematic diagram of the data-physical fusion process of the present invention;

[0046] Figure 3 This is a schematic diagram of the transfer learning process of the present invention;

[0047] Figure 4 This is a schematic diagram of the anomaly detection process of the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0049] See Figures 1 to 4As shown, this embodiment of the invention provides a method for physical twin modeling and anomaly detection across operating conditions in industrial control systems, including:

[0050] S1. Based on the historical operation logs of the industrial scenario, equipment manuals, PLC control logic, and pump and valve operating conditions, a set of differential equations is constructed to describe the dynamic changes of the system and provide a source of physical constraints for the multi-task PINN model.

[0051] S2. Encode sensor and actuator data within the historical time window, extract the dynamic evolution characteristics of the system in the corresponding time period, and use them as a shared representation for subsequent models. Extract time features from multi-source industrial control data, obtain low-dimensional potential features, and capture the underlying system dynamics.

[0052] S3. Establish a shared temporal feature network and use it as a time encoder for task branches, and realize cross-stage sharing of dynamic patterns through the time encoder to eliminate redundant learning;

[0053] S4. Establish a derivative value prediction network and a prediction value network to provide derivative consistency constraints and physical consistency constraints for the multi-task PINN model.

[0054] S5. Establish a cross-domain transfer learning mechanism, which automatically extracts short-time window data as incremental data to fine-tune and update the physical twin model, so that the model can be continuously calibrated as the working conditions change dynamically.

[0055] S6. Establish an anomaly detection mechanism to compare real-time observation data with the prediction results of the physical twin model.

[0056] In this embodiment, the system of differential equations in S1 includes:

[0057]

[0058]

[0059]

[0060]

[0061] in Represented as the first Water level values ​​in individual water storage tanks during water level changes This is expressed as the influent flow rate. This is indicated as the water inlet control switch. Expressed as outflow rate, This is indicated as a water flow switch. Represented as the cross-sectional area of ​​the storage tank . This indicates the pressure difference between the ultrafiltration and reverse osmosis stages. This represents the traffic volume during that phase. This represents the actuator state at this stage. This is represented by the intrinsic membrane resistance at this stage. This is represented as the dirt resistance at this stage. The concentration is expressed as the concentration produced by chemical addition. Indicates impact Unknown injection dose, This indicates the volume of the storage tank where chemical reagents are added. This is expressed as a change in the concentration of free chlorine. Represented as unknown light intensity, This is expressed as the effect on the reaction constant.

[0062] In this embodiment, the prediction network uses a shared temporal feature vector. As input, the state values ​​of each physical variable are processed through a lightweight multilayer feedforward neural network. Modeling is performed to directly predict key state variables, including water level, concentration, and pressure difference. The prediction network is responsible for data fitting, ensuring numerical accuracy by minimizing the error between observed and predicted values, and combining physical residual constraints to ensure that the prediction results meet data consistency and conform to the physical laws of the system.

[0063] In this embodiment, the derivative value prediction network also uses shared features. First derivatives of physical variables independently modeled as input The derived numerical network is used to characterize the dynamic evolution trend of the system. By jointly constraining the numerical prediction results and the PDE operator, it can reveal the dynamic process of the system, enhance the model's ability to express the laws of physical change, and thus improve the stability and physical consistency under small sample and complex working conditions.

[0064] In this embodiment, the fine-tuning fusion update process of the cross-domain learning mechanism in S5 is as follows:

[0065] S51. By performing industrial mechanism analysis on the log data of the source domain scenario, train the source domain physical twin model A;

[0066] S52. Extract parameters with cross-scene sharing value from the physical twin model A. The parameters with cross-scene sharing value include shared temporal feature coding layer parameters, basic physical structure parameters, weights and biases of intermediate layers. Use the parameters with cross-scene sharing value as the initialization parameter set Pshare of the target scene model.

[0067] S53. Initialize the target physical twin model B using the shared parameter set Pshare;

[0068] S54. Select a time window from the real-time data of the target scene to form an incremental dataset Dt;

[0069] S55. While keeping the physical equation constraint structure unchanged, maintain slight updates or freezes of the shared temporal feature layer and fine-tune the data-related task branch network.

[0070] S56. Train the physical twin model B using a loss function with regularization constraints;

[0071] S57. If the loss is greater than the threshold, return to step S55 to unfreeze the training model of part of the encoder layer. If the loss is less than the threshold, fuse the physical constraint parameters of the target scene with the feature representation, and calibrate each physical parameter to make it consistent with the features of the target device.

