A communication anomaly detection method and device based on multi-modal feature fusion

Abstract

This application provides a communication anomaly detection method and apparatus based on multimodal feature fusion. It extracts multiple heterogeneous features in parallel from preprocessed industrial control communication traffic; generates a dynamic latent feature baseline using a sliding window and exponentially weighted moving average algorithm, and calculates the latent feature anomaly degree based on the current Laplacian latent feature vector; adaptively weights and fuses the total feature vector to generate a fused feature vector; inputs the fused feature vector into a pre-trained autoencoder model, calculates the reconstruction error of the fused feature vector and generates a reconstruction anomaly score; combines the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and uses a multimodal classifier to determine the target anomaly type. This method and apparatus solve the problems of single feature dimension and static baseline in traditional methods under encrypted environments, meeting the real-time and computational efficiency requirements of industrial control systems.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and apparatus for detecting communication anomalies based on multimodal feature fusion. Background Technology

[0002] Industrial control systems, as a core component of critical information infrastructure, have been widely applied in key sectors of the national economy such as energy, transportation, and intelligent manufacturing. Against the backdrop of the rapid development of the Industrial Internet, encrypted communication technology in industrial control networks has been deployed on a large scale, with encrypted traffic accounting for over 90%. However, while ensuring the confidentiality and integrity of data transmission, encryption technology has also brought new security threats.

[0003] Traditional industrial control system (ICS) protocol anomaly detection techniques primarily rely on plaintext protocol content analysis, including methods such as protocol header field parsing and data packet format verification. However, these techniques have significant limitations when dealing with encrypted communication scenarios: firstly, the encrypted protocol payload cannot be directly parsed; secondly, even using plaintext information from the TLS handshake phase, it is difficult to capture dynamic behavioral characteristics during protocol execution. To address this technical challenge, current research focuses on two main directions: one is statistical traffic analysis methods, which establish behavioral benchmark models by mining the temporal and value domain characteristics of communication traffic; the other is intelligent detection methods based on deep learning, which use machine learning algorithms to directly learn the pattern characteristics of encrypted traffic. However, these methods still face technical bottlenecks such as limited feature dimensions, static benchmark models, and insufficient extraction of dynamic system response features, resulting in room for improvement in the accuracy and real-time performance of ICS encrypted communication protocol anomaly detection. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a communication anomaly detection method and apparatus based on multimodal feature fusion. This method extracts three types of information from encrypted communication traffic: plaintext features, statistical features, and latent features. A dynamic latent feature baseline is constructed, and multimodal features are fused through an attention mechanism. Finally, the results are input into an autoencoder model to calculate the reconstruction error, thereby achieving anomaly detection and classification of encrypted communication protocols in industrial control systems. This solves the problems of traditional methods having single feature dimensions and static baselines in encrypted environments. Furthermore, through dynamic weight adjustment and edge deployment optimization, it meets the real-time and computational efficiency requirements of industrial control systems.

[0005] In a first aspect, embodiments of this application provide a communication anomaly detection method based on multimodal feature fusion, the communication anomaly detection method comprising: Multiple heterogeneous features are extracted in parallel from the preprocessed industrial control communication traffic; wherein, the heterogeneous features include plaintext feature vectors, statistical feature vectors, and Laplace latent feature vectors; Based on the Laplacian latent feature vector and the real-time operating status of industrial control equipment, a dynamic latent feature baseline is generated through a sliding window and exponentially weighted moving average algorithm, and the latent feature anomaly degree of the current Laplacian latent feature vector is calculated based on the dynamic latent feature baseline. The various heterogeneous features are concatenated into a total feature vector. The total feature vector is then adaptively weighted and fused using the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector. The fused feature vector is input into a pre-trained autoencoder model to calculate the reconstruction error of the fused feature vector and generate a reconstruction anomaly score. The reconstruction anomaly score and the latent feature anomaly degree are combined to determine whether the current industrial control communication is abnormal. The attention weight, reconstruction error and the latent feature anomaly degree are input into a multimodal classifier to determine the target anomaly type.

[0006] Furthermore, the plaintext feature vector is extracted through the following steps: The fixed fields of the protocol header are extracted from the industrial control communication traffic, plaintext information is extracted from the handshake process of the transport layer security protocol or the secure socket layer protocol, and the source IP address, destination IP address, port number and transport layer protocol information are extracted from the network layer. The extracted information is transformed into a 32-dimensional plaintext feature vector through a rule engine.

[0007] Furthermore, the statistical feature vector is extracted through the following steps: The industrial control communication traffic is converted into time series data to construct an instruction interval sequence and a data packet size sequence. The mean, variance, skewness, and kurtosis are calculated from the instruction interval sequence as time-domain features; The mean, variance, and quantiles are calculated from the data packet size sequence as range features; Extract request response time, retransmission count, and timeout rate from communication traffic as traffic pattern features; The time-domain features, the value-domain features, and the flow pattern features are extracted and encoded using a multilayer perceptron to form a 32-dimensional statistical feature vector.

[0008] Furthermore, the Laplacian latent feature vector is extracted through the following steps: The timestamp sequence in the industrial control communication traffic is converted into an instruction interval sequence, and an input-output sequence pair consisting of instruction sending time interval and response time interval is constructed; Based on the input-output sequence pair, the denominator polynomial coefficients and numerator polynomial coefficients of the transfer function are determined, the poles are solved, and the real and imaginary parts of the poles are extracted to form a 64-dimensional Laplace latent feature vector.

[0009] Furthermore, the step of generating a dynamic latent feature baseline based on the Laplace latent features and the real-time acquired operating status of the industrial control equipment, using a sliding window and exponentially weighted moving average algorithm, includes: A sliding window is set up, and the dynamic mean and dynamic standard deviation of the Laplacian latent feature vectors within the sliding window are calculated using an exponentially weighted moving average algorithm; wherein, the sliding window is used to store recently extracted Laplacian latent feature vectors, and the length of the sliding window is dynamically adjusted according to the communication cycle of the industrial control protocol; Acquire the real-time status signal of the industrial control equipment, and determine the adaptive coefficient of the operating condition based on the real-time status signal; The dynamic latent feature baseline is constructed based on the dynamic mean, the dynamic standard deviation, and the operating condition adaptive coefficient.

[0010] Furthermore, the adaptive weighted fusion of the total feature vector through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector includes: The weights of different features in the total feature vector are calculated using a multi-head attention mechanism; The weights of the multi-head attention mechanism are coupled with the working condition adaptive coefficient and the latent feature anomaly degree. The total feature vector is then weighted and fused according to the calculated weights to obtain the fused feature vector.

