Training method of industrial control configuration software anomaly detection model, model and electronic equipment

Abstract

The invention discloses a training method of an industrial control configuration software anomaly detection model, the industrial control configuration software anomaly detection model and electronic equipment. The method comprises the following steps: acquiring an execution path of a current action of industrial control configuration software to construct an action data set; constructing a multi-layer sensor network based on a preset framework; according to the multi-layer perceptron network and the training set, an industrial control configuration software anomaly detection model is obtained through training based on a preset balance algorithm, and the balance algorithm is obtained by combining a gradient coordination mechanism and non-negative positive class and label-free class learning algorithms. According to the method, the nnPU algorithm is subjected to weight adjustment through the loss function under the GHM, so that the problem that positive example and negative example loss contribution is unbalanced is solved, and meanwhile, in the balance algorithm obtained by combining the two, model overfitting can be avoided through risk loss function constraint. And meanwhile, training can be realized only through positive examples and label-free data, so that an anomaly detection model training scene when negative examples are scarce or even missing is adapted.

Description

Technical Field

[0001] This application relates to a training method for an anomaly detection model of industrial control configuration software, an anomaly detection model of industrial control configuration software, and electronic equipment, belonging to the field of industrial control system control technology. Background Technology

[0002] Power control systems are core infrastructure for ensuring power production, transmission, and dispatch. Configuration software, as a key component for communication between the process network layer and the control network layer, is responsible for real-time monitoring and control of devices such as RTUs and PLCs. With the advancement of network attack methods, attackers often cause abnormal behavior in configuration software by tampering with control commands or injecting malicious code, thereby damaging the power control system.

[0003] Currently, solutions for detecting the aforementioned abnormal actions in related technologies often suffer from the following problems: Normal action data (positive examples) constitutes a very high proportion in industrial control systems, while abnormal action data (negative examples) is scarce and difficult to obtain. Traditional models tend to favor positive examples, leading to a high rate of missed detections of abnormal behaviors. Furthermore, conventional nnPU (non-negative PU learning) algorithms in current technologies are prone to producing negative terms when estimating risk losses, resulting in model overfitting and an inability to adapt to the complex control behavior data distribution of industrial control systems. In addition, the execution paths of the underlying functions in configuration software have temporal and high-dimensional characteristics, and current anomaly detection models have not designed dedicated representation methods for this type of data, making it difficult to effectively extract abnormal features. Summary of the Invention

[0004] This application proposes a training method for an anomaly detection model of industrial control configuration software, the anomaly detection model of industrial control configuration software, and an electronic device.

[0005] The training method for the industrial control configuration software anomaly detection model in this application specifically includes: Obtain the execution path of the current action of the industrial control configuration software to construct an action dataset, wherein the action dataset includes a training set for training the anomaly detection model of the industrial control configuration software; Construct a multilayer perceptron network based on a pre-defined framework; Based on the multilayer perceptron network and the training set, the industrial control configuration software anomaly detection model is trained using a preset balancing algorithm, wherein the balancing algorithm is obtained by combining a gradient coordination mechanism and learning algorithms for non-negative and positive classes and unlabeled classes.

[0006] In some implementations, obtaining the execution path of the current action of the industrial control configuration software based on a preset instrumentation program to construct an action dataset includes: Based on a preset instrumentation program, the execution path of the first action and the execution path of the second action of the industrial control configuration software are obtained, wherein the first action is the normal execution action of the industrial control configuration software and the second action is the abnormal execution action of the industrial control configuration software. Based on the cost-sensitive PCA algorithm, a reduction operation is performed according to the execution path of the first action and the execution path of the second action to obtain normalized data; Based on the normalized data, a partitioning operation and a normalization operation are performed according to a preset ratio to determine the training set, wherein the training set includes verified positive example data and unlabeled data.

[0007] In some implementations, the cost-sensitive PCA algorithm is used to perform a reduction operation based on the execution paths of the first action and the second action to obtain normalized data, including: Based on the cost-sensitive PCA algorithm, redundant basic functions included in the execution paths of the first action and the second action are eliminated using a preset feature contribution threshold to determine key module feature information. The information included in the execution paths of the first action and the second action includes at least the action function name, call order, and execution time. The key module feature information is converted into a vector format to determine the normalized data.

[0008] In some implementations, the construction of a multilayer perceptron network based on a preset framework includes: According to the preset framework, the multilayer perceptron network is constructed with preset construction parameters, wherein the construction parameters include the dimension of the input layer, the dimension of the hidden layer, the dimension of the output layer, the initial value of the network weights, and the initial value of the bias term. The calculation of the network weights adopts the Adam algorithm to seek the efficiency of convergence optimization, and the activation function of the hidden layer adopts the ReLU function to avoid gradient vanishing.

[0009] In some implementations, the step of training the industrial control configuration software anomaly detection model based on the multilayer perceptron network and the training set using a preset balancing algorithm includes: Based on the gradient coordination mechanism and the non-negative positive class and unlabeled class learning algorithm, the risk loss estimation function of the industrial control configuration software anomaly detection model in the current iteration is determined according to the training set. Based on the calculation results of the risk loss estimation function in the previous iteration, the bias term is updated, and the network weights are updated based on the Adam algorithm to obtain the industrial control configuration software anomaly detection model in the current iteration. Based on the verification function of the preset framework, the sample detection index of the industrial control configuration software anomaly detection model in the current iteration is detected. When the number of iterations reaches a preset limit or the sample detection index meets a preset condition, the predicted label dataset corresponding to the unlabeled data included in the training set is determined according to the industrial control configuration software anomaly detection model in the current iteration, and the industrial control configuration software anomaly detection model and the predicted label dataset are output to complete the training of the industrial control configuration software anomaly detection model.

