Nuclear power plant dcs log anomaly detection method based on time interval and adaptive support degree sequence pattern mining

Abstract

An anomaly detection method for nuclear power DCS logs based on time interval and adaptive support sequence pattern mining includes: acquiring DCS controller log data; preprocessing the log data, including log parsing, log template extraction, and log annotation, to obtain structured log data, log templates, and anomaly tags; constructing log sequences, including device grouping and time interval window segmentation, converting the acquired DCS controller log data into structured sequences and dividing them into training and test sets; applying the adaptive support-enhanced Prefix Span algorithm to the training set to extract a global frequent pattern database; and performing anomaly detection on the test set based on the global frequent pattern database. This method overcomes the shortcomings of existing technologies that often ignore the inherent event logic and rhythm of the system, and can generate high-quality and semantically clear input samples, thus ensuring the effectiveness of subsequent frequent pattern mining from the data source and significantly improving the accuracy of the mining results.

Description

Technical Field

[0001] This invention relates to the field of log anomaly detection technology, specifically to a method for detecting anomalies in nuclear power plant DCS logs based on time intervals and adaptive support sequence pattern mining. Background Technology

[0002] Nuclear energy, as a crucial component of the global clean and low-carbon energy system, demands its safe and stable operation. Modern nuclear power plants extensively rely on distributed control systems (DCS), which serve as the "central nervous system" for achieving plant automation and safety protection. The DCS not only continuously monitors the plant's operational status but also executes critical operations such as reactor tripping in emergency situations. Therefore, any failure in the DCS can lead to unplanned shutdowns, substantial economic losses, and even serious safety accidents, making efficient DCS maintenance essential for ensuring overall operational reliability.

[0003] In a DCS architecture, process control stations and their core logic processing units—controllers—play a central role in the system's monitoring and control functions. These controllers generate massive amounts of logs during operation, containing invaluable equipment status and alarm information, serving as an indispensable data source for fault diagnosis and system health monitoring. However, the analysis of these logs currently relies primarily on manual processing. Given the sheer scale and complexity of the data, this traditional method is not only inefficient but also prone to omissions. Therefore, there is an urgent need to develop automated anomaly detection algorithms to drive the modernization and intelligentization of DCS maintenance methods.

[0004] Logs are essentially time series of events. Given that normal system behavior typically exhibits periodic patterns, anomaly detection methods based on frequent sequence mining have become an ideal technological paradigm. In the field of Industrial Control Systems (ICS), this approach has evolved from early methods using sequence pattern mining for direct anomaly identification or alarm management, to the introduction of the Minimum Description Length (MDL) principle to mitigate pattern explosion and accurately capture time constraints. Meanwhile, process mining, as another technological approach, has demonstrated significant advantages in handling complex attacks and anomalies due to its ability to automatically reconstruct behavioral models from logs and identify deviations through consistency checks.

[0005] However, the aforementioned methods largely rely on general data mining frameworks or process models, lacking specific adaptation to the data characteristics of safety-critical systems such as nuclear power plant DCS. Faced with specific challenges such as maintaining a complete chain of operational events in DCS logs and significant heterogeneity among controllers, commonly used fixed-window schemes or static threshold mechanisms are no longer sufficient to meet practical needs. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a method for anomaly detection in nuclear power DCS logs based on time interval and adaptive support sequence pattern mining. First, the raw DCS logs are preprocessed. A Drain parser extracts log templates representing event types from the log data, mapping each log message to a unique template identifier (template ID) and separating the corresponding fields (log occurrence time, device name, log message, etc.). Then, the logs are grouped according to device, and a time interval window is used to construct log sequences, converting the DCS logs into structured sequences. A high-quality global frequent pattern database is mined using an adaptive support-enhanced Prefix Span algorithm. Finally, this global frequent pattern database is used to perform anomaly detection on the test set.

[0007] The technical solution adopted in this invention is as follows:

[0008] A method for anomaly detection in nuclear power plant DCS logs based on time interval and adaptive support sequence pattern mining includes the following steps: Step 1: Obtain DCS controller log data; Step 2: Preprocess the log data, including log parsing, log template extraction, and log annotation, to obtain structured log data, log templates, and exception tags; Step 3: Construct log sequences, including device grouping and time interval window segmentation. Convert the DCS controller log data obtained in Step 1 into structured sequences and segment them into training and test sets. Step 4: Apply the adaptive support-enhanced Prefix Span algorithm to the training set to extract the global frequent pattern database; Step 5: Perform anomaly detection on the test set based on the global frequent pattern database; Step 6: Evaluation of the anomaly detection method.