[0011] Furthermore, the process of inputting the fused feature vector into the pre-trained autoencoder model, calculating the reconstruction error of the fused features and generating a reconstruction anomaly score, combining the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and determining the target anomaly type based on attention weights, reconstruction error, and latent feature anomaly degree, specifically includes: The fused feature vector is input into the autoencoder model, the difference between the reconstructed feature vector output by the autoencoder model and the input fused feature vector is calculated, the difference is used as the reconstruction error, and a reconstruction anomaly score is generated based on the reconstruction error. When the reconstruction anomaly score exceeds the first preset threshold, or the latent feature anomaly degree exceeds the second preset threshold, the current industrial control communication is determined to be abnormal. The attention weights, the reconstruction error, and the latent feature anomaly degree are combined and input into a multimodal classifier, which outputs a probability distribution of a preset anomaly type and determines the target anomaly type based on the probability distribution.

[0012] Secondly, embodiments of this application also provide a communication anomaly detection device based on multimodal feature fusion, the communication anomaly detection device comprising: The heterogeneous feature extraction module is used to extract multiple heterogeneous features in parallel from the preprocessed industrial control communication traffic; wherein, the heterogeneous features include plaintext feature vectors, statistical feature vectors, and Laplace latent feature vectors. The latent feature anomaly calculation module is used to generate a dynamic latent feature baseline based on the Laplacian latent feature vector and the real-time acquired operating status of industrial control equipment, through a sliding window and exponential weighted moving average algorithm, and to calculate the latent feature anomaly of the current Laplacian latent feature vector based on the dynamic latent feature baseline. The fusion feature vector generation module is used to concatenate the various heterogeneous features into a total feature vector, and to perform adaptive weighted fusion on the total feature vector through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fusion feature vector. An anomaly detection module is used to input the fused feature vector into a pre-trained autoencoder model, calculate the reconstruction error of the fused feature vector and generate a reconstruction anomaly score, combine the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and input the attention weight, reconstruction error and latent feature anomaly degree into a multimodal classifier to determine the target anomaly type.

[0013] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the communication anomaly detection method based on multimodal feature fusion as described above are performed.

[0014] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the communication anomaly detection method based on multimodal feature fusion as described above.

[0015] This application provides a communication anomaly detection method and apparatus based on multimodal feature fusion. First, multiple heterogeneous features are extracted in parallel from preprocessed industrial control communication traffic. These heterogeneous features include plaintext feature vectors, statistical feature vectors, and Laplacian latent feature vectors. Then, based on the Laplacian latent feature vectors and the real-time operating status of the industrial control equipment, a dynamic latent feature baseline is generated using a sliding window and exponentially weighted moving average algorithm. The latent feature anomaly degree of the current Laplacian latent feature vector is calculated based on the dynamic latent feature baseline. The multiple heterogeneous features are concatenated into a total feature vector. The total feature vector is adaptively weighted and fused using the operating condition adaptive coefficient of the dynamic latent feature baseline and a multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector. Finally, the fused feature vector is input into a pre-trained autoencoder model to calculate the reconstruction error of the fused feature vector and generate a reconstruction anomaly score. The reconstruction anomaly score and the latent feature anomaly degree are combined to determine whether the current industrial control communication is abnormal. The attention weights, reconstruction error, and latent feature anomaly degree are then input into a multimodal classifier to determine the target anomaly type.

[0016] This application extracts three types of information—plaintext features, statistical features, and latent features—from encrypted communication traffic to construct a dynamic latent feature baseline. It then fuses multimodal features through an attention mechanism, ultimately inputting the results into an autoencoder model to calculate the reconstruction error, thereby achieving anomaly detection and classification of encrypted communication protocols in industrial control systems. Compared to existing technologies, this application introduces Laplace latent feature mining, which can extract dynamic response characteristics of the system from encrypted traffic. This solves the problems of single feature dimensions and static baselines in traditional methods under encrypted environments. Furthermore, through dynamic weight adjustment and edge deployment optimization, it meets the real-time and computational efficiency requirements of industrial control systems.

[0017] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a communication anomaly detection method based on multimodal feature fusion provided in this application embodiment; Figure 2 A flowchart illustrating a multimodal feature extraction method provided in an embodiment of this application; Figure 3 A schematic diagram of a communication anomaly detection device based on multimodal feature fusion provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0021] First, the applicable scenarios for this application will be introduced. This application can be applied to the field of computer technology.

[0022] Industrial control systems, as a core component of critical information infrastructure, have been widely applied in key sectors of the national economy such as energy, transportation, and intelligent manufacturing. Against the backdrop of the rapid development of the Industrial Internet, encrypted communication technology in industrial control networks has been deployed on a large scale, with encrypted traffic accounting for over 90%. However, while ensuring the confidentiality and integrity of data transmission, encryption technology has also brought new security threats.

[0023] Research has revealed that traditional industrial control protocol anomaly detection techniques primarily rely on plaintext protocol content analysis, including methods such as protocol header field parsing and data packet format verification. However, these techniques have significant limitations when dealing with encrypted communication scenarios: firstly, the encrypted protocol payload cannot be directly parsed; secondly, even using plaintext information from the TLS handshake phase, it is difficult to capture dynamic behavioral characteristics during protocol execution. To address this technical challenge, current research focuses on two main directions: one is statistical traffic analysis methods, which establish behavioral benchmark models by mining the temporal and value domain characteristics of communication traffic; the other is intelligent detection methods based on deep learning, which use machine learning algorithms to directly learn the pattern characteristics of encrypted traffic. However, these methods still face technical bottlenecks such as limited feature dimensions, static benchmark models, and insufficient extraction of dynamic system response features, resulting in room for improvement in the accuracy and real-time performance of anomaly detection for industrial control encrypted communication protocols.

[0024] Based on this, the embodiments of this application provide a communication anomaly detection method based on multimodal feature fusion, which solves the problems of single feature dimension and static baseline in traditional methods under encrypted environments, and meets the real-time and computational efficiency requirements of industrial control systems.

[0025] Please see Figure 1 , Figure 1 This is a flowchart illustrating a communication anomaly detection method based on multimodal feature fusion, provided as an embodiment of this application. Figure 1 As shown in the figure, the communication anomaly detection method provided in this application includes: S101 extracts multiple heterogeneous features in parallel from the preprocessed industrial control communication traffic.

[0026] Here, industrial control communication traffic refers to communication data transmitted over a network in an industrial control system, including commands, responses, and status information. Heterogeneous features refer to a set of features from different dimensions with different mathematical properties and physical meanings. In the embodiments provided in this application, heterogeneous features include plaintext features, statistical features, and Laplace implicit features.

