Intelligent fault diagnosis method and system based on multi-source data

Abstract

The invention discloses an industrial network fault intelligent diagnosis method and system based on multi-source data, and the method comprises the steps: synchronously collecting data from a plurality of data sources of an industrial network, and extracting a time sequence statistical feature, a flow entropy feature and a protocol conformity feature to form a multi-dimensional feature vector; establishing a dynamic baseline model by adopting a sliding window online learning method, and calculating a comprehensive anomaly score for anomaly detection; the fault suspicion degree is calculated based on the equipment incidence matrix and the fault propagation model to realize fault source positioning; carrying out fault type identification and root cause analysis by adopting Bayesian reasoning and a knowledge rule base; and outputting a structured diagnosis report containing the fault source, the type, the root cause and the disposal suggestion. According to the invention, early warning, accurate positioning and intelligent diagnosis of industrial network faults are realized, and the operation and maintenance efficiency, safety and reliability of the industrial control network are significantly improved.

Description

Technical Field

[0001] This invention relates to the field of industrial network fault diagnosis technology, and in particular to a fault intelligent diagnosis method and system based on multi-source data. Background Technology

[0002] With the deepening of intelligent manufacturing, the scale and complexity of industrial control networks continue to increase. The interconnection of systems such as PLC (Programmable Logic Controller), DCS (Distributed Control System), and SCADA (Supervisory Control and Data Acquisition System) makes the network architecture increasingly complex.

[0003] Traditional industrial network fault diagnosis methods mainly rely on the experience and judgment of maintenance personnel and simple threshold alarm mechanisms, resulting in delayed fault detection. They typically only respond passively after a fault occurs, failing to provide early warning. Traditional methods also face difficulties in fault location, as the intricate fault propagation paths in complex network topologies make it difficult to quickly and accurately pinpoint the fault source. Furthermore, existing methods lack root cause analysis, often remaining at the superficial level and failing to delve into the root causes of faults. This also leads to weak multi-source data fusion capabilities, making it impossible to effectively integrate heterogeneous data from multiple sources such as device logs, network traffic, and protocol packets for comprehensive diagnosis, resulting in inaccurate fault diagnosis results.

[0004] Therefore, there is an urgent need for an industrial network fault diagnosis method and system that can integrate multi-source heterogeneous data, realize intelligent fault detection, precise fault location and root cause analysis, so as to improve the operation and maintenance efficiency and security and reliability of industrial control networks. Summary of the Invention

[0005] This invention provides a fault intelligent diagnosis method and system based on multi-source data, which solves the problems of lagging industrial network fault detection, difficulty in localization, insufficient root cause analysis, and weak multi-source data fusion capability in the prior art, and achieves the purpose of early warning, accurate localization and intelligent diagnosis of industrial network faults.

[0006] To achieve the above objectives, in a first aspect, the present invention provides a fault intelligent diagnosis method based on multi-source data, applicable to industrial control network environments including PLC, DCS, and SCADA systems. The method includes the following steps: Step S1: Synchronously collect data from multiple data sources in the industrial network. The data sources include equipment operation logs, network traffic mirrors, protocol messages, I / O point data, and configuration information. Use a precise time protocol to synchronize the multi-source data at the microsecond level and divide the collected raw data into data frame sequences according to time windows.

[0007] Step S2: Extract a multi-dimensional feature vector for each data frame. The features include time-series statistical features, traffic entropy features, and protocol compliance features. The time-series statistical features include the mean, standard deviation, skewness, and kurtosis of the message arrival interval. The traffic entropy features include source address entropy, destination address entropy, and port entropy. The protocol compliance features are calculated based on the protocol deviation of the message sequence using an industrial protocol state machine.

[0008] Step S3: A dynamic baseline model is established using the sliding window online learning method. The dynamic threshold range of each feature dimension is calculated, and the comprehensive anomaly score of the current data frame is calculated to determine whether the network operation status is abnormal.

[0009] Step S4: When the comprehensive anomaly score exceeds the alarm threshold, a fault is determined to exist, and the fault source location process is initiated; a device association matrix is ​​constructed based on the network topology connection relationship, the fault suspicion of each device node is calculated, and the device with the highest fault suspicion is identified as the fault source.

[0010] Step S5: Construct a fault type feature mapping table to classify faults into five categories: link faults, equipment faults, protocol anomalies, performance degradation, and configuration errors; use Bayesian inference to calculate the posterior probability of each fault type, perform root cause inference based on the fault knowledge rule base, synthesize evidence for the matched rules, and calculate the final root cause confidence.