[0072] S58. Perform periodic incremental fine-tuning using real-time streaming data, and perform model fusion and updating in step S55, so that the physical twin model continuously updates the model when the working conditions change. When the model drifts too much, a cross-scene migration update cycle is triggered.

[0073] In this embodiment, the anomaly detection mechanism in step S6 includes constructing a physical consistency detection by using the state prediction value and derivative prediction value output by the physical twin model through the industrial control system to determine whether it violates physical laws; when a situation does not satisfy the physical equation, it is determined to be an anomaly, and further calculates the residual between the model prediction value and the actual value to determine whether the residual exceeds the threshold range, thus determining an anomaly.

[0074] In this embodiment, the regularization loss function includes a first loss function and a second loss function, wherein the first loss function is: ,in For the first The total loss of each task For the first Data loss per task For the first The derivative loss for each task, For the first The parameters in the physical loss formula for each task , , These are hyperparameters of the various losses, used to balance the contributions of data fitting.

[0075] In this embodiment, the second loss function is Used for fine-tuning updates, where This is represented as the total loss function ultimately used for optimization. This is represented as the original loss function for the target task. Represented as the first step in the training process of the target task The current values ​​of the parameters, This represents the first time the source task training is completed. Fixed values ​​for each parameter This indicates the importance weight of the source task parameters relative to the shared physical constraints. This is the balance coefficient.

[0076] Compared with existing deep learning-based anomaly detection methods, the core differences in the anomaly detection mechanism improved by this invention are mainly reflected in the following three aspects:

[0077] 1. This invention introduces a prediction mechanism based on physical consistency, addressing the insensitivity of existing methods to anomalies such as covert attacks. It achieves synchronous constraints on the physical variables themselves and their changing trends, enabling anomalies to be amplified and revealed at an early stage, thus improving detection accuracy.

[0078] 2. The loss function constrained by a system of physical differential equations differs from existing technologies where the loss function only includes prediction error and lacks physical constraints, leading to model distortion under changing operating conditions, sensor noise, or abnormal interference. This invention combines data loss, derivative loss, and physical loss to construct a composite loss, ensuring that the prediction results are strictly constrained by industrial control mechanisms. This significantly improves the model's generalization and stability, thereby enhancing anomaly detection accuracy.

[0079] 3. Cross-domain parameter sharing and transfer learning enable physical twin models to quickly adapt to different working environments and achieve accurate fitting while maintaining overall structural stability. Therefore, they can still maintain high-precision anomaly detection capabilities in new scenarios.

[0080] This paper proposes a multi-level verification mechanism for data consistency and physical consistency between the prediction results of the physical twin model and real-time measurement data. This mechanism effectively reduces noise interference and false alarm rate, enabling the system to maintain high detection accuracy under small sensor disturbances; it also improves physical interpretability and enables anomaly localization and classification. The detection mechanism judges the consistency of physical laws based on physical deviation and derivative deviation, making anomalies interpretable, localizable, and classifiable, avoiding the uncertainty brought by black-box models. It proposes dynamic fusion of real-time sensor data, predicted state, derivatives, and physical constraints to achieve real-time consistency analysis and anomaly decision-making, improving the stability and robustness of the physical twin model. Finally, it proposes a cross-domain transfer learning strategy to achieve basic layer sharing, domain layer fine-tuning, and regularization constraints of the physical twin model, enabling the anomaly detection mechanism to quickly adapt to new working conditions or new industrial scenarios, reduce data dependence, improve generalization ability, and maintain high detection accuracy.

[0081] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A physical twin modeling and anomaly detection method for cross-condition industrial control systems, characterized in that, Includes the following steps: S1. Based on the historical operation logs of the industrial scenario, equipment manuals, PLC control logic, and pump and valve operating conditions, a set of differential equations is constructed to describe the dynamic changes of the system and provide a source of physical constraints for the multi-task PINN model. S2. Encode sensor and actuator data within the historical time window, extract the dynamic evolution characteristics of the system in the corresponding time period, and use them as a shared representation for subsequent models. Extract time features from multi-source industrial control data, obtain low-dimensional potential features, and capture the underlying system dynamics. S3. Establish a shared temporal feature network and use it as a time encoder for task branches, and realize cross-stage sharing of dynamic patterns through the time encoder to eliminate redundant learning; S4. Establish a derivative value prediction network and a prediction value network to provide derivative consistency constraints and physical consistency constraints for the multi-task PINN model. S5. Establish a cross-domain transfer learning mechanism, which automatically extracts short-time window data as incremental data to fine-tune and update the physical twin model, so that the model can be continuously calibrated as the working conditions change dynamically. S6. Establish an anomaly detection mechanism to compare real-time observation data with the prediction results of the physical twin model.