[0027] Regarding step S101 above, in specific implementation, industrial control network sniffing devices are used to collect industrial control communication traffic in real time, including information such as timestamps, source / destination IPs, port numbers, and protocol header fields. Then, the industrial control communication traffic is preprocessed. Preprocessing may include cleaning, format unification, and noise filtering of the raw communication traffic; this application does not specifically limit this process. Multiple heterogeneous features are extracted in parallel from the preprocessed industrial control communication traffic. Specifically, three types of features are extracted from the encrypted communication traffic: Plaintext features (protocol header fields): Fixed fields in the protocol header are parsed using a rule engine to form a 32-dimensional feature vector. Plaintext feature extraction: Fixed fields in the protocol header (such as Modbus function codes and DNP3 control fields) are parsed to extract a 32-dimensional plaintext feature vector. Statistical characteristics (traffic time-domain / value-domain distribution): By analyzing the time-domain and value-domain characteristics of command intervals and packet sizes, a 32-dimensional feature vector is formed. Statistical feature extraction: Calculate the command interval sequence. and packet size sequence Statistical indicators (mean, variance, skewness, etc.) are used to extract a 32-dimensional statistical feature vector. Laplace latent features (system dynamic response characteristics): The communication sequence is converted into complex frequency domain features through discrete Laplace transform, and system dynamic characteristics such as pole positions and attenuation coefficients are extracted to form a 64-dimensional feature vector. Laplace latent feature extraction: The discrete Laplace transform (Z-transform) is applied to the preprocessed communication sequence to extract system dynamic characteristics such as pole positions and attenuation coefficients, forming a 64-dimensional latent feature vector. .

[0028] Please see Figure 2 , Figure 2 This is a flowchart illustrating a multimodal feature extraction method provided in an embodiment of this application. Specifically, the plaintext feature vector is extracted through the following steps: The system extracts fixed fields from the protocol header of the industrial control communication traffic, extracts plaintext information from the handshake process of the transport layer security protocol or secure socket layer protocol, and extracts source IP address, destination IP address, port number and transport layer protocol information from the network layer; the extracted information is then converted into a 32-dimensional plaintext feature vector through a rule engine.

[0029] Here, plaintext features are primarily extracted from the unencrypted portion of industrial control system (ICS) encrypted communication traffic. In ICS encrypted communication protocols, although the payload is encrypted, some plaintext information still exists, such as fixed fields in the protocol header and TLS / SSL handshake information. While this information is limited, it reflects basic communication attributes such as protocol type, source / destination addresses, and port numbers. Specifically, the plaintext feature extraction process includes the following steps: Protocol header parsing: Extracting fixed fields from the protocol header of encrypted communication traffic, such as the function code of the Modbus protocol, the control field of the DNP3 protocol, and the application service data unit type of the IEC 104 protocol. These fields are usually kept in plaintext form during encryption and can be directly used for feature extraction.

[0030] TLS / SSL Handshake Information Extraction: In the initial phase of encrypted communication, the TLS / SSL handshake process transmits plaintext information, including the protocol version, cipher suite, and certificate fingerprint. This information can be used to identify the encryption type and security of the communication.

[0031] Network layer information extraction: Extracting information such as source IP, destination IP, port number, and transport layer protocol from the IP and TCP layers. This information reflects the network topology and connection relationships of the communication.

[0032] After plaintext features are extracted by the rule engine, a 32-dimensional plaintext feature vector is formed, which is specifically represented by the following formula:

[0033] in, This indicates whether the i-th plaintext feature exists or meets the expected value (such as whether a protocol field is valid). For example, for Modbus / TCP over TLS, This can represent "function code is 03". This indicates that "the protocol version is TLS 1.3", and so on.

[0034] Specifically, the statistical feature vector is extracted through the following steps: The industrial control communication traffic is converted into time series data to construct an instruction interval sequence and a data packet size sequence. The mean, variance, skewness, and kurtosis are calculated from the instruction interval sequence as time-domain features. The mean, variance, and quantiles are calculated from the data packet size sequence as value-domain features. Request response time, retransmission count, and timeout rate are extracted from the communication traffic as traffic pattern features. The time-domain features, value-domain features, and traffic pattern features are extracted and encoded using a multilayer perceptron to form a 32-dimensional statistical feature vector.

[0035] Here, statistical feature extraction extracts statistical features by analyzing the time-domain and value-domain characteristics of communication traffic. These features reflect communication patterns and behavioral characteristics, such as command frequency and packet size distribution, enabling the capture of abnormal communication patterns without relying on protocol content. The statistical feature extraction process includes the following key steps: Communication sequence construction: Converting encrypted communication traffic into time-series data, including instruction interval sequences. (Time difference between adjacent instructions) and packet size sequence (Size of each data packet).

[0036] Time-domain feature calculation: Calculating statistical indicators, such as the mean, from the instruction interval sequence. ,variance skewness kurtosis These indicators reflect the frequency and stability of communication.

[0037] Range feature calculation: Calculate statistical indicators, such as the mean, from the data packet size sequence. ,variance Indicators such as the quantiles of data packet size distribution (e.g., 25%, 50%, 75th percentile) reflect the amount and distribution patterns of communication data.

[0038] Traffic pattern feature calculation: Extract features such as request-response time, retransmission count, and timeout rate from communication traffic. These features reflect the interaction pattern and stability of communication.

[0039] Statistical features are extracted and encoded using a multilayer perceptron (MLP) to form a 32-dimensional statistical feature vector:

[0040] in, This represents the standardized value of the j-th statistical feature (processed by Min-Max normalization or Z-score standardization).

[0041] The innovation of statistical feature extraction lies in its combination of multidimensional statistical analysis of the time domain and value domain, enabling it to capture complex patterns in communication traffic. For example, when a significant increase in the variance of the instruction interval is detected... Furthermore, the average data packet size decreased significantly. This may indicate that the system is in an abnormal state (such as network congestion or protocol abuse).

[0042] Specifically, the Laplacian latent feature vector is extracted through the following steps: The timestamp sequence in the industrial control communication traffic is converted into an instruction interval sequence, and an input-output sequence pair consisting of instruction sending time interval and response time interval is constructed. Based on the input-output sequence pair, the denominator polynomial coefficients and numerator polynomial coefficients of the transfer function are determined, the poles are solved, and the real and imaginary parts of the poles are extracted to form a 64-dimensional Laplace latent feature vector.