[0011] Furthermore, the synchronous collection of data from multiple data sources in the industrial network specifically includes: It captures raw Ethernet packets through port mirroring of industrial switches, supporting Modbus / TCP, EtherNet / IP, PROFINET and OPC UA protocols.

[0012] Real-time data from PLC and DCS I / O points is acquired via the OPC DA / UA interface, with a sampling period of [missing information]. , This indicates the time interval between two consecutive data samples.

[0013] Collect alarm logs from network and security devices using Syslog or SNMP Trap.

[0014] The interface status, traffic statistics, and CPU / memory utilization of switches and routers are collected via the SNMP protocol, with a polling period of 10-60 seconds. Employing the IEEE 1588 precision time protocol for microsecond-level time synchronization of multi-source data, the synchronization accuracy is superior to... .

[0015] The collected raw data is divided into time windows. Divided into data frame sequences ,in , Indicates the first One data frame, Indicates the total number of data frames.

[0016] Furthermore, the flow entropy feature mentioned in step S2 is calculated based on the Shannon entropy formula, which is: ,in Represents random variables Information entropy Indicates an event The probability of occurrence Indicates the total number of events.

[0017] Calculate the source address entropy based on the Shannon entropy formula. Destination address entropy and port entropy .

[0018] Furthermore, the calculation of the protocol compliance feature in step S2 specifically includes: Define the finite state machine model for each industrial protocol. ,in For a set of states, To input the alphabet, This is the state transition function. This is the initial state. This is the set of terminating states.

[0019] Perform deep protocol parsing on the message sequence to extract the function code sequence. ,in Indicates the first The function code of each message, This represents the total number of messages in the message sequence.

[0020] The function code sequence is input into the state machine for verification, and the number of illegal state transitions is recorded. .

[0021] Calculate protocol deviation ,in, This indicates the percentage of protocol deviation.

[0022] when At that time, there is a risk of protocol anomalies in the marking.

[0023] Furthermore, the calculation method for the dynamic threshold interval in step S3 is as follows: for each feature dimension Calculate its dynamic threshold range ,in: ; ; Indicates the first The lower threshold boundary of the dimensional feature; Indicates the first Upper threshold boundary of dimensional features; For the first in the sliding window The mean of the dimensional features; For the first in the sliding window Standard deviation of dimensional features; Here is the confidence coefficient. , used to control the width of the threshold range; The fluctuation sensitivity coefficient This is used to adjust the degree of response to characteristic fluctuations; For the first The rate of change of a feature reflects the dynamic trend of its change.

[0024] Furthermore, the calculation method for the comprehensive anomaly score in step S3 is as follows: in, This represents the overall anomaly score of the current data frame; Indicates the total number of feature dimensions; For the first The weights of the dimensional features, and satisfying ; Indicates the current data frame number The actual value of the dimensional feature; For the first in the sliding window The mean of the dimensional features; For the first in the sliding window Standard deviation of dimensional features; For exception indicator functions, when hour ,otherwise ; The feature weights An adaptive calculation using the information gain method is employed, calculating the information gain of each feature based on historical fault samples. ,in Entropy of the fault category For a given feature The conditional entropy is then applied; the weights are obtained by normalizing the information gain. .

[0025] Furthermore, the method for calculating the fault suspicion level in step S4 is as follows: Construct a device association matrix based on network topology connections. ,in The number of devices in the network, when the devices With equipment When a direct communication link exists ,otherwise ; Calculate the fault suspicion of each device node. : in, For equipment Local anomaly scores; For the propagation coefficient, This is used to control the weight of the impact of abnormalities in adjacent devices on the suspicion level of the current device. For each element in the device association matrix, it represents a device. With equipment Does a direct connection exist? For equipment Local anomaly scores; For equipment With equipment The topological distance between them is measured in hops.

[0026] Furthermore, the method for calculating the posterior probability of each fault type using Bayesian inference in step S5 is as follows: in, Represents a given feature vector Fault type under the condition is The posterior probability; Indicates the first Types of faults These correspond to link failure, device failure, protocol anomaly, performance degradation, and configuration error, respectively. Fault type The prior probability is obtained from historical failure statistics; Let be the likelihood function, representing the likelihood under fault type. Observed eigenvectors under certain conditions The conditional probability; This is the feature vector of the current fault state.

[0027] Evidence is synthesized for the matching rules, and the final root cause confidence score is calculated: in, This indicates the final confidence level after synthesis. and These represent the confidence levels of the Bayesian inference engine and the rule matching engine, respectively.