[0010] In some implementations, the verification function based on the preset framework detects the sample detection indicators of the industrial control configuration software anomaly detection model in the current iteration, including: Based on the verification function of the preset framework, the detection index of the industrial control configuration software anomaly detection model in the current iteration on the unlabeled data in the training set and the loss value calculated according to the risk loss estimation function are performed, wherein the detection index includes at least accuracy, precision and recall.

[0011] In some implementations, the action dataset further includes a test set, which includes verified positive data, unlabeled data, and artificially injected known anomalous data. In the action dataset, the training set and the test set have a preset ratio. Based on this, the method further includes: The anomaly detection model of the industrial control configuration software is tested according to the test set to determine the detection effect of the anomaly detection model of the industrial control configuration software.

[0012] In some implementations, testing the industrial control configuration software anomaly detection model according to the test set to determine the detection effectiveness of the industrial control configuration software anomaly detection model includes: Based on a preset anomaly probability threshold, the anomaly probability and corresponding prediction label of each data in the test set are determined according to the anomaly detection model of the industrial control configuration software. When the anomaly probability is greater than or equal to the anomaly probability threshold, the prediction label indicates an anomaly, and when the anomaly probability is less than the anomaly probability threshold, the prediction label indicates normal. Based on the predicted label and the true label corresponding to each data point in the test set, a confusion matrix is ​​determined to assess the detection performance of the industrial control configuration software anomaly detection model.

[0013] The industrial control configuration software anomaly detection model in this application is trained according to the industrial control configuration software anomaly detection model training method in the above-described embodiments.

[0014] The electronic device in this application includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the training method for the industrial control configuration software anomaly detection model in the above-described embodiments is implemented.

[0015] The beneficial effects of this application are as follows: The training method for the industrial control configuration software anomaly detection model in this application adjusts the weights of the learning algorithms for non-negative positive classes and unlabeled classes using the loss function under the gradient coordination mechanism. This addresses the problem of unbalanced contribution of positive and negative loss due to insufficient negative samples. Furthermore, in the balanced algorithm obtained by combining these two methods, the risk loss function constraint can minimize the possibility of negative risk loss estimates, thereby preventing model overfitting. Additionally, the model can be trained using only positive and unlabeled data, thus adapting to anomaly detection model training scenarios where negative samples are scarce or even missing. Attached Figure Description

[0016] Figure 1 This is one of the flowcharts illustrating the training method for the industrial control configuration software anomaly detection model in the embodiments of this application; Figure 2 This is the second flowchart illustrating the training method for the industrial control configuration software anomaly detection model in the embodiments of this application; Figure 3 This is the third flowchart illustrating the training method for the industrial control configuration software anomaly detection model in the embodiments of this application; Figure 4 This is the fourth flowchart illustrating the training method for the industrial control configuration software anomaly detection model in the embodiments of this application; Figure 5 This is the fifth flowchart illustrating the training method for the industrial control configuration software anomaly detection model in the embodiments of this application; Figure 6 This is the sixth flowchart illustrating the training method for the industrial control configuration software anomaly detection model in the embodiments of this application. Detailed Implementation

[0017] Please see Figure 1 The training method for the industrial control configuration software anomaly detection model in the embodiments of this application includes: Step 01: Obtain the execution path of the current action in the industrial control configuration software to build an action dataset. The action dataset includes the training set for training anomaly detection models in industrial control configuration software.

[0018] Specifically, before building and training the model, it is necessary to first collect an action dataset for training. Generally, the process of collecting the action dataset can be performed directly during the operation of the industrial control configuration software. The collected data is usually function-level action execution path information. After processing the collected raw execution path information, an action dataset is formed, which includes the actions used to train the industrial control configuration software anomaly detection model. In other words, the action dataset includes data for other purposes besides the training set used to train the industrial control configuration software anomaly detection model, such as a test set used to test and verify the detection effect of the generated industrial control configuration software anomaly detection model. For a detailed explanation of other data besides the training set, please refer to the implementation method described later.

[0019] Further, please refer to Figure 2 In some embodiments, step 01 further includes: Step 011: Based on the preset instrumentation program, obtain the execution path of the first action and the execution path of the second action in the industrial control configuration software. The first action is the normal execution action of the industrial control configuration software, and the second action is the abnormal execution action of the industrial control configuration software.

[0020] Specifically, the following examples will illustrate how action datasets are constructed.

[0021] In some examples, a dynamic binary instrumentation framework (such as DynamoRIO) is employed to capture and record the actions performed during the operation of industrial control configuration software. The actions performed by the industrial control configuration software during operation can generally be divided into two categories: normal actions performed during the normal operation of the configuration software itself, such as telemetry data acquisition and parameter downloading; and abnormal actions that would not be performed during normal operation, such as parameter tampering and malicious code injection. When capturing and recording these two types of actions, the dynamic binary instrumentation framework is used to record the function-level execution path information corresponding to each action, which is then used as the raw data for constructing the action dataset.