[0043] Here, Laplace implicit feature extraction extracts system dynamic response features from encrypted industrial control communication sequences using the Discrete Laplace Transform (DLT). These features reflect the physical dynamic characteristics of the industrial control system, such as the response time of valve control commands and current changes during motor startup, enabling the capture of the system's essential behavior without decryption. The Laplace implicit feature extraction process includes: Communication sequence modeling: This involves analyzing the timestamp sequence within encrypted communication traffic. Convert to instruction interval sequence And construct input-output sequence pairs For example, for Modbus / TCP over TLS, It can represent the time interval for sending instructions. It can represent the response time interval.

[0044] Discrete Laplace Transform (DLT): for instruction interval sequences and response time series Apply the Discrete Laplace Transform (Z-transform) respectively:

[0045] in, It is a complex variable, (T) is the sampling period (e.g., T=2 seconds), and (N) is the sequence length (e.g., (N=300) corresponds to a 10-minute window).

[0046] Transfer function identification: Assuming the industrial control system is a linear time-invariant (LTI) system, construct the transfer function. ,Right now:

[0047] in, It is a denominator polynomial. It is the numerator polynomial. Using the least squares method or the Yule-Walker equation, it can be derived from the input-output sequence pair. Identify the coefficients of the transfer function. .

[0048] Pole extraction and analysis: solving the denominator polynomial The root, extract the poles of the system. .

[0049] Real part of the pole and the virtual part Im The stability and dynamic characteristics of the system are determined when the poles are located inside the unit circle (i.e., ...). When the poles are located outside the unit circle (i.e., when the poles are outside the unit circle), the system is stable; when the poles are located outside the unit circle (i.e., when the poles are outside the unit circle), the system is stable. When the poles are at a certain point, the system is unstable. Specifically, the real part of the poles... The imaginary part reflects the system's decay characteristics (negative real part represents decay, positive real part represents divergence). Im It reflects the oscillation characteristics of the system (related to the system response speed).

[0050] Feature vector construction: based on extracted poles Construct a 64-dimensional Laplacian latent feature vector:

[0051] in, It is the i-th pole of the transfer function G(z). Furthermore, the magnitude of the pole can be added. and phase angle As an extended feature.

[0052] The innovation of Laplace latent feature extraction lies in its introduction of the Laplace transform from traditional control theory into the field of network security. By analyzing the complex frequency domain characteristics of the communication sequence, it extracts the dynamic response features of the system. Compared with existing technologies, this method can capture the behavioral essence of the system, rather than just focusing on surface statistical properties. For example, for motor start commands, even if the specific parameter values ​​are encrypted, the latent features of the response time series (such as the real parts of poles) can be analyzed. Even with changes in the system, it is still possible to determine whether the system has started normally.

[0053] S102, based on the Laplacian latent feature vector and the real-time acquired operating status of the industrial control equipment, a dynamic latent feature baseline is generated through a sliding window and exponentially weighted moving average algorithm, and the latent feature anomaly degree of the current Laplacian latent feature vector is calculated based on the dynamic latent feature baseline.

[0054] Here, the dynamic latent feature baseline refers to a reference benchmark constructed based on the dynamic statistics of the Laplacian latent features and the adaptive coefficients of the operating conditions, used to determine whether the current features are abnormal. The latent feature anomaly degree refers to the degree of difference between the current Laplacian latent feature vector and the dynamic latent feature baseline, reflecting the degree of anomalousness in the dynamic behavior of the system.

[0055] As an optional embodiment, regarding step S102 above, the step of generating a dynamic latent feature baseline based on the Laplace latent features and the real-time acquired operating status of the industrial control equipment, using a sliding window and exponentially weighted moving average algorithm, includes: Step 1021: Set a sliding window and calculate the dynamic mean and dynamic standard deviation of the Laplace latent feature vector within the sliding window using an exponentially weighted moving average algorithm.

[0056] Here, the sliding window is used to store recently extracted Laplacian latent feature vectors, and the length of the sliding window is dynamically adjusted according to the communication cycle of the industrial control protocol.

[0057] Here, dynamic latent feature baseline construction utilizes a sliding window and adaptive threshold algorithm, combined with industrial control equipment status signals, to build an adaptively updated baseline to adapt to changes in the industrial control equipment's state (such as equipment transitioning from standby to high-load operation, system maintenance, equipment start-up and shutdown, etc.). The dynamic baseline construction process includes: Sliding window design: Set a sliding window of length N to store the most recent latent feature vectors.

[0058] in, The window at time t contains the latent feature vectors of the most recent N time points. The window length N is dynamically adjusted according to the communication cycle of the industrial control protocol.

[0059] in, For window time (e.g., 10 minutes). The sampling interval (set according to the communication cycle of the industrial control protocol, such as Modbus / TCP, which is usually 10 ... The window length can be dynamically adjusted when the device status changes. (e.g., during maintenance) to accelerate adaptation to the new state.

[0060] Calculation of dynamic mean and standard deviation: Calculate the dynamic mean of the latent feature vectors within the window. and dynamic standard deviation :

[0061] In addition, the Exponentially Weighted Moving Average (EWMA) can be used to increase the weight of recent data:

[0062]

[0063] in, Weighting coefficients (usually taken as...) This is used to balance the impact of recent data with historical data.

[0064] Step 1022: Obtain the real-time status signal of the industrial control equipment, and determine the adaptive coefficient of the operating condition based on the real-time status signal.

[0065] Step 1023: Construct the dynamic latent feature baseline based on the dynamic mean, the dynamic standard deviation, and the working condition adaptive coefficient.

[0066] Specifically, for steps 1022-1023 above, firstly, based on the dynamic mean and standard deviation, an adaptive coefficient for the operating condition is set. The adaptive coefficient for the operating condition is expressed by the following formula:

[0067] in, It depends on the device status. The dynamically adjusted coefficients are determined by the following mapping relationship:

[0068] This design considers the fluctuation range of communication behavior under different device states. For example, under maintenance conditions, the device may perform various test operations, resulting in significant fluctuations in communication behavior; therefore, a larger baseline range is required. Device status signal fusion is implemented, acquiring real-time status signals of industrial control equipment (such as mode switching and operating status in PLC logs) via the OPC UA protocol or SCADA system interface. When a change in device status is detected, a baseline reset is automatically triggered. The baseline reset includes clearing the sliding window buffer, resetting the counter, and loading the data corresponding to the new device status. Value operations, etc.