[0028] Based on the same inventive concept, this invention provides an intelligent fault diagnosis system for industrial networks based on multi-source data, used to implement the method of the first aspect. The system includes: a multi-source data acquisition module, a feature extraction module, an anomaly detection module, a fault location module, and a diagnostic reasoning module.

[0029] The multi-source data acquisition module includes a protocol parsing engine, a time synchronization unit, and a data cache queue, which are used to synchronously acquire network operation data from multiple data sources in the industrial network and perform in-depth protocol parsing.

[0030] The feature extraction module includes a statistical feature calculation unit, an entropy calculation unit, and a protocol compliance detection unit, which are used to extract multi-dimensional feature vectors and quantize them.

[0031] The anomaly detection module includes a dynamic baseline modeling unit, a threshold calculation unit, and an anomaly scoring unit, which are used to detect network state anomalies in real time and calculate a comprehensive anomaly score.

[0032] The fault location module includes a topology management unit and a suspicion calculation unit, which are used to calculate the fault suspicion of each device node based on the device association matrix and determine the fault source.

[0033] The diagnostic reasoning module includes a Bayesian inference engine and a rule matching engine, used for fault type identification and root cause analysis.

[0034] Furthermore, the system also includes a knowledge base management module for storing and managing fault diagnosis rules, historical fault samples, and Bayesian probability parameters; and a diagnostic report generation module for generating structured diagnostic reports and pushing them to the operation and maintenance management platform.

[0035] Compared with the prior art, the beneficial effects of the present invention are: This invention establishes a multi-dimensional feature extraction system by integrating heterogeneous data from multiple sources, such as device logs, network traffic, protocol messages, and I / O point data. It employs an adaptive dynamic baseline modeling method to adapt to normal fluctuations in industrial networks and reduce false alarms. Based on network topology and fault propagation models, it achieves precise fault source localization. Combining Bayesian inference and a knowledge rule base for fault type identification and root cause analysis, it provides maintenance personnel with complete diagnostic reports and handling suggestions, significantly improving the efficiency and accuracy of industrial network fault diagnosis. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the components of a fault intelligent diagnosis system based on multi-source data according to the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention are described clearly and completely below. Obviously, the described embodiments are only a part of the embodiments of this invention, not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0038] Example 1 This embodiment provides a fault intelligent diagnosis method based on multi-source data, including the following steps: Step S1: Synchronously collect data from multiple data sources in the industrial network. The data sources include equipment operation logs, network traffic mirrors, protocol messages, I / O point data, and configuration information. Use a precise time protocol to synchronize the multi-source data at the microsecond level and divide the collected raw data into data frame sequences according to time windows.

[0039] Set appropriate data acquisition strategies based on the characteristics of the industrial site. For example, in discrete manufacturing workshops, focus on acquiring equipment communication messages and I / O point data; in process industry environments, focus on acquiring DCS control data and process variables.

[0040] The multi-source heterogeneous data acquisition specifically includes: Raw Ethernet packets are captured via port mirroring of industrial switches, supporting Modbus / TCP, EtherNet / IP, PROFINET, and OPC UA protocols. The port mirroring configuration uses SPAN (Switched Port Analyzer) technology to replicate traffic from critical communication links to the acquisition port, enabling non-intrusive monitoring of network traffic.

[0041] Real-time data from PLC and DCS I / O points is acquired via the OPC DA / UA interface, with a sampling period of [missing information]. ,in This indicates the time interval between two consecutive data samples. The OPC UA interface provides a unified data access standard, supports complex data types and security authentication mechanisms, and can obtain detailed operating status of the device.

[0042] Alarm logs from network and security devices can be collected using Syslog or SNMP Trap. Syslog uses UDP port 514 to receive log messages and supports the RFC 5424 standard format; SNMP Trap uses UDP port 162 to receive alarm events and supports SNMPv2c and SNMPv3 versions.

[0043] The SNMP protocol is used to collect interface status, traffic statistics, and CPU / memory utilization of switches and routers, with a polling period of 10-60 seconds. SNMP polling uses GET-BULK requests to optimize performance and reduce network overhead.

[0044] Time synchronization is fundamental to multi-source data fusion. The IEEE 1588 Precision Time Protocol (PTP) achieves sub-microsecond time synchronization accuracy in industrial Ethernet environments through a master-slave clock synchronization mechanism. During deployment, a high-precision clock source is set up as the Grandmaster, and other devices act as Slaves for synchronization.