[0022] In some implementations, please refer to [the relevant documentation]. Figure 2 Step 01 further includes: Step 012: Based on the cost-sensitive PCA algorithm, perform a reduction operation according to the execution path of the first action and the execution path of the second action to obtain normalized data.

[0023] Specifically, based on the above implementation method, since the original function-level execution path information often contains redundant modules, such as repeated system basic functions, directly using the original information as part of the action dataset for model training would significantly increase the complexity of model training and subsequent model application. Therefore, for example, after obtaining the original function-level execution path information, a cost-sensitive PCA algorithm can be used to remove redundant system basic functions such as memory allocation functions, thereby retaining key function modules (such as RTU instruction issuance modules, data verification modules, etc.) that are strongly related to the overall control logic of the configuration software in the original information, thus obtaining standardized data that can be further applied.

[0024] For further examples, please refer to Figure 3 Step 012 further includes: Step 0121: Based on the cost-sensitive PCA algorithm, and using a preset feature contribution threshold, perform a removal operation on redundant basic functions included in the execution paths of the first and second actions to determine the feature information of key modules. The execution paths of the first action and the second action contain information including at least the action function name, the order of calls, and the execution duration. Step 0122: Convert the key module feature information into a vector format to determine the normalized data.

[0025] Specifically, in some examples of using the cost-sensitive PCA algorithm, the function-level execution path information recorded during motion capture generally includes three parts: the name of the function executing the action, the order in which the function is called during the configuration software's operation, and the specific execution time of the function. Based on this, the cost-sensitive PCA algorithm removes redundant information such as the function name, call order, and execution time of basic system functions (e.g., memory allocation functions) from these three parts, thereby obtaining the key module feature information. This can generally be achieved by setting the feature contribution threshold of the cost-sensitive PCA algorithm to 0.2.

[0026] Next, due to the inherent characteristics of the industrial control configuration software platform, the execution path information of each action has a high dimensionality. This high dimensionality can lead to input adaptation problems during model training and application. Therefore, before constructing and generating the action dataset, it is necessary to standardize the format of the key module feature information obtained after data removal. Generally, vector format conversion is performed on each retained key module feature information, converting it into a feature vector of dimension N, thereby generating standardized data. The dimension N is generally equal to the number of key function modules such as RTU instruction issuance module and data verification module in the retained key module feature information. In this way, the dimension and format of the action dataset to be generated are unified through vector format conversion, thereby avoiding input adaptation problems during model training and application.

[0027] In some implementations, please refer to [the relevant documentation]. Figure 2 Step 01 further includes: Step 013: Based on the normalized data, perform partitioning and normalization operations according to a preset ratio to determine the training set, which includes verified positive examples and unlabeled data.

[0028] Specifically, based on the above implementation method, after eliminating redundant functions using the cost-sensitive PCA algorithm and performing vector format conversion to obtain normalized data, the next step is to partition the normalized data to obtain a training set for model training. For example, the normalized data includes multiple verified normal action execution paths (i.e., positive example datasets) and multiple unlabeled action execution paths (i.e., unlabeled datasets). When constructing the action dataset, since verified abnormal actions in the industrial control configuration software platform are too scarce, multiple verified abnormal action execution paths (i.e., negative example datasets) are artificially injected into the normalized data according to the normalized data format. Then, the positive example dataset and the unlabeled dataset are split according to a preset ratio to obtain the training set for model training. For example, 70% of the positive example dataset and the unlabeled dataset are divided into 70% of the training set to be processed. Specifically, the remaining 30% of the positive example dataset and the unlabeled dataset, as well as the aforementioned negative example dataset, are retained; their specific uses are described in the implementation method below.

[0029] Furthermore, due to the dimensional differences in the data corresponding to different modules in the training set of the industrial control configuration software platform, the numerical values ​​of the data to be processed in different modules are inconsistent. During model training, the training direction often favors features with larger numerical values. Therefore, to avoid this situation, for example, the data to be processed in the training set can be further normalized using a minimum-maximum (Min-Max) normalization method. This maps the feature values ​​of each data point to the [0,1] interval according to the same normalization standard, thereby eliminating the dimensional differences between the data from different modules and preventing the model training from favoring features with larger numerical values. After normalization, the data to be processed in the training set is transformed into a training set that can be used for model training.

[0030] Please refer to further information. Figure 1 The training method for the industrial control configuration software anomaly detection model in the embodiments of this application further includes: Step 02: Construct a multilayer perceptron network based on a preset framework.

[0031] Specifically, a Multilayer Perceptron (MLP) network is a type of artificial neural network. Its hierarchical structure mainly includes an input layer, an output layer, and hidden layers, exhibiting forward computation characteristics, that is, calculating the influence of nodes in the previous layer on nodes in the next layer. The input and output layers are typically single, while multiple hidden layers can be used. Different layers are connected through fully connected layers, thus mapping the input vector to the output vector. An MLP network has three basic elements: weights, activation functions in the hidden layers, and biases. The industrial control configuration software anomaly detection model in this application is trained based on a multilayer perceptron network.