[0069]

[0070] Subsequently, the equipment status is acquired via the OPC UA protocol or SCADA system interface to obtain real-time status signals (such as operation / maintenance / shutdown) of the industrial control equipment. When a change in equipment status is detected, a baseline reset is automatically triggered to ensure that the baseline is synchronized with the equipment status. Dynamically adjust the sliding window length N and the adaptive coefficient. And update the dynamic baseline, specifically expressed by the following formula:

[0071]

[0072]

[0073] Furthermore, after the dynamic latent feature baseline is determined, the latent feature anomaly degree of the current Laplacian latent feature vector is calculated based on the dynamic latent feature baseline, and the current latent feature is calculated as follows. Compared with baseline Difference:

[0074] in, This indicates the degree of latent feature anomaly at the current time point. It is to prevent the minimum value where the denominator is zero (e.g.) ).

[0075] Thus, according to step S102 above, the innovation of dynamic baseline construction lies in its combination of the statistical characteristics of industrial control equipment status signals and latent features, achieving adaptive baseline updates. Compared with static baselines, it can significantly reduce the false alarm rate and improve detection accuracy. For example, during equipment maintenance, the system will automatically update the baseline. The version has been updated to 4.0, allowing for greater fluctuations in communication behavior and preventing normal maintenance operations from being misjudged as abnormal.

[0076] S103, the various heterogeneous features are concatenated into a total feature vector, and the total feature vector is adaptively weighted and fused by the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector.

[0077] Here, adaptive weighted fusion refers to the weighted combination of different features based on the weights calculated by the attention mechanism, enabling the model to automatically focus on important features. The fused feature vector refers to the feature vector generated after weighted fusion through the multi-head attention mechanism, which serves as the input to the subsequent detection model.

[0078] According to step S103 above, in specific implementation, multiple heterogeneous features are concatenated into a total feature vector. Through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree, the total feature vector is adaptively weighted and fused to generate a fused feature vector.

[0079] Specifically, multimodal feature fusion and feature vector concatenation combine plaintext features. Statistical characteristics and latent features Concatenate them into a unified total feature vector:

[0080] in, It is a total eigenvector of 128 dimensions (32+32+64).

[0081] Furthermore, to enhance the model's adaptability to the current device state, this application also implements the coupling of attention weights with the dynamic baseline:

[0082] in, These are the adaptive coefficients of the dynamic baseline. It is a pre-trained state-weight matrix. In this way, when the device is in maintenance mode, The model will automatically increase the weight of latent features to adapt to changes in device state.

[0083] Specifically, regarding step S103 above, the adaptive weighted fusion of the total feature vector using the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector includes: The weights of different features in the total feature vector are calculated using a multi-head attention mechanism; the weights of the multi-head attention mechanism are coupled with the working condition adaptive coefficient and the latent feature anomaly degree; and the total feature vector is weighted and fused according to the calculated weights to obtain a fused feature vector.

[0084] Specifically, for the two steps mentioned above, firstly, attention mechanism feature weighting is performed. A multi-head attention mechanism is used to calculate the weights of different features, and then weighted fusion is performed.

[0085] Where Q, K, and V are the query, key, and value matrices, respectively, and are generated in the following way:

[0086] It is a learnable weight matrix used to map feature vectors to different attention spaces. In this application, the number of attention heads is 12, of which: 4 heads focus on plaintext features (protocol field correlation), 4 heads focus on statistical features (traffic distribution anomalies), and 4 heads focus on latent features (system dynamic characteristics). The output of the attention mechanism is fused in the following way:

[0087] in, , It is the output transformation matrix, used to merge the outputs of multi-head attention into a unified feature vector.

[0088] S104, the fused feature vector is input into the pre-trained autoencoder model, the reconstruction error of the fused feature vector is calculated and a reconstruction anomaly score is generated, the reconstruction anomaly score and the latent feature anomaly degree are combined to determine whether the current industrial control communication is abnormal, and the attention weight, reconstruction error and latent feature anomaly degree are input into the multimodal classifier to determine the target anomaly type.

[0089] Regarding step S104 above, in specific implementation, the fused feature vector is input into the pre-trained autoencoder model, the reconstruction error of the fused feature vector is calculated and a reconstruction anomaly score is generated, and the reconstruction anomaly score and latent feature anomaly degree are combined to determine whether the current industrial control communication is abnormal, and the attention weight, reconstruction error and the latent feature anomaly degree are input into the multimodal classifier to determine the target anomaly type.

[0090] As an optional embodiment, regarding step S104 above, the step of inputting the fused feature vector into the pre-trained autoencoder model, calculating the reconstruction error of the fused features and generating a reconstruction anomaly score, combining the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and determining the target anomaly type based on attention weights, reconstruction error, and latent feature anomaly degree, specifically includes: Step 1041: Input the fused feature vector into the autoencoder model, calculate the difference between the reconstructed feature vector output by the autoencoder model and the input fused feature vector, use the difference as the reconstruction error, and generate a reconstruction anomaly score based on the reconstruction error.

[0091] First, we introduce the LSTM-autoencoder model structure, including the encoder, decoder, and residual connections between the encoder and decoder: Encoder: 3-layer LSTM, 128 units per layer, used to compress the input feature sequence into a low-dimensional representation.

[0092] in, It is the hidden state of the encoder at time t, used to represent the compressed representation of the current communication behavior.

[0093] Decoder: 2-layer LSTM, 64 units per layer, used to reconstruct the feature sequence from the hidden state.

[0094] in, It is the hidden state of the decoder at time t-1, used to reconstruct the feature vector at the current time point.

[0095] Residual Connection: To accelerate convergence and prevent information loss, this application introduces a residual connection between the encoder and decoder.

[0096]

[0097] The Dropout layer is used to prevent overfitting and improve the model's generalization ability.

[0098] The difference between the reconstructed feature vector output by the autoencoder model and the fused feature vector input is calculated using the following formula and used as the anomaly score:

[0099] Here, Score(t) represents the degree of anomaly at the current time point.

[0100] Step 1042: When the reconstruction anomaly score exceeds the first preset threshold, or the hidden feature anomaly degree exceeds the second preset threshold, the current industrial control communication is determined to be abnormal.

[0101] Here, when the reconstruction anomaly score exceeds the first preset threshold, or the hidden feature anomaly degree exceeds the second preset threshold, the current industrial control communication is determined to be abnormal.

[0102] Step 1043: Combine the attention weight, the reconstruction error and the latent feature anomaly degree, input them into the multimodal classifier, output the probability distribution of the preset anomaly type, and determine the target anomaly type according to the probability distribution.