[0045] Time window The choice needs to balance real-time performance and statistical stability. Suitable for scenarios with high real-time requirements, such as safety interlocking systems; Suitable for scenarios requiring high statistical accuracy, such as performance trend analysis. Typical configuration uses... As the default value.

[0046] The collected raw data is divided into time windows. Divided into data frame sequences ,in , Indicates the first One data frame, Indicates the total number of data frames.

[0047] Step S2: Extract a multi-dimensional feature vector for each data frame. The features include time-series statistical features, traffic entropy features, and protocol compliance features. The time-series statistical features include the mean, standard deviation, skewness, and kurtosis of the message arrival interval. The traffic entropy features include source address entropy, destination address entropy, and port entropy. The protocol compliance features are calculated based on the protocol deviation of the message sequence using an industrial protocol state machine.

[0048] Timing statistics include the mean of message arrival intervals. Standard deviation skewness and kurtosis .

[0049] Inter-Arrival Time (IAT) refers to the time difference between the arrival times of two adjacent messages. Let's assume a data frame... Contains The arrival times of the messages are as follows: Then the arrival interval sequence is .

[0050] mean The calculation formula is: ,in This represents the average message arrival interval, reflecting the average density of network traffic.

[0051] Standard deviation The calculation formula is: ,in It indicates the degree of dispersion in message arrival intervals, reflecting the volatility of traffic.

[0052] Skewness The calculation formula is: ,in It indicates the asymmetry of the distribution. Positive skewness indicates the presence of more large intervals (sparse flow), while negative skewness indicates the presence of more small intervals (dense flow).

[0053] Kudo The calculation formula is: ,in It indicates the degree of peak in the distribution; peak indicates the presence of outlier extreme values.

[0054] The flow entropy feature is calculated based on the Shannon entropy formula, which is: ,in Represents random variables Information entropy Indicates an event The probability of occurrence Indicates the total number of events.

[0055] Three types of flow entropy characteristics are calculated based on the Shannon entropy formula: Source address entropy Entropy represents the distribution of source IP addresses in a data frame, used to measure the diversity and uniformity of communication sources. During calculation, the frequency of each source IP address within the data frame is counted, normalized to obtain a probability distribution, and then substituted into the Shannon entropy formula. High source address entropy indicates diverse communication sources, while low source address entropy may indicate the presence of scanning attacks or single points of failure.

[0056] Destination address entropy Entropy represents the distribution of destination IP addresses in a data frame. It is used to measure the diversity and uniformity of communication destinations. Low destination address entropy may indicate the presence of a DDoS attack or server overload.

[0057] Port Entropy The entropy value represents the distribution of port numbers in a data frame and is used to measure the diversity of communication service types. Abnormal changes in port entropy may indicate port scanning or service anomalies. Normal industrial network communication is regular and the entropy value is relatively stable. Sudden changes in entropy value indicate abnormal network behavior.

[0058] The calculation of protocol compliance features is based on an industrial protocol state machine model, and the calculation of the protocol compliance features specifically includes: Define the finite state machine model for each industrial protocol. ,in For a set of states, To input the alphabet, Define the legal state transition rules for the state transition function; This is the initial state, typically an idle or waiting state; This is a set of termination states, representing communication transactions that have been completed normally.

[0059] Taking the Modbus / TCP protocol as an example, the state set Input alphabet Includes function codes such as read coil (0x01), read discrete input (0x02), read holding register (0x03), and write single coil (0x05); state transition function. Definitions as follows: , .

[0060] Perform deep protocol parsing on the message sequence to extract the function code sequence. ,in Indicates the first The function code of each message, This represents the total number of messages in the message sequence.

[0061] The function code sequence is input into the state machine for verification, and the number of illegal state transitions is recorded. .

[0062] Calculate protocol deviation ,in, This indicates the percentage of protocol deviation.

[0063] when At that time, there is a risk of protocol anomalies in the marking.

[0064] Step S3: A dynamic baseline model is established using the sliding window online learning method. The dynamic threshold range of each feature dimension is calculated, and the comprehensive anomaly score of the current data frame is calculated to determine whether the network operation status is abnormal.