[0032] As for the framework for model training, the Chainer framework is generally used. The Chainer framework is a deep learning framework based on the Python language that adopts a "define-as-you-go" mechanism, which can be adapted to the algorithms used in the subsequent model training process.

[0033] In some embodiments, step 02 further includes: Based on a preset framework and preset construction parameters, a multilayer perceptron network is constructed. The construction parameters include the dimensions of the input layer, the hidden layer, the output layer, the initial values ​​of the network weights, and the initial values ​​of the bias terms. The Adam algorithm is used to calculate the network weights in order to seek efficiency in convergence optimization. The ReLU function is used as the activation function of the hidden layer to avoid gradient vanishing.

[0034] Specifically, based on the above implementation method, regarding the specific parameters for constructing the MLP network, for example, the dimension of the input layer should be equal to the number of key function modules in the key module feature information. The dimension of the hidden layer can be selectively set according to the actual situation; generally, it can be set to a hidden layer dimension of 3 (i.e., a total of 3 hidden layers). In addition, the number of neurons set in each hidden layer can also be adjusted according to actual needs; for example, 50 neurons can be set in each hidden layer. The dimension of the output layer can be set to 1 neuron. Furthermore, regarding the initial values ​​of the weights and biases of the MLP network, the initial value of the bias can be set to 0.1, and the weights can be randomly initialized. For example, the connection weights between the hidden layer and the output layer can be set to follow a normal distribution. N For weight updates (0, 0.01), the Adam algorithm is generally used. Compared to other weighting algorithms, the Adam algorithm allows the MLP network to converge and optimize quickly. For the activation function of the hidden layers in the MLP network, the ReLU function can be used. The ReLU function has better gradient descent performance than other activation functions, effectively avoiding gradient vanishing. Based on the initial parameters and the set function, a basic multilayer perceptron network can be constructed.

[0035] Please refer to further information. Figure 1 The training method for the industrial control configuration software anomaly detection model in the embodiments of this application further includes: Step 03: Based on the multilayer perceptron network and the training set, train the anomaly detection model for the industrial control configuration software using a preset balancing algorithm. The balancing algorithm is derived by combining gradient coordination mechanism with learning algorithms for non-negative and positive classes and unlabeled classes.

[0036] Specifically, non-negative positive and unlabeled class learning (nnPU) is a non-negative, unbiased learning algorithm for positive and unlabeled classes. Its core idea is to estimate the loss of negative samples from the unlabeled sample set, thus treating the unlabeled sample set as a set of negative samples with incorrect labels. Sampling the dataset in a completely random manner yields an expected loss for the positive sample set that is extremely close to the expected loss for the positive samples in the unlabeled sample set, which can be expressed as Equation 1.

[0037] Formula 1:

[0038] in For decision functions, their objects are... x The sample data itself comes from the training set. The loss function measures the deviation between the model's predictions and the actual situation. The expected loss for positive samples. This is the expected loss for positive samples in the unlabeled sample set.

[0039] Based on this, the overall risk loss function corresponding to the decision function in the nnPU algorithm can be obtained. Approximate representation As shown in Formula 2.

[0040] Formula 2:

[0041] in The class prior probability refers to the proportion of positive samples in the total sample consisting of positive samples and unlabeled samples. For example, in the training set of the above implementation, the class prior probability... (That is, the proportion of positive examples in the training set) is 0.33. This is the risk loss function corresponding to the positive examples, which is the cumulative value of the loss for all positive examples. It reflects the model's ability to identify positive examples. This is the risk loss function for positive samples that are estimated as negative by the model; that is, the cumulative loss of all positive samples that are misclassified as negative. This is the risk loss function for examples with negative true labels among unlabeled samples, which is the cumulative loss for correctly identifying outlier samples among unlabeled samples. By using the maximum value operation in the last term of Equation 2, the potential negative values ​​in the original PU learning algorithm are transformed into a maximum value selection method, thus avoiding the occurrence of negative values ​​and effectively preventing overfitting of the model.

[0042] Under the above conditions, when the loss function satisfies the conditions in Formula 3, Formula 4 holds, thus yielding the risk loss estimation function. It must be about the decision function. If the function is non-convex, then using such a risk loss estimation function can increase the computational complexity of the function, thereby ensuring that the optimal solution of the algorithm is obtained as much as possible.

[0043] Formula 3:

[0044] Formula 4:

[0045] in c It is a constant.

[0046] As explained above, the imbalance in the dataset size during the nnPU algorithm leads to smaller class prior probabilities, which in turn affects the risk loss estimation function. A value closer to 0 weakens the ability of the model trained by the nnPU algorithm to identify imbalanced samples. Therefore, as a further example, incorporating the Gradient Harmonizing Mechanism (GHM) into the nnPU algorithm can balance the impact of data imbalance on class prior probabilities and risk during training, thereby improving detection accuracy. GHM improves upon certain aspects of the current focal loss method by calculating the L1 norm of the gradient to construct a cost-sensitive vector and dynamically adjusting the loss weight of each sample based on this vector. Compared to Focal Loss, the GHM loss function is more flexible and adjustable, exhibiting superior performance when handling imbalanced datasets of varying degrees.