2. The method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 1, characterized in that, The system of differential equations in S1 includes: ； ； ； ； in Represented as the first Water level values ​​in individual water storage tanks during water level changes This is expressed as the influent flow rate. This is indicated as the water inlet control switch. Expressed as outflow rate, This is indicated as a water flow switch. Represented as the cross-sectional area of ​​the storage tank , This indicates the pressure difference between the ultrafiltration and reverse osmosis stages. This represents the traffic volume during that phase. This represents the actuator state at this stage. This is represented by the intrinsic membrane resistance at this stage. This is represented as the dirt resistance at this stage. The concentration is expressed as the concentration produced by chemical addition. Indicates impact Unknown injection dose, This indicates the volume of the storage tank where chemicals are added. This is expressed as a change in the concentration of free chlorine. Represented as unknown light intensity, This is expressed as the effect on the reaction constant.

3. The method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 2, characterized in that, The prediction network shares time-series feature vectors. As input, the state values ​​of each physical variable are processed through a lightweight multilayer feedforward neural network. Modeling is performed to directly predict key state variables, including water level, concentration, and pressure difference. The prediction network is responsible for data fitting, ensuring numerical accuracy by minimizing the error between observed and predicted values, and combining physical residual constraints to ensure that the prediction results meet data consistency and conform to the physical laws of the system.

4. The method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 2, characterized in that, The derivative prediction network also uses shared features. First derivatives of physical variables independently modeled as input The derived numerical network is used to characterize the dynamic evolution trend of the system. By jointly constraining the numerical prediction results and the PDE operator, it can reveal the dynamic process of the system, enhance the model's ability to express the laws of physical change, and thus improve the stability and physical consistency under small sample and complex working conditions.

5. A method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 3, characterized in that, The fine-tuning and fusion update process of the cross-domain learning mechanism described in S5 is as follows: S51. By performing industrial mechanism analysis on the log data of the source domain scenario, train the source domain physical twin model A; S52. Extract parameters with cross-scene shared value from the physical twin model A. These parameters include shared temporal feature encoding layer parameters, basic physical structure parameters, and the weights and biases of intermediate layers. Use these parameters with cross-scene shared value as the initialization parameter set P of the target scene model. share ; S53, Using shared parameter set P share Initialize the target physical twin model B; S54. Select a time window from the real-time data of the target scene to form an incremental dataset D. t ; S55. While keeping the physical equation constraint structure unchanged, maintain slight updates or freezes of the shared temporal feature layer and fine-tune the data-related task branch network. S56. Train the physical twin model B using a loss function with regularization constraints; S57. If the loss is greater than the threshold, return to step S55 to unfreeze the training model of part of the encoder layer. If the loss is less than the threshold, fuse the physical constraint parameters of the target scene with the feature representation, and calibrate each physical parameter to make it consistent with the features of the target device. S58. Perform periodic incremental fine-tuning using real-time streaming data, and perform model fusion and updating in step S55, so that the physical twin model continuously updates the model when the working conditions change. When the model drifts too much, a cross-scene migration update cycle is triggered.

6. The method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 1, characterized in that, The anomaly detection mechanism in step S6 includes constructing a physical consistency detection by using the state prediction value and derivative prediction value output by the physical twin model through the industrial control system to determine whether it violates physical laws; when a situation does not satisfy the physical equation, it is determined to be an anomaly, and the residual between the model prediction value and the actual value is further calculated to determine whether the residual exceeds the threshold range, thus determining an anomaly.

7. A method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 5, characterized in that, The regularization loss function includes a first loss function and a second loss function, wherein the first loss function is: ,in For the first The total loss of each task For the first Data loss per task For the first The derivative loss for each task, For the first The parameters in the physical loss formula for each task , , These are hyperparameters of the various losses, used to balance the contributions of data fitting.

8. A method for physical twin modeling and anomaly detection across operating conditions in industrial control systems according to claim 7, characterized in that, The second loss function is Used for fine-tuning updates, where This is represented as the total loss function ultimately used for optimization. This is represented as the original loss function for the target task. Represented as the first step in the training process of the target task The current values ​​of the parameters, This represents the first time the source task training is completed. Fixed values ​​for each parameter This indicates the importance weight of the source task parameters relative to the shared physical constraints. This is the balance coefficient.

Images