[0065] The calculation method for the dynamic threshold interval is as follows: for each feature dimension Calculate its dynamic threshold range ,in: ; ; Indicates the first The lower threshold boundary of the dimensional feature; Indicates the first Upper threshold boundary of dimensional features; For the first in the sliding window The mean of the 3D features is calculated using the following formula: ; For the first in the sliding window The standard deviation of a feature is calculated using the following formula: ; Here is the confidence coefficient. This is used to control the width of the threshold range. This corresponds to a confidence interval of approximately 95%. This corresponds to a confidence interval of approximately 99.7%. The fluctuation sensitivity coefficient Used to adjust the degree of response to characteristic fluctuations, high The value makes the threshold more sensitive to changes; For the first The rate of change of the dimensional feature is calculated using the following formula: It reflects the dynamic changing trend of characteristics.

[0066] The calculation method for the comprehensive anomaly score is as follows: in, This represents the overall anomaly score of the current data frame; Indicates the total number of feature dimensions; For the first The weights of the dimensional features, and satisfying ; Indicates the current data frame number The actual value of the dimensional feature; For the first in the sliding window The mean of the dimensional features; For the first in the sliding window Standard deviation of dimensional features; For exception indicator functions, when hour ,otherwise ; The feature weights An adaptive calculation using the information gain method is employed, calculating the information gain of each feature based on historical fault samples. ,in Entropy of the fault category For a given feature The conditional entropy is then applied; the weights are obtained by normalizing the information gain. .

[0067] Step S4: When the comprehensive anomaly score exceeds the alarm threshold, a fault is determined to exist, and the fault source location process is initiated; a device association matrix is ​​constructed based on the network topology connection relationship, the fault suspicion of each device node is calculated, and the device with the highest fault suspicion is identified as the fault source.

[0068] To filter out false alarms caused by transient disturbances, a continuous anomaly confirmation mechanism is set up: Set a continuous exception counter The initial value is 0; when hour, Increment by 1, otherwise reset to 0; when The fault was confirmed in time, among which , This is the warning threshold.

[0069] This mechanism requires multiple consecutive data frames to show anomalies before a fault is confirmed, effectively avoiding false alarms caused by network jitter, momentary interference, etc. This corresponds to a confirmation delay of approximately 1.5 to 3 seconds (depending on the time). The settings are suitable for most industrial scenarios.

[0070] when When (and the continuous confirmation condition is met) a fault is determined to exist, the fault source location process is initiated, wherein... Alarm thresholds are typically set. .

[0071] The method for calculating fault suspicion is as follows: a device association matrix is ​​constructed based on the network topology connection relationship. ,in The number of devices in the network, when the devices With equipment When a direct communication link exists ,otherwise .

[0072] The correlation matrix reflects the physical topology of the network. It can be automatically constructed by obtaining LLDP (Link Layer Discovery Protocol) neighbor information via SNMP, or manually configured by operations and maintenance personnel according to network documentation to calculate the fault suspicion of each device node. : in, For equipment Local anomaly scores; For the propagation coefficient, This is used to control the weight of the impact of abnormalities in adjacent devices on the suspicion level of the current device. For each element in the device association matrix, it represents a device. With equipment Does a direct connection exist? For equipment Local anomaly scores; For equipment With equipment The topological distance between them, measured in hops, can be calculated using either the Dijkstra algorithm or the Floyd-Warshall algorithm.

[0073] The core idea behind fault suspicion calculation is that the true fault source not only exhibits abnormal behavior itself but also affects surrounding devices through network topology. Therefore, the suspicion formula comprehensively considers both the degree of abnormality of the device itself and the propagation effect of abnormality from adjacent devices; propagation coefficient The settings need to be adjusted according to the characteristics of the network: strongly coupled networks (such as bus topologies) should be set to higher settings. Value; set lower for weakly coupled networks (such as star topologies). value.

[0074] Will The largest device is identified as the source of the fault. If multiple devices are of similar suspicion, the N most suspicious devices can be output.

[0075] Step S5: Construct a fault type feature mapping table to classify faults into five categories: link faults, equipment faults, protocol anomalies, performance degradation, and configuration errors; use Bayesian inference to calculate the posterior probability of each fault type, perform root cause inference based on the fault knowledge rule base, synthesize evidence for the matched rules, and calculate the final root cause confidence.

[0076] Construct a fault type feature mapping table to classify faults into five categories: link faults ( Equipment failure () Protocol exception () ), performance degradation ( ) and configuration errors ( ).

[0077] The method for calculating the posterior probability of each fault type using Bayesian inference is as follows: in, Represents a given feature vector Fault type under the condition is The posterior probability; Indicates the first Types of faults These correspond to link failure, device failure, protocol anomaly, performance degradation, and configuration error, respectively. Fault type The prior probability is obtained from historical failure statistics; Let be the likelihood function, representing the likelihood under fault type. Observed eigenvectors under certain conditions The conditional probability; This is the feature vector of the current fault state.