[0103] Regarding step 1043 above, in specific implementation, a multimodal classifier is constructed based on anomaly scoring and attention weights to classify anomaly types:

[0104]

[0105] in, This represents the attention weights corresponding to the plaintext feature vectors. This represents the attention weights corresponding to the statistical feature vectors. This represents the attention weights corresponding to the Laplacian hidden feature vectors. It is the feature vector input to the classifier. It is the probability distribution of the output anomaly types. and These are the weight matrix and bias terms of the classifier.

[0106] Anomaly detection and classification: based on anomaly scores and classification probability distribution Determine if the current communication is abnormal and identify the type of abnormality, for example: Protocol abuse: (Mainly characterized by plaintext anomalies) System overload: (Hidden feature real part) (Mainly) Hidden tunnels: (Statistical characteristic distribution shift is the main factor) As an optional embodiment, this application employs a weighted cross-entropy loss function in the multimodal classifier to balance the contributions of different categories to the loss function:

[0107] in, It's a category weight, based on historical outlier rates. Dynamic adjustment:

[0108] For example, the anomaly rate of hidden tunnels is usually low ( Therefore, its weight is relatively high. This is to enhance the model's sensitivity to rare anomalies.

[0109] Online adaptive training: To improve the model's adaptability in long-term operation, this application implements an online adaptive training mechanism: a model freezing strategy that updates only the attention module and classification layer, retaining 90% of the original knowledge.

[0110] Learning rate adjustment: The learning rate during the fine-tuning phase is set to... This prevents drastic parameter changes. Incremental learning: When a sufficient number of outlier samples are detected, the model is incrementally updated.

[0111] In this way, the model can continuously learn new anomaly patterns while retaining existing knowledge. The weighted cross-entropy loss function balances the contributions of different categories to the loss function, improving the ability to detect rare anomalies.

[0112] As an optional embodiment, to meet the real-time requirements of industrial control systems (typically requiring a response time of less than 100ms), this application implements INT8 quantization deployment, converting FP32 weights into INT8 representations. Using INT8 quantization technology, the model size is compressed to 1 / 4 of that of FP32, resulting in a 40% improvement in inference speed.

[0113] in, and These are quantitative parameters determined using histogram statistics.

[0114] Inference speed optimization: On edge devices, INT8 quantization can improve the inference speed to below 80ms (compared to FP32's 200ms), meeting the real-time requirements of industrial control systems.

[0115] In this way, by fusing multimodal features and deep learning detection, and integrating plaintext features, statistical features, and latent features through an attention mechanism, and then inputting them into a lightweight LSTM-autoencoder model, the attention mechanism is tightly integrated with a dynamic baseline, achieving adaptive adjustment of feature weights. Simultaneously, a lightweight LSTM-autoencoder model and INT8 quantization technology are used to calculate reconstruction errors and perform anomaly classification, achieving high-precision anomaly detection and classification. This also resolves the contradiction between model complexity and computational resources, making real-time deployment of industrial control systems possible. For example, when a system overload anomaly (latent feature anomaly degree) is detected... When the attention mechanism is applied, it automatically increases the weight of latent features, making the model pay more attention to the dynamic characteristics of the system and improving classification accuracy.

[0116] As an optional embodiment, this application also includes an online adaptive training framework, which enables lightweight deployment and dynamic updates of the model through an edge-cloud collaborative architecture, ensuring that the model maintains high accuracy over long-term operation. The online adaptive training framework includes the following key steps: Edge device inference: Deploy lightweight models on edge devices (such as industrial control gateways) to handle real-time inference and anomaly detection, with a response time controlled within 100ms. Anomaly sample collection: Collect detected anomaly samples (including original feature vectors). Reconstructing feature vectors Exception type tags The abnormal samples are stored in a local buffer. Model updates are triggered when the number of abnormal samples in the local buffer exceeds a threshold. When this occurs, a model update is triggered:

[0117] Incremental Model Update: On a cloud server, the model is incrementally updated using collected outlier samples. Parameter Freeze Strategy: The first 90% of the encoder parameters are frozen, and only the attention module and classification layer are updated. Learning Rate Scheduling: Cosine annealing learning rate scheduling is used, with an initial learning rate of... Gradually reduced to Gradient clipping: To prevent gradient explosion, gradient clipping is introduced.

[0118] Model lightweighting: The updated model is lightweighted through INT8 quantization and structured pruning (removing neurons with absolute weight values ​​below a threshold) to ensure efficient deployment on edge devices. Model distribution and updating: The lightweight model is distributed to all edge devices, and the model is updated when the devices are idle to avoid affecting normal industrial control services.

[0119] The online adaptive training framework combines the real-time performance of edge computing with the computing power of cloud computing, enabling continuous model optimization. Compared to offline training, this method can continuously learn new anomaly patterns during the operation of the industrial control system, improving the model's generalization ability. For example, when a new type of encrypted communication attack occurs in the industrial control network, edge devices can detect the anomaly and collect samples. The cloud server uses these samples to update the model and then distributes it to all edge devices, achieving continuous model evolution.

[0120] The communication anomaly detection method based on multimodal feature fusion provided in this application firstly extracts multiple heterogeneous features in parallel from preprocessed industrial control communication traffic; wherein, the heterogeneous features include plaintext feature vectors, statistical feature vectors, and Laplacian latent feature vectors; then, based on the Laplacian latent feature vectors and the real-time acquired operating status of industrial control equipment, a dynamic latent feature baseline is generated through a sliding window and exponentially weighted moving average algorithm, and the latent feature anomaly degree of the current Laplacian latent feature vector is calculated based on the dynamic latent feature baseline; the multiple heterogeneous features are concatenated into a total feature vector, and the total feature vector is adaptively weighted and fused through the operating condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector; finally, the fused feature vector is input into a pre-trained autoencoder model, the reconstruction error of the fused feature vector is calculated and a reconstruction anomaly score is generated, and the reconstruction anomaly score and the latent feature anomaly degree are combined to determine whether the current industrial control communication is abnormal, and the attention weight, reconstruction error, and latent feature anomaly degree are input into a multimodal classifier to determine the target anomaly type.

[0121] This application extracts three types of information—plaintext features, statistical features, and latent features—from encrypted communication traffic to construct a dynamic latent feature baseline. It then fuses multimodal features through an attention mechanism, ultimately inputting the results into an autoencoder model to calculate the reconstruction error, thereby achieving anomaly detection and classification of encrypted communication protocols in industrial control systems. Compared to existing technologies, this application introduces Laplace latent feature mining, which can extract dynamic response characteristics of the system from encrypted traffic. This solves the problems of single feature dimensions and static baselines in traditional methods under encrypted environments. Furthermore, through dynamic weight adjustment and edge deployment optimization, it meets the real-time and computational efficiency requirements of industrial control systems.