[0009] In step 1, real DCS controller log data of the nuclear power plant is collected over a certain period of time.

[0010] Step 2 includes: 2.1: Log parsing and log template extraction: Based on the raw logs obtained in step 1, the Drain parser is used to process them, aiming to transform the unstructured raw text into structured log data.

[0011] The Drain parser constructs log templates by identifying constants in the log text, thereby extracting features representing event types from seemingly messy text and mapping each log message to a unique template identifier (Template_ID). Simultaneously, the parsing process also segments key information fields such as log occurrence time and device name. As shown in the anonymized example of parsed logs in Table 1, the log template obtained after parsing the original log is the content of the Text column, which is matched with a unique Template_ID. Ultimately, all logs are standardized into eight attribute columns: Date, Time, Device, Device_info, Display, Code, Text, and Template_ID, completing the transformation from raw text to structured data.

[0012]

[0013] 2.2: Log annotations: Log labeling specifically refers to marking the abnormal attributes of logs after parsing. A two-stage method of keyword matching and human expert review is used for anomaly labeling. In the first stage, candidate abnormal logs are extracted based on the keywords "fail," "disable," "alarm," and "error." In the second stage, three experienced DCS operation and maintenance experts (each with more than five years of relevant experience) independently review and label the candidate abnormal logs. Only those candidate abnormal logs that are unanimously identified as abnormal by all three experts are included in the final experience anomaly set and labeled with an anomaly tag. According to this rule, a status tag indicating "normal" or "abnormal" is added to each log, ultimately forming a structured log with anomaly tags.

[0014] Step 3 includes: 3.1: Equipment Grouping: After obtaining the structured log sequence, the logs are grouped according to the device name (Device_info) in Table 1, and an independent behavior sequence is constructed for each device. The full log data is divided into several independent device log subsets. Within each device log subset, the log entries are strictly sorted in ascending order of time based on the timestamp information recorded in the Date and Time fields to ensure the causal order of events.

[0015] 3.2: Time interval window segmentation: After grouping the devices, the application time interval window divides the log subset of each device into a structured sequence. The steps are as follows: For all logs of each device sorted in ascending order of timestamps, it can be represented as and its corresponding timestamp .in, These represent the types of log events (i.e., Template_ID) that occur sequentially on the device over time. This represents the template identifier corresponding to the first log entry for this device. This represents the template identifier corresponding to the last log entry. These represent the generation timestamps corresponding to the logs mentioned above, i.e. Representative Log The moment of occurrence, Representative Log The timing of the occurrence of the event and the strict one-to-one correspondence between the two.

[0016] Define time interval threshold Starting from the first log entry, iterate through the logs sequentially; if the current log entry... And the next log The time interval between ( Less than or equal to Then it is believed and They belong to the same sequence. When encountering an interval ( (greater than) At that time, the current sequence is in Termination at this point, new sequence from Begin. This process iterates through all the device's logs, producing a continuous sequence of structured logs. , These represent the structured subsequences obtained after dividing the time interval window, i.e. The first subsequence obtained by segmentation, This is the k-th subsequence.

[0017] This operation is performed independently for all devices. The above-mentioned time interval window method is used to divide the log subset of each device into structured sequences. Finally, the structured sequence samples generated by all devices are aggregated to form a global structured log sequence set.

[0018] 3.3: Dividing the training set and the test set: In a structured log sequence, any sequence containing an anomalous label is defined as an anomalous sequence; otherwise, it is considered a normal sequence. All normal sequences in the global structured log sequence set are randomly divided into two parts: 80% is used to construct the training set, and the test set consists of the remaining 20% ​​of normal sequences and all anomalous sequences; the 20% of normal sequences are used to evaluate the model's ability to recognize normal behavior, while the anomalous sequences are used to evaluate its ability to detect anomalies.