[0047] In some implementations, please refer to Figure 4 Step 03 further includes: Step 031: Based on the gradient coordination mechanism and the learning algorithms for non-negative positive classes and unlabeled classes, determine the risk loss estimation function of the industrial control configuration software anomaly detection model in the current iteration according to the training set.

[0048] Specifically, the following example illustrates how to integrate GHM into the nnPU algorithm: GHM can implicitly express sample imbalance using gradient norm distribution, and within a certain range, it can utilize confidence levels. q The number of samples is used to perform loss decay. The technique defines the gradient norm. As shown in Formula 5.

[0049] Formula 5:

[0050] in It is the target confidence level given by the model.

[0051] Gradient norm A smaller gradient norm indicates more accurate predictions. Positive samples are easily distinguishable by the model due to their large number, while negative samples are difficult to distinguish due to their smaller number. The gradient distribution can intuitively illustrate this phenomenon. The core idea of ​​GHM is to ignore easily distinguishable samples with small gradient norms while also reducing the number of difficult samples. Therefore, the gradient density GD is defined as shown in Equation 6.

[0052] Formula 6:

[0053] in, Gradient density refers to a certain gradient norm. The density of nearby samples reflects the number of samples in that gradient interval. The interval length is a fixed value set manually, used to represent the width of the interval for gradient statistics. M This represents the total number of samples used in gradient calculation, which are derived from the training set. It is an indicator function, if the first... k Gradient norm of each sample The value falls on If the value is within the specified range, the function outputs 1; otherwise, it outputs 0.

[0054] For example, Formula 7 defines the cross-entropy loss CE.

[0055] Formula 7:

[0056] in For the first i The confidence level corresponding to each sample The model gives the first i The target confidence level for each sample For the first i The cross-entropy loss corresponds to each sample, and the samples are from the training set.

[0057] Based on the above definition, the GHM loss function can be obtained as shown in Formula 8. The GHM loss function operates on the decision function. .

[0058] Formula 8:

[0059] in For the first i The gradient density corresponding to each sample.

[0060] Then let's use the GHM loss function By introducing the nnPU algorithm and utilizing the GHM loss function to correct the risk loss estimation function, we can address the imbalance in the distribution and scale of control behavior data in configuration software within industrial control environments. Specifically, the GHM loss function given in Equation 8... As the risk loss function in Formula 2, Formula 8 is substituted into Formula 2 to construct the balancing algorithm, which yields the risk loss estimation function optimized by GHM, as shown in Formula 9.

[0061] Formula 9:

[0062]

[0063] Next, based on the risk loss estimation function in Formula 9, and using the training set data, the anomaly detection model for industrial control configuration software can be trained through multiple iterations to obtain the model. In each iteration, the loss value will be calculated based on the data in the training set according to the risk loss estimation function shown in Formula 9.

[0064] Please continue reading. Figure 4 In some embodiments, step 03 further includes: Step 032: Based on the calculation results of the risk loss estimation function in the previous iteration, update the bias term and update the network weights based on the Adam algorithm to obtain the industrial control configuration software anomaly detection model in the current iteration.

[0065] Specifically, for the method of training the model through multiple iterations, the logic of each iteration is as follows: First, for the iteration starting point, the input data consists of a training set including both positive example datasets and unlabeled datasets, along with a pre-set maximum number of iterations. When inputting the training set, the proportion of positive examples in the training set (corresponding to the class prior probability) is obtained. ).

[0066] Then, the loss value corresponding to the training set is calculated based on the risk loss estimation function shown in Formula 9. In each iteration, an import batch size limit is set. The number of data entries taken from the training set in each loss calculation cannot exceed the import batch size limit mentioned above, so as to ensure the efficiency of the model training process.

[0067] Finally, based on the Adam algorithm, the weights and biases of the MLP network are optimized in reverse according to the calculated loss value, thereby optimizing the structural performance of the MLP network and improving the model's ability and accuracy in detecting abnormal actions.

[0068] Please continue reading. Figure 4 In some embodiments, step 03 further includes: Step 033: Based on the verification function of the preset framework, detect the sample detection index of the industrial control configuration software anomaly detection model in the current iteration; Step 034: When the number of iterations reaches the preset limit or the sample detection index meets the preset conditions, determine the predicted label dataset corresponding to the unlabeled data in the training set according to the anomaly detection model of the industrial control configuration software in the current iteration, and output the anomaly detection model of the industrial control configuration software and the predicted label dataset to complete the training of the anomaly detection model of the industrial control configuration software.

[0069] Specifically, based on the above implementation method, for the loop conditions of multiple iterations, in addition to the maximum number of iterations set at the beginning of the iteration, it also includes the specific performance of the industrial control configuration software anomaly detection model in anomaly detection obtained at the end of each iteration. Therefore, for example, when updating the weights and biases of the MLP network to complete the current iteration, the extensions.LogReport function (corresponding to the verification function) under the Chainer framework can be used to perform sample index detection on the industrial control configuration software anomaly detection model at the end of the current iteration. If the detection result meets the preset conditions, it can be determined that the industrial control configuration software anomaly detection model obtained at the end of the current iteration can meet the requirements for anomaly action detection on the industrial control configuration software platform, and the iteration can be directly terminated at this time. Furthermore, the iteration will also terminate when the number of iterations reaches the preset maximum number of iterations.