[0122] Please see Figure 3 , Figure 3This is a schematic diagram of a communication anomaly detection device based on multimodal feature fusion, provided as an embodiment of this application. Figure 3 As shown, the communication anomaly detection device 300 based on multimodal feature fusion includes: The heterogeneous feature extraction module 301 is used to extract multiple heterogeneous features in parallel from the preprocessed industrial control communication traffic; wherein, the heterogeneous features include plaintext feature vectors, statistical feature vectors and Laplace latent feature vectors. The latent feature anomaly calculation module 302 is used to generate a dynamic latent feature baseline based on the Laplacian latent feature vector and the real-time acquired operating status of industrial control equipment, through a sliding window and exponential weighted moving average algorithm, and to calculate the latent feature anomaly of the current Laplacian latent feature vector based on the dynamic latent feature baseline. The fusion feature vector generation module 303 is used to concatenate the multiple heterogeneous features into a total feature vector, and to perform adaptive weighted fusion on the total feature vector through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fusion feature vector. Anomaly detection module 304 is used to input the fused feature vector into a pre-trained autoencoder model, calculate the reconstruction error of the fused feature vector and generate a reconstruction anomaly score, combine the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and input the attention weight, reconstruction error and latent feature anomaly degree into a multimodal classifier to determine the target anomaly type.

[0123] Furthermore, the heterogeneous feature extraction module 301 is also used to extract the plaintext feature vector through the following steps: The fixed fields of the protocol header are extracted from the industrial control communication traffic, plaintext information is extracted from the handshake process of the transport layer security protocol or the secure socket layer protocol, and the source IP address, destination IP address, port number and transport layer protocol information are extracted from the network layer. The extracted information is transformed into a 32-dimensional plaintext feature vector through a rule engine.

[0124] Furthermore, the heterogeneous feature extraction module 301 is also used to extract the statistical feature vector through the following steps: The industrial control communication traffic is converted into time series data to construct an instruction interval sequence and a data packet size sequence. The mean, variance, skewness, and kurtosis are calculated from the instruction interval sequence as time-domain features; The mean, variance, and quantiles are calculated from the data packet size sequence as range features; Extract request response time, retransmission count, and timeout rate from communication traffic as traffic pattern features; The time-domain features, the value-domain features, and the flow pattern features are extracted and encoded using a multilayer perceptron to form a 32-dimensional statistical feature vector.

[0125] Furthermore, the heterogeneous feature extraction module 301 is also used to extract the Laplacian latent feature vector through the following steps: The timestamp sequence in the industrial control communication traffic is converted into an instruction interval sequence, and an input-output sequence pair consisting of instruction sending time interval and response time interval is constructed; Based on the input-output sequence pair, the denominator polynomial coefficients and numerator polynomial coefficients of the transfer function are determined, the poles are solved, and the real and imaginary parts of the poles are extracted to form a 64-dimensional Laplace latent feature vector.

[0126] Furthermore, when the latent feature anomaly calculation module 302 is used to generate a dynamic latent feature baseline based on the Laplace latent features and the real-time acquired operating status of the industrial control equipment using a sliding window and exponentially weighted moving average algorithm, the latent feature anomaly calculation module 302 is also used for: A sliding window is set up, and the dynamic mean and dynamic standard deviation of the Laplacian latent feature vectors within the sliding window are calculated using an exponentially weighted moving average algorithm; wherein, the sliding window is used to store recently extracted Laplacian latent feature vectors, and the length of the sliding window is dynamically adjusted according to the communication cycle of the industrial control protocol; Acquire the real-time status signal of the industrial control equipment, and determine the adaptive coefficient of the operating condition based on the real-time status signal; The dynamic latent feature baseline is constructed based on the dynamic mean, the dynamic standard deviation, and the operating condition adaptive coefficient.

[0127] Furthermore, when the fusion feature vector generation module 303 is used to adaptively weight and fuse the total feature vector through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fusion feature vector, the fusion feature vector generation module 303 is also used to: The weights of different features in the total feature vector are calculated using a multi-head attention mechanism; The weights of the multi-head attention mechanism are coupled with the working condition adaptive coefficient and the latent feature anomaly degree. The total feature vector is then weighted and fused according to the calculated weights to obtain the fused feature vector.

[0128] Furthermore, when the anomaly detection module 304 is used to input the fused feature vector into the pre-trained autoencoder model, calculate the reconstruction error of the fused features and generate a reconstruction anomaly score, combine the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and determine the target anomaly type based on the attention weight, reconstruction error and latent feature anomaly degree, the anomaly detection module is also used in 304: The fused feature vector is input into the autoencoder model, the difference between the reconstructed feature vector output by the autoencoder model and the input fused feature vector is calculated, the difference is used as the reconstruction error, and a reconstruction anomaly score is generated based on the reconstruction error. When the reconstruction anomaly score exceeds the first preset threshold, or the latent feature anomaly degree exceeds the second preset threshold, the current industrial control communication is determined to be abnormal. The attention weights, the reconstruction error, and the latent feature anomaly degree are combined and input into a multimodal classifier, which outputs a probability distribution of a preset anomaly type and determines the target anomaly type based on the probability distribution.

[0129] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 400 includes a processor 410, a memory 420, and a bus 430.

[0130] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, they can perform the operations described above. Figure 1 The steps of the communication anomaly detection method based on multimodal feature fusion in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0131] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figure 1 The steps of the communication anomaly detection method based on multimodal feature fusion in the method embodiment shown are described in detail in the method embodiment, and will not be repeated here.