[0019] In step 4, the adaptive support-enhanced Prefix Span algorithm refers to a hierarchical sequence pattern mining strategy. First, the standard PrefixSpan algorithm is used to independently mine at the device level to preserve the local features of low-frequency devices. Then, a log-normalized weighting mechanism based on device log volume is introduced to assign dynamic weights to devices of different sizes, and the weighted global support of each candidate pattern in all devices is calculated. Finally, the global threshold is adaptively determined based on the statistical distribution of the weighted support scores of all candidate modes.

[0020] Step 4 includes: 4.1: Device-based closed-pattern mining: Using the training set obtained from step 3, a combination of closed-pattern mining and minimum length constraint is independently performed on each device. A variant of Prefix Span, and uses a relative support threshold to generate a set of local closure patterns for each device; For equipment Its local closed pattern set Defined as: (1); in: Representation and Closed Pattern Mining and minimum length constraint Integrated prefix span algorithm, specifically referring to constraint conditions ; Representative equipment sequence set; This represents its relative support threshold.

[0021] 4.2: Global Pattern Aggregation and Filtering: For each device, the logarithm based on the number of sequences is calculated as the normalized weight, as follows: For equipment Its normalized weight Defined as: (2); in: Representative equipment sequence set; This indicates the total number of sequences used for this device.

[0022] (3); in: It is the total number of devices; logarithmic function This is used to smooth out large differences in the number of sequences between different devices, preventing devices with high log volumes from dominating the weight distribution. The constant 1 ensures that when... The mathematical definition still holds true when the value is 0.

[0023] Using normalized weights, a weighted global support is calculated for each candidate pattern mined from all devices. The calculation method is as follows: For candidate modes Its equipment The local support ratio is defined as follows: (4); in: It is a candidate mode exist The absolute number of times it appears in the text.

[0024] Candidate mode global support Defined as: (5); Finally, the global threshold is determined based on the distribution of weighted support scores for all candidate modes. : (6); Where: function ) indicates the calculation of percentiles; It is the set of all candidate patterns; p is the given percentile parameter.

[0025] Patterns that meet this global threshold form the final global frequent pattern database. As a normal behavioral pattern: (7).

[0026] Step 5 includes: 5.1: Determining anomaly detection thresholds based on normal behavior patterns: for Each mode in , calculation mode and all other patterns in the global frequent pattern database The normalized edit distance (NED) between them is mathematically represented as: (8); Where: function This represents the edit distance between two strings, indicating the absolute amount of the difference; function Indicates the maximum possible edit distance.

[0027] For each mode The minimum distance from it to any other pattern is represented as All The values ​​constitute a distribution This represents the inherent closeness between normal behavioral patterns.

[0028] Anomaly detection threshold Defined as distribution High percentile: , p) (9; Where: function ) indicates calculation of percentiles; p is the percentile parameter; anomaly detection threshold. This threshold represents the maximum permissible degree of natural deviation under normal operating conditions. When the distance between a newly input sequence and the normal behavior pattern exceeds this threshold, the deviation is considered a significant departure from the normal distribution, thus identifying the input sequence as an anomalous sequence.

[0029] 5.2: Anomaly Decision-Making for the Test Set: During the anomaly detection phase, for each sequence to be detected in the test set... Perform the following steps: Calculate the sequence to be detected With normal pattern set The normalized edit distance for each pattern P is calculated using the following formula: (10); Where: function This represents the edit distance between two strings, indicating the absolute amount of the difference; function Indicates the maximum possible edit distance.

[0030] Iterate through all calculated normalized edit distances and select the minimum value as the minimum normalized edit distance of the sequence to be detected. The formula is as follows: (11); Where: the function NED() represents the normalized edit distance; Represents the test sequence Deviation from the overall global frequent pattern database It is all normal behavioral patterns A set of.

[0031] If this minimum normalized edit distance exceeds the anomaly detection threshold Then this sequence to be detected If a sequence is identified as abnormal, it is classified as normal.

[0032] The final judgment rule is as follows: abnormal: (12); normal: (13); Step 6: Evaluation of the anomaly detection method: Using accuracy ( Precision ), recall rate ( Recall ), F1 score ( F1 score These three evaluation metrics are used to comprehensively evaluate the anomaly detection performance of the TA-Prefix Span-AD method.

[0033] Accuracy ( Precision The ) represents the proportion of actual abnormal sequences among the abnormal sequences predicted by the anomaly detection method, calculated using the following formula: (14); in: Indicates a true positive result. This indicates a false positive.