[0078] Likelihood function The estimation uses the Naive Bayes assumption, that is, each feature is conditionally independent: For continuous features, assume they follow a Gaussian distribution: ,in and The first Class 1 fault The mean and standard deviation of the dimensional features.

[0079] Root cause reasoning is performed based on a fault knowledge rule base, which is represented in a "condition-conclusion" format, and the rule confidence level is... .

[0080] The fault knowledge rule base includes the following types of diagnostic rules: Link failure rule: IF Interface status = Down AND Peer interface status = Down THEN Physical link interrupted ( Equipment fault rules: IF CPU utilization > 90% AND response latency > normal value × 3 THEN equipment overload Protocol exception rules: IF AND an illegal function code exists. THEN: Protocol attack or device malfunction. Performance degradation rule: IF packet loss rate > 1% AND latency jitter > normal value × 2 THEN network congestion ); Configuration error rule: IF VLAN mismatch OR IP address conflict THEN Configuration error ( ).

[0081] Evidence is synthesized for the matching rules, and the final root cause confidence score is calculated: in, This indicates the final confidence level after synthesis. and These represent the confidence levels of the two matching rules, respectively. and These represent the confidence levels of the Bayesian inference engine and the rule matching engine, respectively.

[0082] The output is a structured diagnostic report containing the following: fault occurrence time (accurate to milliseconds); fault source device identifier (device name, IP address, location information); fault type (one of five types and its posterior probability); root cause (matching rules and confidence level); recommended remedial measures (remedial suggestions based on a knowledge base); the diagnostic report is output in JSON or XML format for easy integration with the operation and maintenance management platform.

[0083] Example 2 like Figure 1 As shown, this invention provides a fault intelligent diagnosis system based on multi-source data. The system includes: a multi-source data acquisition module, a feature extraction module, an anomaly detection module, a fault location module, and a diagnostic reasoning module.

[0084] The multi-source data acquisition module includes a protocol parsing engine, a time synchronization unit, and a data buffer queue. It is used to synchronously acquire network operation data from multiple data sources in the industrial network and perform deep protocol parsing. In terms of hardware configuration, the module includes a high-speed network interface card (supporting 10Gbps line-speed acquisition), an industrial-grade GPS / PTP time synchronization module, a large-capacity circular buffer (supporting 1 hour of data storage), and a dedicated protocol parsing ASIC. The protocol parsing engine supports deep parsing of various industrial protocols, including Modbus / TCP, EtherNet / IP, PROFINET, OPC UA, IEC 61850, and DNP3. Zero-copy technology is used to optimize message processing performance, achieving a single-module processing capacity of 1 million messages / second. The time synchronization unit adopts the IEEE 1588PTP protocol and supports both Boundary Clock and Transparent Clock operating modes. Combined with a high-precision crystal oscillator, it can achieve time synchronization accuracy better than 100 nanoseconds. The data buffer queue adopts a lock-free circular buffer design, supporting a multi-producer-single-consumer mode to ensure data integrity in high-concurrency scenarios.

[0085] The feature extraction module includes a statistical feature calculation unit, an entropy calculation unit, and a protocol compliance detection unit, used to extract and quantize multi-dimensional feature vectors. This module adopts a streaming computing architecture, supporting online feature extraction. The statistical feature calculation unit uses an incremental algorithm to avoid repeatedly calculating all data within the window. The entropy calculation unit uses an approximation algorithm (such as HyperLogLog) to reduce computational complexity while maintaining accuracy. The protocol compliance detection unit incorporates state machine models for various industrial protocols and supports dynamically loading new protocol models.

[0086] The anomaly detection module includes a dynamic baseline modeling unit, a threshold calculation unit, and an anomaly scoring unit, used to detect network state anomalies in real time and calculate a comprehensive anomaly score. The dynamic baseline modeling unit adopts a sliding window mechanism and supports multiple window strategies (fixed-length window, time window, event window); the threshold calculation unit implements an adaptive threshold algorithm and supports online parameter adjustment; the anomaly scoring unit adopts a weighted fusion strategy and supports automatic weight learning.

[0087] The fault location module includes a topology management unit and a suspicion calculation unit, which are used to calculate the fault suspicion of each device node based on the device association matrix and determine the fault source.