[0132] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0133] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0134] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0136] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A communication anomaly detection method based on multimodal feature fusion, characterized in that, The communication anomaly detection method includes: Multiple heterogeneous features are extracted in parallel from the preprocessed industrial control communication traffic; wherein, the heterogeneous features include plaintext feature vectors, statistical feature vectors, and Laplace latent feature vectors; Based on the Laplacian latent feature vector and the real-time operating status of industrial control equipment, a dynamic latent feature baseline is generated through a sliding window and exponentially weighted moving average algorithm, and the latent feature anomaly degree of the current Laplacian latent feature vector is calculated based on the dynamic latent feature baseline. The various heterogeneous features are concatenated into a total feature vector. The total feature vector is then adaptively weighted and fused using the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector. The fused feature vector is input into a pre-trained autoencoder model to calculate the reconstruction error of the fused feature vector and generate a reconstruction anomaly score. The reconstruction anomaly score and the latent feature anomaly degree are combined to determine whether the current industrial control communication is abnormal. The attention weight, reconstruction error and the latent feature anomaly degree are input into a multimodal classifier to determine the target anomaly type. The Laplacian latent feature vector is extracted using the following steps: The timestamp sequence in the industrial control communication traffic is converted into an instruction interval sequence, and an input-output sequence pair consisting of instruction sending time interval and response time interval is constructed; Based on the input-output sequence pair, the denominator polynomial coefficients and numerator polynomial coefficients of the transfer function are determined, the poles are solved, and the real and imaginary parts of the poles are extracted to form a 64-dimensional Laplace latent feature vector. The process of generating a dynamic latent feature baseline based on the Laplacian latent feature vector and the real-time acquired operating status of the industrial control equipment, using a sliding window and exponentially weighted moving average algorithm, includes: A sliding window is set up, and the dynamic mean and dynamic standard deviation of the Laplacian latent feature vectors within the sliding window are calculated using an exponentially weighted moving average algorithm; wherein, the sliding window is used to store recently extracted Laplacian latent feature vectors, and the length of the sliding window is dynamically adjusted according to the communication cycle of the industrial control protocol; Acquire the real-time status signal of the industrial control equipment, and determine the operating condition adaptive coefficient based on the real-time status signal; The dynamic latent feature baseline is constructed based on the dynamic mean, the dynamic standard deviation, and the operating condition adaptive coefficient.

2. The communication anomaly detection method according to claim 1, characterized in that, The plaintext feature vector is extracted using the following steps: The fixed fields of the protocol header are extracted from the industrial control communication traffic, plaintext information is extracted from the handshake process of the transport layer security protocol or the secure socket layer protocol, and the source IP address, destination IP address, port number and transport layer protocol information are extracted from the network layer. The extracted information is transformed into a 32-dimensional plaintext feature vector through a rule engine.

3. The communication anomaly detection method according to claim 1, characterized in that, The statistical feature vector is extracted using the following steps: The industrial control communication traffic is converted into time series data to construct an instruction interval sequence and a data packet size sequence. The mean, variance, skewness, and kurtosis are calculated as time-domain features from the instruction interval sequence; The mean, variance, and quantiles of the data packet size sequence are calculated as range features; Extract request response time, retransmission count, and timeout rate from communication traffic as traffic pattern features; The time-domain features, the value-domain features, and the flow pattern features are extracted and encoded using a multilayer perceptron to form a 32-dimensional statistical feature vector.

4. The communication anomaly detection method according to claim 1, characterized in that, The process of adaptively weighting and fusing the total feature vector through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fused feature vector includes: The weights of different features in the total feature vector are calculated using a multi-head attention mechanism; The weights of the multi-head attention mechanism are coupled with the working condition adaptive coefficient and the latent feature anomaly degree. The total feature vector is then weighted and fused according to the calculated weights to obtain the fused feature vector.

5. The communication anomaly detection method according to claim 1, characterized in that, The process involves inputting the fused feature vector into a pre-trained autoencoder model, calculating the reconstruction error of the fused feature vector, generating a reconstruction anomaly score, combining the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and determining the target anomaly type based on attention weights, reconstruction error, and latent feature anomaly degree. Specifically, this includes: The fused feature vector is input into the autoencoder model, the difference between the reconstructed feature vector output by the autoencoder model and the input fused feature vector is calculated, the difference is used as the reconstruction error, and a reconstruction anomaly score is generated based on the reconstruction error. When the reconstruction anomaly score exceeds the first preset threshold, or the latent feature anomaly degree exceeds the second preset threshold, the current industrial control communication is determined to be abnormal. The attention weights, the reconstruction error, and the latent feature anomaly degree are combined and input into a multimodal classifier, which outputs a probability distribution of a preset anomaly type and determines the target anomaly type based on the probability distribution.

6. A communication anomaly detection device based on multimodal feature fusion, characterized in that, The communication anomaly detection device includes: The heterogeneous feature extraction module is used to extract multiple heterogeneous features in parallel from the preprocessed industrial control communication traffic; wherein, the heterogeneous features include plaintext feature vectors, statistical feature vectors, and Laplace latent feature vectors. The latent feature anomaly calculation module is used to generate a dynamic latent feature baseline based on the Laplacian latent feature vector and the real-time acquired operating status of industrial control equipment, through a sliding window and exponential weighted moving average algorithm, and to calculate the latent feature anomaly of the current Laplacian latent feature vector based on the dynamic latent feature baseline. The fusion feature vector generation module is used to concatenate the various heterogeneous features into a total feature vector, and to perform adaptive weighted fusion on the total feature vector through the working condition adaptive coefficient of the dynamic latent feature baseline and the multi-head attention mechanism coupled with the latent feature anomaly degree to generate a fusion feature vector. An anomaly detection module is used to input the fused feature vector into a pre-trained autoencoder model, calculate the reconstruction error of the fused feature vector and generate a reconstruction anomaly score, combine the reconstruction anomaly score with the latent feature anomaly degree to determine whether the current industrial control communication is abnormal, and input the attention weight, reconstruction error and latent feature anomaly degree into a multimodal classifier to determine the target anomaly type. The heterogeneous feature extraction module is also used to extract the Laplacian latent feature vector through the following steps: The timestamp sequence in the industrial control communication traffic is converted into an instruction interval sequence, and an input-output sequence pair consisting of instruction sending time interval and response time interval is constructed; Based on the input-output sequence pair, the denominator polynomial coefficients and numerator polynomial coefficients of the transfer function are determined, the poles are solved, and the real and imaginary parts of the poles are extracted to form a 64-dimensional Laplace latent feature vector. When the latent feature anomaly calculation module is used to generate a dynamic latent feature baseline based on the Laplacian latent feature vector and the real-time acquired operating status of the industrial control equipment using a sliding window and exponentially weighted moving average algorithm, the latent feature anomaly calculation module is also used for: A sliding window is set up, and the dynamic mean and dynamic standard deviation of the Laplacian latent feature vectors within the sliding window are calculated using an exponentially weighted moving average algorithm; wherein, the sliding window is used to store recently extracted Laplacian latent feature vectors, and the length of the sliding window is dynamically adjusted according to the communication cycle of the industrial control protocol; Acquire the real-time status signal of the industrial control equipment, and determine the operating condition adaptive coefficient based on the real-time status signal; The dynamic latent feature baseline is constructed based on the dynamic mean, the dynamic standard deviation, and the operating condition adaptive coefficient.

7. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. The machine-readable instructions are executed by the processor to perform the steps of the communication anomaly detection method based on multimodal feature fusion as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the communication anomaly detection method based on multimodal feature fusion as described in any one of claims 1 to 5.

Images