[0034] Recall rate ( Recall The percentage of actual abnormal sequences correctly detected by the anomaly detection method out of all actual abnormal sequences is represented by the following formula: (15); in: Indicates a true positive result. This indicates a false negative.

[0035] F1 score ( F1 score The harmonic mean of precision and recall is calculated using the following formula: (16).

[0036] This invention discloses a method for anomaly detection in nuclear power plant DCS logs based on time interval and adaptive support sequence pattern mining, with the following technical effects: 1) The time interval window division method proposed in this invention is based on the core characteristics of the log events within a transaction in a nuclear power DCS system having temporal continuity and significant time intervals between different transactions, and achieves natural and accurate segmentation of the log sequence according to the operation cycle.

[0037] 2) This method overcomes the shortcomings of existing technologies that often ignore the inherent event logic and rhythm of the system, and can generate high-quality and semantically clear input samples, thereby ensuring the effectiveness of subsequent frequent pattern mining from the data source and significantly improving the accuracy of the mining results.

[0038] 3) This invention proposes a pattern mining method (T-) based on the Prefix Span algorithm that is more suitable for nuclear power plant DCS logs. A-PrefixSpan). By combining closed-pattern mining to eliminate redundancy, implementing minimum length constraints to filter noise, and adaptive support mechanisms to balance device differences, a high-quality library of normal and frequent patterns was constructed, laying the foundation for accurate anomaly detection.

[0039] 4) The method of this invention successfully overcomes the key technical challenges faced by standard algorithms when applied to real nuclear power DCS logs, such as high pattern redundancy, large short pattern noise interference, and difficulty in adapting to differences between devices, thereby significantly improving the practicality and accuracy of the mining results.

[0040] 5) The anomaly detection threshold determined by the global frequent pattern database in this invention can adapt to changes in the data, ensuring that the most important patterns are always selected regardless of the overall score of the data.

[0041] 6) This invention has conducted in-depth research on the various parameters of the algorithm ( , , , By fine-tuning the coupling relationship and interaction mechanism between the parameters, the optimal parameter configuration was determined, thereby giving the algorithm excellent overall anomaly detection performance and ensuring its effectiveness and robustness in anomaly detection tasks. Attached Figure Description

[0042] The present invention will be further described below with reference to the accompanying drawings and examples; Figure 1 Example diagram of the original DCS controller log with sensitive information masked.

[0043] Figure 2 This is a diagram of the DCS controller log TA-PrefixSpan framework.

[0044] Figure 3 This is a comparison chart of the optimal detection performance indicators at different time intervals. Detailed Implementation

[0045] A method for anomaly detection in nuclear power plant DCS logs based on time interval and adaptive support sequence pattern mining is proposed. First, the raw nuclear power plant controller logs are preprocessed to obtain structured logs. Then, the logs are grouped according to the device, and a time interval window is applied to segment the log substream of each device into sequences, resulting in log sequences for all devices. Next, an adaptive support-enhanced Prefix Span algorithm is applied to extract frequent patterns from the training set. Then, an anomaly detection threshold is determined based on the obtained normal pattern set. Finally, the distance from the test sequence to each pattern in the normal pattern set is calculated, the minimum normalized edit distance is found, and the test sequence is classified into normal and anomaly categories according to the judgment rules. This invention utilizes time interval windows and closed pattern mining to implement constraints, combined with an adaptive support strategy based on device weights, effectively solving the limitations of traditional log detection methods in anomaly detection of nuclear power plant DCS logs. It significantly improves the accuracy, recall, and F1 composite index of anomaly detection, and its application can improve the utilization rate of nuclear power plant DCS log data. The method includes the following steps: S1: Obtain DCS controller log data: We selected actual DCS controller logs from the nuclear power plant, including a total of 870,413 raw log entries from March 3, 2022 to November 8, 2023. For example... Figure 1 As shown, the nuclear power plant's DCS log is a semi-structured sequential record.

[0046] S2: Preprocess the log data, including the following steps: S2.1: Log parsing and log template extraction.