[0070] If the iteration is deemed complete, further exemplarily, the anomaly detection model of the industrial control configuration software after the most recent iteration is used to perform complete anomaly detection on the unlabeled dataset in the training set. Finally, the model and the detection results are used together as the output of the training method of the industrial control configuration software anomaly detection model in the above embodiment. Generally, for the output and saving of the model, the model can be saved as a model file using the chainer.serializers.save_npz module under the Chainer framework. For example, the file can be named GHM-nnPU_best.model, and the detection results of the model on the complete unlabeled dataset can be saved in a data format such as CSV.

[0071] In some embodiments, step 033 further includes: The verification function based on the pre-defined framework performs detection on the detection indicators of the industrial control configuration software anomaly detection model in the current iteration on the unlabeled data in the training set, as well as the loss value calculated according to the risk loss estimation function. The detection indicators include at least accuracy, precision, and recall.

[0072] Specifically, the detection metrics for the sample detection model of the industrial control configuration software anomaly detection model in the current iteration generally include the following: the loss value calculated based on the risk loss estimation function, the accuracy, precision, recall (true positive rate), false positive rate, and F1 score of the industrial control configuration software anomaly detection model for detecting unlabeled data in the training set. Apart from the loss value, the most commonly used sample detection metrics are the accuracy, precision, and recall mentioned above.

[0073] In the statistics of model detection results, based on the relationship between the predicted labels and the true labels of the samples, the results can be divided into the following four cases: A true positive (TP) is a case where both the predicted label obtained from the model and the true label of the sample are positive. A false positive (FP) is a case where the model predicts a positive label, but the actual label is a negative label. A true negative (TN) is a case where both the predicted label obtained from the model and the true label of the sample are negative. A false negative (FN) is a case where the model predicts a negative label, but the actual label is positive.

[0074] The four scenarios described above together form the confusion matrix of the model. Based on these four scenarios, the various detection metrics can be obtained as follows: Accuracy (ACC) is the proportion of samples in a statistical prediction category that correctly predict all outcomes out of all samples. It is calculated as shown in Formula 10.

[0075] Formula 10:

[0076] TP, FP, TN, and FN represent the sample numbers of true positive, false positive, true negative, and false negative results, respectively, and the same applies below.

[0077] Precision (PRE) is the proportion of true positives among all samples predicted as positive, calculated as shown in Formula 11.

[0078] Formula 11:

[0079] Recall (REC), also known as the true positive rate, is the proportion of correctly predicted results among all samples where the actual situation is positive. It is calculated as shown in Formula 12.

[0080] Formula 12:

[0081] In addition, the false positive rate (FPR) is the proportion of samples with a true negative result that are predicted to be positive, and it is calculated as shown in Formula 13.

[0082] Formula 13:

[0083] The F1 score (F1S) is a comprehensive evaluation metric, representing the harmonic mean of precision and recall. It effectively balances the trade-offs between the two, and its calculation method is shown in Formula 14. Formula 14:

[0084] For example, before the end of each iteration, the index detection performed on the industrial control configuration software anomaly detection model obtained in that iteration can generally use the above-mentioned accuracy (ACC), precision (PRE), and recall (REC). When all three are detected to be not less than the corresponding set threshold, it means that the sample detection index in the above embodiment meets the preset conditions. At this time, the iteration can be ended, and the model can be further used to perform a complete detection on the unlabeled dataset in the training set. Finally, the model and the detection results are saved and output according to the method described in the above embodiment, thereby completing the training process of the industrial control configuration software anomaly detection model.

[0085] In some implementations, the action dataset also includes a test set, which includes verified positive data, unlabeled data, and artificially injected known anomalous data. In the action dataset, the training set and the test set have a preset ratio. Based on the above, please refer to Figure 5 The training method for the industrial control configuration software anomaly detection model in the embodiments of this application further includes: Step 04: Test the anomaly detection model of the industrial control configuration software according to the test set to determine the detection effect of the anomaly detection model of the industrial control configuration software.

[0086] Specifically, based on the above implementation method, according to the proportion of the training set in the action dataset, the action dataset, excluding the training set, contains a portion of positive example dataset, a portion of unlabeled dataset, and a portion of negative example dataset that is intentionally injected. For example, according to the example above, after separating the training set, there are 30% positive example dataset, 30% unlabeled dataset, and a complete negative example dataset remaining. Based on this, the remaining data is used as the test set, and the effectiveness of the industrial control configuration software anomaly detection model in detecting abnormal actions of the industrial control configuration software platform is tested. For example, the test results can also be compared with other test models in the current related technologies.

[0087] In some implementations, please refer to Figure 6 Step 04 further includes: Step 041: Based on the preset anomaly probability threshold, and according to the anomaly detection model of the industrial control configuration software, determine the anomaly probability and corresponding predicted label for each data point in the test set. When the anomaly probability is greater than or equal to the anomaly probability threshold, the predicted label indicates an anomaly; when the anomaly probability is less than the anomaly probability threshold, the predicted label indicates a normal anomaly. Step 042: Based on the predicted label and the true label corresponding to each data point in the test set, determine the corresponding confusion matrix to determine the detection effect of the industrial control configuration software anomaly detection model.