[0088] The topology management unit supports automatic topology discovery (based on LLDP and CDP protocols) and manual topology configuration. It maintains a real-time updated network topology graph and supports topology change event detection and notification. The suspicion calculation unit implements graph-based fault propagation analysis, supporting multiple propagation models (linear propagation, exponential decay, threshold propagation). GPU-accelerated matrix operations support real-time localization of large-scale networks (>10,000 nodes).

[0089] The diagnostic reasoning module includes a Bayesian inference engine and a rule matching engine for fault type identification and root cause analysis. The Bayesian inference engine implements a Naive Bayes classifier and Bayesian network inference, supporting online model updates; the rule matching engine uses the Rete algorithm to optimize rule matching efficiency and supports complex condition combinations and priority control.

[0090] The two engines can work together: Bayesian inference provides the probability distribution of fault types, and rule matching provides specific root cause explanations. The final result combines the outputs of both to improve the accuracy and interpretability of the diagnosis.

[0091] The system also includes a knowledge base management module for storing and managing fault diagnosis rules, historical fault samples, and Bayesian probability parameters. This module adopts a hierarchical storage architecture: hot data (recent samples, commonly used rules) is stored in an in-memory database; warm data (historical samples) is stored on an SSD; and cold data (archived data) is stored in a distributed file system.

[0092] The diagnostic report generation module is used to generate structured diagnostic reports and push them to the operation and maintenance management platform. The module supports real-time alarm push and periodic summary reports.

[0093] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A fault intelligent diagnosis method based on multi-source data, applied to an industrial control network environment including PLC, DCS, and SCADA systems, characterized in that, The method includes the following steps: Step S1: Synchronously collect data from multiple data sources in the industrial network. The data sources include equipment operation logs, network traffic mirrors, protocol messages, I / O point data, and configuration information. Use a precise time protocol to synchronize the multi-source data at the microsecond level and divide the collected raw data into data frame sequences according to time windows. Step S2: Extract a multi-dimensional feature vector for each data frame. The feature vector includes temporal statistical features, traffic entropy features, and protocol compliance features. The temporal statistical features include the mean, standard deviation, skewness, and kurtosis of the message arrival interval. The traffic entropy features include source address entropy, destination address entropy, and port entropy. The protocol compliance features are calculated based on the protocol deviation of the message sequence using an industrial protocol state machine. Step S3: A dynamic baseline model is established using the sliding window online learning method. The dynamic threshold range of each feature vector is calculated, and the comprehensive anomaly score of the current data frame is calculated to determine whether the network operation status is abnormal. Step S4: When the comprehensive anomaly score exceeds the alarm threshold, a fault is determined to exist, and the fault source location process is initiated; a device association matrix is ​​constructed based on the network topology connection relationship, the fault suspicion of each device node is calculated, and the device with the highest fault suspicion is identified as the fault source. Step S5: Construct a fault type feature mapping table to classify faults into five categories: link faults, equipment faults, protocol anomalies, performance degradation, and configuration errors; use Bayesian inference to calculate the posterior probability of each fault type, perform root cause inference based on the fault knowledge rule base, synthesize evidence for the matched rules, calculate the final root cause confidence, and determine the fault type.

2. The method according to claim 1, characterized in that, Synchronously collecting data from multiple data sources in an industrial network specifically includes: Raw Ethernet packets are captured via port mirroring of industrial switches, supporting Modbus / TCP, EtherNet / IP, PROFINET and OPC UA protocols; Real-time data from PLC and DCS I / O points is acquired via the OPC DA / UA interface, with a sampling period of [missing information]. , Indicates the time interval between two consecutive data samples; Collect alarm logs from network and security devices using Syslog or SNMP Trap; The interface status, traffic statistics, and CPU / memory utilization of switches and routers are collected via the SNMP protocol, with a polling period of 10-60 seconds. Employing the IEEE 1588 precision time protocol for microsecond-level time synchronization of multi-source data, the synchronization accuracy is superior to... ; The collected raw data is divided into time windows. Divided into data frame sequences ,in , Indicates the first One data frame, Indicates the total number of data frames.

3. The method according to claim 1, characterized in that, The flow entropy feature mentioned in step S2 is calculated based on the Shannon entropy formula, which is: ,in Represents random variables Information entropy Indicates the first One event The probability of occurrence Indicates the total number of events; Calculate the source address entropy based on the Shannon entropy formula. Destination address entropy and port entropy .