[0047] Based on the raw logs obtained from S1, the Drain parser is used to process them, aiming to transform unstructured raw text into structured log data. The Drain parser constructs log templates by identifying constant parts in the log text, thereby extracting features representing event types from the seemingly messy text and mapping each log message to a unique template identifier (Template_ID). Simultaneously, the parsing process also performs field segmentation for key information such as log occurrence time and device name. Table 2 shows an anonymous example of the generated parsed logs. Each log message in the table, after parsing, yields a log template in the Text column, which is matched with a unique Template_ID. Ultimately, all logs are standardized to eight attribute columns: Date, Time, Device, Device_info, Display, Code, Text, and Template_ID, completing the transformation from raw text to structured data.

[0048]

[0049] S2.2: Log annotation: A two-stage approach, combining keyword matching and human expert review, is employed for anomaly labeling. In the first stage, candidate anomaly logs are extracted based on the keywords "fail," "disable," "alarm," and "error." In the second stage, three experienced DCS operation and maintenance experts (each with over five years of relevant experience) independently review and label the candidate anomaly logs. Only those candidate anomaly logs unanimously identified as anomaly by all three experts are included in the final experienced anomaly set and tagged with anomalies. Based on this rule, a status label indicating "normal" or "abnormal" is added to each log entry, ultimately forming a structured log with anomaly labels.

[0050] S3: Construct log sequences, including device grouping and time interval window segmentation, to convert DCS logs into structured sequences.

[0051] S3.1: Equipment Grouping: After obtaining the structured log sequences, the logs are grouped according to the device names (Device_info) in Table 2, constructing an independent behavior sequence for each device, thus dividing the full log data into several independent device log subsets. Within each device log subset, log entries are strictly sorted in ascending order of time based on the timestamp information recorded in the Date and Time fields to ensure the causal sequence of events. Finally, the data is divided into 128 groups corresponding to the controllers.

[0052]

[0053] S3.2: Time interval window segmentation: After grouping the devices, the application time interval window divides the log subset of each device into a structured sequence. The steps are as follows: For all logs of each device sorted in ascending order of timestamps, it can be represented as and its corresponding timestamp .in, These represent the types of log events (i.e., Template_ID) that occur sequentially on the device over time. This represents the template identifier corresponding to the first log entry for this device. This represents the template identifier corresponding to the last log entry. These represent the generation timestamps corresponding to the logs mentioned above, i.e. Representative Log The moment of occurrence, Representative Log The timing of the occurrence of the event and the strict one-to-one correspondence between the two.

[0054] Define time interval threshold Starting from the first log entry, iterate through the logs sequentially; if the current log entry... And the next log The time interval between ( Less than or equal to Then it is believed and They belong to the same sequence. When encountering an interval ( (greater than) At that time, the current sequence is in Termination at this point, new sequence from Begin. This process iterates through all the device's logs, producing a continuous sequence of structured logs. , These represent the structured subsequences obtained after dividing the time interval window, i.e. The first subsequence obtained by segmentation, This is the k-th subsequence.

[0055] This operation is performed independently for all devices. The above-mentioned time interval window method is used to divide the log subset of each device into structured sequences. Finally, the structured sequence samples generated by all devices are aggregated to form a global structured log sequence set.

[0056] Based on domain expert knowledge and the typical duration of nuclear power plant operation logs, the logs are divided into five time interval parameters. The time intervals were divided into (20, 40, 60, 80, 100 min) as shown in Table 4, in order to study the optimal time. .

[0057]

[0058] S3.3: Divide the training set and the test set: In a structured log sequence, any sequence containing an anomaly label is defined as an anomalous sequence; otherwise, it is considered a normal sequence. All normal sequences in the global structured log sequence set are randomly divided into two parts: 80% is used to construct the training set, and the remaining 20% ​​(normal sequences) and all anomalous sequences constitute the test set. The 20% of normal sequences are used to evaluate the model's ability to recognize normal behavior, while the anomalous sequences are used to evaluate its ability to detect anomalies. Table 4 shows the five time interval parameters. The number of training set sequences and the number of test set sequences under the (20, 40, 60, 80, 100min) segmentation.

[0059] S4: Apply the adaptive support-enhanced Prefix Span algorithm to the training set to extract frequent patterns: The adaptive support-enhanced Prefix Span algorithm is a hierarchical sequence pattern mining strategy. First, it uses the standard PrefixSpan algorithm to independently mine at the device level to preserve the local features of low-frequency devices. Then, it introduces a log-normalized weighting mechanism based on device log volume to assign dynamic weights to devices of different sizes, calculating the weighted global support of each candidate pattern across all devices. Finally, based on the statistical distribution of the weighted support scores of all candidate patterns, it adaptively determines the global threshold.