[0088] Specifically, based on the above implementation method, for testing the detection effect of the industrial control configuration software anomaly detection model based on a test set, in some examples, the industrial control configuration software anomaly detection model first traverses each data sample entry in the test set and calculates the anomaly probability that the action corresponding to each entry is an abnormal action. Next, based on a preset anomaly probability threshold, the anomaly probability corresponding to each entry is compared with the threshold. The predicted label of the data sample entries with an anomaly probability not less than the threshold is set to "abnormal", and the predicted label of the remaining data sample entries is set to "normal". The above-mentioned anomaly probability threshold is determined based on both the ROC curve and the F1 score. The ROC curve is a working characteristic curve, with the false positive rate (FPR) on the horizontal axis and the recall rate (REC) on the vertical axis. The ROC curve is not affected by the imbalance of data samples and can still obtain a high recall rate with a low false positive rate, which can optimize the model performance. ROC curve verification showed that when the anomaly probability threshold was set to 0.5, the corresponding F1 score was the highest. This maximizes the balance between precision and recall, thus ensuring that the model has the best detection performance.

[0089] After determining the predicted and true labels corresponding to each data sample item, the number of true positives, false positives, true negatives, and false negatives, as well as the ratios of accuracy (ACC), precision (PRE), and recall (REC) can be statistically obtained by comparing the predicted and true labels. This forms the confusion matrix of the industrial control configuration software anomaly detection model. Finally, this confusion matrix can be compared with the confusion matrices of other detection models in related technologies to obtain the test results of the detection effect of the industrial control configuration software anomaly detection model in this application embodiment.

[0090] An example of the training method for the industrial control configuration software anomaly detection model described above is as follows: First, cost-sensitive PCA was applied to the captured raw execution path data, with a feature contribution threshold of 0.2. Redundant system fundamental functions (such as memory allocation functions) were removed, and 379 key module data strongly related to the configuration software control logic were extracted. Then, the key module data was converted into normalized data in a 379-dimensional feature vector format. The normalized data included 10,000 positive examples (positive example dataset P), 20,000 unlabeled examples (unlabeled dataset U), and 500 artificially injected negative examples (negative example dataset). The positive and unlabeled data were divided in a 7:3 ratio, with 7,000 positive examples and 14,000 unlabeled examples used as the training set. Min-Max normalization was performed on the training set, and the remaining 3,000 positive examples, 6,000 unlabeled examples, and 500 negative examples were used as the test set.

[0091] Then, an MLP network was constructed based on the Chainer 7.8.0 framework and Python 3.8. The input layer dimension was set to 379, the hidden layers were set to 3 layers with 50 neurons each, and a fully connected approach was adopted. The activation function was ReLU. The output layer was set to 1 neuron, and the output probability value was in the range of [0,1]. In addition, the network weights and bias terms were randomly initialized. The iterative calculation algorithm for the weights was set to the Adam algorithm. The initial learning rate was set to 0.001. As the number of iterations increased, the initial learning rate gradually decreased. The decay rate could be set to decrease to half every 20 iterations. The maximum number of iterations was set to 100, and the maximum number of input entries per iteration was limited to 64.

[0092] After initiating the iteration, the model's recall reached 98.8% on the 54th iteration, satisfying the iteration termination condition. At this point, the model from the 54th iteration was used with the unlabeled dataset in the training set as complete input to perform detection and output the corresponding anomaly probability results. The model from the 54th iteration was saved as a model file named "GHM-nnPU_best.model", and the output anomaly probability results were saved in CSV format. During the iteration process, the loss value calculated according to the risk loss estimation function gradually decreased with no significant fluctuations in each iteration, indicating a low risk of overfitting.

[0093] Finally, based on the test set and with an anomaly probability threshold set to 0.5, the iteratively trained model was used to detect each data item in the test set, outputting the corresponding anomaly probability and further obtaining the predicted label for each item. Then, based on the differences between the predicted and true labels, a confusion matrix and detection metrics such as accuracy, precision, and recall were calculated. Statistically, the precision was 98.0%, accuracy was 93.8%, recall was 98.8%, and F1 score was 96.7%, showing a significant improvement in detection performance compared to the nnPU model (90.1% precision, 55.5% recall) in current related technologies.

[0094] In addition to the above implementation methods, PyTorch can also be used as the program framework for building MLP networks, besides Chainer. PyTorch is more applicable to a wider range of deep learning ecosystems and its code migration is easier than Chainer's. For the activation function of the hidden layers in the MLP network, the LeakyReLU function can be used instead of the ReLU function to solve the problem of neuron "death" in the hidden layers, thereby further optimizing the model's generalization ability. Furthermore, when selecting the anomaly probability threshold based on the ROC curve and F1 score, the selection conditions can be adjusted according to actual needs, allowing the model to be used specifically to detect abnormal actions under different conditions.

[0095] The industrial control configuration software anomaly detection model in this application is trained according to the industrial control configuration software anomaly detection model training method in the above-described embodiments.

[0096] The electronic device in this application includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the training method for the abnormal detection model of the industrial control configuration software in the above-described embodiments is implemented.