4. The method according to claim 1, characterized in that, The calculation of the protocol compliance feature in step S2 specifically includes: Define the finite state machine model for each industrial protocol. ,in For a set of states, To input the alphabet, This is the state transition function. This is the initial state. For the set of terminating states; Perform deep protocol parsing on the message sequence to extract the function code sequence. ,in Indicates the first The function code of each message, This represents the total number of messages in the message sequence. The function code sequence is input into the state machine for verification, and the number of illegal state transitions is recorded. ; Calculate protocol deviation ,in, Indicates the percentage of protocol deviation; when When this occurs, a protocol anomaly risk is identified, and this protocol anomaly risk is used to characterize the protocol compliance feature.

5. The method according to claim 1, characterized in that, The calculation method for the dynamic threshold interval mentioned in step S3 is as follows: For each dimension of features Calculate its dynamic threshold range ,in: ; ; Indicates the first The lower threshold boundary of the dimensional feature; Indicates the first Upper threshold boundary of dimensional features; For the first in the sliding window The mean of the dimensional features; For the first in the sliding window Standard deviation of dimensional features; Here is the confidence coefficient. , used to control the width of the threshold range; The fluctuation sensitivity coefficient This is used to adjust the degree of response to characteristic fluctuations; For the first The rate of change of a feature reflects the dynamic trend of its change.

6. The method according to claim 1, characterized in that, The method for calculating the comprehensive anomaly score in step S3 is as follows: in, This represents the overall anomaly score of the current data frame; Indicates the total number of feature dimensions; For the first The weights of the features, and satisfying ; Indicates the current data frame number The actual value of the dimensional feature; For the first in the sliding window The mean of the dimensional features; For the first in the sliding window Standard deviation of dimensional features; For exception indicator functions, when hour ,otherwise ; The feature weights An adaptive calculation using the information gain method is employed, calculating the information gain of each feature based on historical fault samples. ,in Entropy of the fault category For a given feature The conditional entropy is then applied; the feature weights are obtained by normalizing the information gain. .

7. The method according to claim 1, characterized in that, The method for calculating the fault suspicion level in step S4 is as follows: Construct a device association matrix based on network topology connections. ,in The number of devices in the network, when the devices With equipment When a direct communication link exists ,otherwise ; Calculate the fault suspicion of each device node. : in, For equipment Local anomaly scores; For the propagation coefficient, This is used to control the weight of the impact of abnormalities in adjacent devices on the suspicion level of the current device. For each element in the device association matrix, it represents a device. With equipment Does a direct connection exist? For equipment Local anomaly scores; For equipment With equipment The topological distance between them is measured in hops.

8. The method according to claim 1, characterized in that, The method for calculating the posterior probability of each fault type using Bayesian inference in step S5 is as follows: in, Represents a given feature vector Fault type under the condition is The posterior probability; Indicates the first Types of faults These correspond to link failure, device failure, protocol anomaly, performance degradation, and configuration error, respectively. Fault type The prior probability is obtained from historical failure statistics; Let be the likelihood function, representing the likelihood under fault type. Observed eigenvectors under certain conditions The conditional probability; This is the feature vector of the current fault state; Evidence is synthesized for the matching rules, and the final root cause confidence score is calculated: in, This represents the final root cause confidence level after synthesis. and These represent the confidence levels of the Bayesian inference engine and the rule matching engine, respectively.

9. A fault intelligent diagnosis system based on multi-source data, used to implement the method described in any one of claims 1-8, characterized in that, The system includes: a multi-source data acquisition module, a feature extraction module, an anomaly detection module, a fault location module, and a diagnostic reasoning module; The multi-source data acquisition module includes a protocol parsing engine, a time synchronization unit, and a data cache queue, which are used to synchronously acquire network operation data from multiple data sources in the industrial network and perform in-depth protocol parsing. The feature extraction module includes a statistical feature calculation unit, an entropy calculation unit, and a protocol compliance detection unit, which are used to extract multi-dimensional feature vectors and quantize them. The anomaly detection module includes a dynamic baseline modeling unit, a threshold calculation unit, and an anomaly scoring unit, which are used to detect network state anomalies in real time and calculate a comprehensive anomaly score. The fault location module includes a topology management unit and a suspicion calculation unit, which are used to calculate the fault suspicion of each device node and determine the fault source based on the device association matrix. The diagnostic reasoning module includes a Bayesian inference engine and a rule matching engine, used for fault type identification and root cause analysis.

10. The system according to claim 9, characterized in that, The system also includes a knowledge base management module for storing and managing fault diagnosis rules, historical fault samples, and Bayesian probability parameters; and a diagnostic report generation module for generating structured diagnostic reports and pushing them to the operation and maintenance management platform.

Images