[0060] S4 includes the following steps: S4.1: Equipment-based closed-mode mining: Using the training set obtained from S3, a method combining closed-pattern mining and minimum length constraints is independently performed on each device. A variant of Prefix Span using a relative support threshold, which will generate a set of local closure patterns for each device. For each device... Its local closed pattern set Defined as: ; in: Representation and Closed Pattern Mining and minimum length constraint Integrated prefix span algorithm, specifically referring to constraint conditions ; Representative equipment sequence set; This represents its relative support threshold.

[0061] S4.2: Global Pattern Aggregation and Filtering: For each device, a logarithm based on the number of sequences is calculated as a normalized weight. The calculation method is as follows: For equipment Its normalized weight Defined as: ; in: Representative equipment sequence set; This indicates the total number of sequences used for this device.

[0062] ; in: It is the total number of devices, logarithmic function This is used to smooth out large differences in the number of sequences between different devices, preventing devices with high log volumes from dominating the weight distribution. The constant 1 ensures that when... The mathematical definition still holds true when the value is 0.

[0063] Using normalized weights, a weighted global support is calculated for each candidate pattern mined from all devices. The calculation method is as follows: For candidate modes Its equipment The local support ratio is defined as follows: ; in: yes exist The absolute number of times it appears in the text.

[0064] Candidate mode global support Defined as: ; Finally, the global threshold is determined based on the distribution of weighted support scores for all candidate modes. : ; Where: function ) indicates the calculation of percentiles; It is the set of all candidate patterns; p is the given percentile parameter.

[0065] Patterns that meet this global threshold form the final global frequent pattern database. As a normal behavioral pattern: ; S5: Perform anomaly detection on the test set based on a global frequent pattern database: S5 includes the following steps: S5.1: Determine the anomaly detection threshold based on normal behavior patterns: for Each mode in , calculation mode and all other patterns in the global frequent pattern database The normalized edit distance (NED) between them. Its mathematical representation is: ; Where: function This represents the edit distance between two strings, indicating the absolute amount of the difference; function Indicates the maximum possible edit distance.

[0066] For each mode The minimum distance from it to any other pattern is represented as All The values ​​constitute a distribution This represents the inherent closeness between normal behavioral patterns.

[0067] Anomaly detection threshold Defined as distribution High percentile: , p) ; Where: function This indicates the calculation of percentiles, where p is the percentile parameter. Anomaly detection threshold. This threshold represents the maximum permissible degree of natural deviation under normal operating conditions. When the distance between a newly input sequence and the normal behavior pattern exceeds this threshold, the deviation is considered a significant departure from the normal distribution, thus identifying the input sequence as an anomalous sequence.

[0068] S5.2: Exception Decisions for the Test Set: During the anomaly detection phase, for each sequence to be detected in the test set... Perform the following steps: Calculate the sequence to be detected With normal pattern set The normalized edit distance for each pattern P is calculated using the following formula: ; Where: function This represents the edit distance between two strings, indicating the absolute amount of the difference; function Indicates the maximum possible edit distance.

[0069] Iterate through all calculated normalized edit distances and select the minimum value as the minimum normalized edit distance of the sequence to be detected. The formula is as follows: ; Where: the function NED() represents the normalized edit distance; Represents the test sequence Deviation from the overall global frequent pattern database It is all normal behavioral patterns A set of.

[0070] If this minimum normalized edit distance exceeds the anomaly detection threshold The sequence to be tested is then classified as an abnormal sequence; otherwise, it is classified as a normal sequence.

[0071] The final judgment rule is as follows: abnormal: ; normal: ; S6: Evaluation of anomaly detection methods: Using accuracy ( Precision ), recall rate ( Recall ), F1 score ( F1 score These three evaluation metrics are used to comprehensively evaluate the anomaly detection performance of the TA-Prefix Span-AD method.

[0072] Accuracy ( Precision The ) represents the proportion of actual abnormal sequences among the abnormal sequences predicted by the anomaly detection method, calculated using the following formula: ; in Indicates a true positive result. This indicates a false positive.

[0073] Recall rate ( Recall The percentage of actual abnormal sequences correctly detected by the anomaly detection method out of all actual abnormal sequences is represented by the following formula: ; in Indicates a true positive result. This indicates a false negative.