[0097] The above description is merely a preferred embodiment of this application and is not intended to limit this application in any way. Although this application has disclosed the preferred embodiment as above, it is not intended to limit this application. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the technical solution of this application. Any simple modifications, equivalent substitutions, and improvements made to the above embodiments without departing from the technical solution of this application, based on the technical essence of this application and within the spirit and principles of this application, shall still fall within the protection scope of the technical solution of this application.

Claims

1. A training method for an anomaly detection model in industrial control configuration software, characterized in that, The method includes: Obtain the execution path of the current action of the industrial control configuration software to construct an action dataset, wherein the action dataset includes a training set for training the anomaly detection model of the industrial control configuration software; Construct a multilayer perceptron network based on a pre-defined framework; Based on the multilayer perceptron network and the training set, the industrial control configuration software anomaly detection model is trained using a preset balancing algorithm, wherein the balancing algorithm is obtained by combining a gradient coordination mechanism and learning algorithms for non-negative and positive classes and unlabeled classes.

2. The method according to claim 1, characterized in that, The method, based on a preset instrumentation program, obtains the execution path of the current action of the industrial control configuration software to construct an action dataset, including: Based on a preset instrumentation program, the execution path of the first action and the execution path of the second action of the industrial control configuration software are obtained, wherein the first action is the normal execution action of the industrial control configuration software and the second action is the abnormal execution action of the industrial control configuration software. Based on the cost-sensitive PCA algorithm, a reduction operation is performed according to the execution path of the first action and the execution path of the second action to obtain normalized data; Based on the normalized data, a partitioning operation and a normalization operation are performed according to a preset ratio to determine the training set, wherein the training set includes verified positive example data and unlabeled data.

3. The method according to claim 2, characterized in that, The cost-sensitive PCA algorithm performs a reduction operation based on the execution paths of the first action and the second action to obtain normalized data, including: Based on the cost-sensitive PCA algorithm, redundant basic functions included in the execution paths of the first action and the second action are eliminated using a preset feature contribution threshold to determine key module feature information. The information included in the execution paths of the first action and the second action includes at least the action function name, call order, and execution time. The key module feature information is converted into a vector format to determine the normalized data.

4. The method according to claim 2, characterized in that, The construction of the multilayer perceptron network based on the preset framework includes: According to the preset framework, the multilayer perceptron network is constructed with preset construction parameters, wherein the construction parameters include the dimension of the input layer, the dimension of the hidden layer, the dimension of the output layer, the initial value of the network weights, and the initial value of the bias term. The calculation of the network weights adopts the Adam algorithm to seek the efficiency of convergence optimization, and the activation function of the hidden layer adopts the ReLU function to avoid gradient vanishing.

5. The method according to claim 4, characterized in that, The step of training the industrial control configuration software anomaly detection model based on the multilayer perceptron network and the training set using a preset balancing algorithm includes: Based on the gradient coordination mechanism and the non-negative positive class and unlabeled class learning algorithm, the risk loss estimation function of the industrial control configuration software anomaly detection model in the current iteration is determined according to the training set. Based on the calculation results of the risk loss estimation function in the previous iteration, the bias term is updated, and the network weights are updated based on the Adam algorithm to obtain the industrial control configuration software anomaly detection model in the current iteration. Based on the verification function of the preset framework, the sample detection index of the industrial control configuration software anomaly detection model in the current iteration is detected; When the number of iterations reaches a preset limit or the sample detection index meets a preset condition, the predicted label dataset corresponding to the unlabeled data included in the training set is determined according to the industrial control configuration software anomaly detection model in the current iteration, and the industrial control configuration software anomaly detection model and the predicted label dataset are output to complete the training of the industrial control configuration software anomaly detection model.

6. The method according to claim 5, characterized in that, The verification function based on the preset framework detects the sample detection indicators of the industrial control configuration software anomaly detection model in the current iteration, including: Based on the verification function of the preset framework, the detection index of the industrial control configuration software anomaly detection model in the current iteration on the unlabeled data in the training set and the loss value calculated according to the risk loss estimation function are performed, wherein the detection index includes at least accuracy, precision and recall.

7. The method according to claim 1, characterized in that, The action dataset also includes a test set, which includes verified positive data, unlabeled data, and artificially injected known abnormal data. In the action dataset, the training set and the test set have a preset ratio. Based on this, the method further includes: The anomaly detection model of the industrial control configuration software is tested according to the test set to determine the detection effect of the anomaly detection model of the industrial control configuration software.

8. The method according to claim 7, characterized in that, The step of testing the industrial control configuration software anomaly detection model according to the test set to determine the detection effect of the industrial control configuration software anomaly detection model includes: Based on a preset anomaly probability threshold, the anomaly probability and corresponding prediction label of each data in the test set are determined according to the anomaly detection model of the industrial control configuration software. When the anomaly probability is greater than or equal to the anomaly probability threshold, the prediction label indicates an anomaly, and when the anomaly probability is less than the anomaly probability threshold, the prediction label indicates normal. Based on the predicted label and the true label corresponding to each data point in the test set, a confusion matrix is ​​determined to assess the detection performance of the industrial control configuration software anomaly detection model.

9. An anomaly detection model for industrial control configuration software, characterized in that, The model is trained according to the training method for anomaly detection model of industrial control configuration software as described in any one of claims 1-8.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements the training method for the industrial control configuration software anomaly detection model as described in any one of claims 1-8.

Images