[0074] F1 score ( F1 score The harmonic mean of precision and recall is calculated using the following formula: ; Table 5 shows the optimal parameter configuration ( , =5-6%, =95%, The confusion matrix (93-94%) visually illustrates the model's predictions for 3554 test sequences. The confusion matrix shows that, with optimal parameter configuration, the model correctly identified 1594 anomalous sequences (TP) and 1374 normal sequences (TN), while generating 329 false positives (FP) and 257 false negatives (FN). The resulting key metrics are: accuracy 0.83, recall 0.86, F1 score 0.84, and precision 0.83. These results demonstrate that TA-PrefixSpan-AD exhibits strong overall anomaly detection performance.

[0075]

[0076] Table 6 presents the results of the ablation study on TA-PrefixSpan-AD, based on the complete model configuration ( , =5-6%, =95%, =93-94%). The results demonstrate that the performance of TA-Prefix Span-AD (F1=0.84) cannot be attributed solely to the time interval window or the adaptive support mechanism, but rather to their synergistic integration. The time interval window ensures the extraction of sequential patterns from semantically coherent time intervals, while the adaptive support threshold tailors the mining process based on the frequency characteristics of each device. This combination effectively addresses the dual challenges of inherent temporal irregularities and frequency heterogeneity in industrial control system logs.

[0077]

[0078] Figure 3 This chart compares the optimal detection performance metrics across different time intervals. It shows the best precision, recall, and F1 score obtained for all parameter combinations within each time interval window. These results demonstrate that smaller... Values ​​(20-40 minutes) may cause the sequence to split too frequently, disrupting the complete event chain and thus reducing accuracy; while larger values... Values ​​(60-100 minutes) can capture more complete behavioral patterns, thus significantly improving recall. It achieves the best balance between accuracy and recall in 80 minutes, resulting in the highest F1 score.

[0079] This invention employs a time interval window instead of the traditional window, using the time interval between consecutive logs as the dividing point, thus preserving the complete event chain. In the pattern mining phase, it enhances the classic Prefix Span algorithm by integrating closed pattern mining to eliminate redundancy, implementing minimum length constraints to filter noise, and designing an adaptive support mechanism that fairly evaluates the global importance of patterns through device weights. Ultimately, this constructs a high-quality library of normal behavior patterns, thereby supporting accurate anomaly detection.

Claims

1. A method for anomaly detection in nuclear power plant DCS logs based on time interval and adaptive support sequence pattern mining, characterized in that... Includes the following steps: Step 1: Obtain DCS controller log data; Step 2: Preprocess the log data, including log parsing, log template extraction, and log annotation, to obtain structured log data, log templates, and exception tags; Step 3: Construct log sequences, including device grouping and time interval window segmentation. Convert the DCS controller log data obtained in Step 1 into structured sequences and divide them into training and test sets. Step 4: Apply the adaptive support-enhanced Prefix Span algorithm to the training set to extract the global frequent pattern database; Step 5: Perform anomaly detection on the test set based on the global frequent pattern database.

2. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 1, characterized in that: Step 2 includes: log parsing and log template extraction. Based on the raw logs obtained in step 1, the Drain parser is used to process them, transforming the unstructured raw text into structured log data.

3. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 2, characterized in that: The Drain parser constructs log templates by recognizing constant parts in the log text, extracts features representing event types from the text, and maps each log message to a unique template identifier (Template_ID). At the same time, the parsing process also implements field segmentation of key information such as log occurrence time and device name.

4. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 3, characterized in that: Step 2 also includes: log annotation: Log labeling specifically refers to marking the abnormal attributes of logs after parsing. A two-stage method of keyword matching and human expert review is used for anomaly labeling. In the first stage, candidate abnormal logs are extracted based on the keywords "fail", "disable", "alarm", and "error". In the second stage, multiple DCS operation and maintenance experts independently review and label the candidate abnormal logs. Only candidate abnormal logs that are unanimously identified as abnormal by multiple DCS operation and maintenance experts are included in the final experience anomaly set and labeled with an anomaly tag. According to this rule, a status tag indicating "normal" or "abnormal" is added to each log, ultimately forming a structured log with anomaly tags.

5. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 4, characterized in that: In step 3, the device grouping specifically includes: After obtaining the structured log sequence, the logs are grouped according to the device name (Device_info), and an independent behavior sequence is constructed for each device. The full log data is divided into several non-interfering device log subsets. In each device log subset, the log entries are strictly sorted in ascending order of time according to the timestamp information recorded in the Date and Time fields to ensure the causal order of events.

6. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 5, characterized in that: In step 3, the time interval window segmentation is specifically as follows: After grouping the devices, the application time interval window divides the log subset of each device into a structured sequence; the steps are as follows: For all logs of each device sorted in ascending order of timestamps, it can be represented as and its corresponding timestamp ;in, These represent the types of log events (i.e., Template_ID) that occur sequentially on the device over time. This represents the template identifier corresponding to the first log entry for this device. This represents the template identifier corresponding to the last log entry. These represent the generation timestamps corresponding to the logs mentioned above, i.e. Representative Log The moment of occurrence, Representative Log The timing of the occurrence, and there is a strict one-to-one correspondence between the two; Define time interval threshold Starting from the first log entry, iterate through the logs sequentially; if the current log entry... And the next log The time interval between ( Less than or equal to Then it is believed and Belonging to the same sequence; when encountering an interval ( (greater than) At that time, the current sequence is in Termination at this point, new sequence from Begin; this process iterates through all the device's logs, producing a continuous sequence of structured logs. , These represent the structured subsequences obtained after dividing the time interval window, i.e. The first subsequence obtained by segmentation, This is the k-th subsequence; By applying the time interval window method described above, the log subset of each device is divided into structured sequences. Finally, the structured sequence samples generated by all devices are aggregated to form a global structured log sequence set.

7. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 6, characterized in that: In step 3, the training set and the test set are divided as follows: A structured sequence is defined as an anomalous sequence if it contains logs with anomaly labels, and otherwise as a normal sequence. All normal sequences in the global structured log sequence set are randomly divided into two parts: 80% are used to build the training set; the test set consists of the remaining 20% ​​of normal sequences and all anomalous sequences; the 20% of normal sequences are used to evaluate the model's ability to recognize normal behavior, and the anomalous sequences are used to evaluate its ability to detect anomalies.

8. The nuclear power plant DCS log anomaly detection method based on time interval and adaptive support sequence pattern mining according to claim 7, characterized in that: Step 4 includes: 4.1: Device-based closed-pattern mining: Using the training set obtained from step 3, a combination of closed-pattern mining and minimum length constraint is independently performed on each device. A variant of Prefix Span, and uses a relative support threshold to generate a set of local closure patterns for each device; For equipment Its local closed pattern set Defined as: （1）； in: Representation and Closed Pattern Mining and minimum length constraint Integrated prefix span algorithm; Representative equipment sequence set; This represents its relative support threshold; 4.2: Global Pattern Aggregation and Filtering: For each device, the logarithm based on the number of sequences is calculated as the normalized weight, as follows: For equipment Its normalized weight Defined as: （2）； in: Representative equipment sequence set; This indicates the total number of sequences used for this device; （3）； in: It is the total number of devices; logarithmic function Used to smooth out large differences in the number of sequences between different devices; Using normalized weights, a weighted global support is calculated for each candidate pattern mined from all devices, as follows: For candidate modes Its equipment The local support ratio is defined as follows: （4）； in: It is a candidate mode exist The absolute number of occurrences in; Candidate mode global support Defined as: （5）； Finally, the global threshold is determined based on the distribution of weighted support scores for all candidate modes. : （6）； Where: function ) indicates the calculation of percentiles; It is the set of all candidate patterns; p is the given percentile parameter; Patterns that meet this global threshold form the final global frequent pattern database. As a normal behavioral pattern: （7）。 9. The method for anomaly detection in nuclear power plant DCS logs based on time interval and adaptive support sequence pattern mining according to claim 8, characterized in that: Step 5 includes: 5.1: Determining anomaly detection thresholds based on normal behavior patterns: for Each mode in , calculation mode and all other patterns in the global frequent pattern database The normalized edit distance (NED) between them is mathematically represented as: （8）； Where: function This represents the edit distance between two strings, indicating the absolute amount of the difference; function Indicates the maximum possible edit distance; For each mode The minimum distance from it to any other pattern is represented as All The values ​​constitute a distribution This represents the inherent closeness between normal behavioral patterns; Anomaly detection threshold Defined as distribution High percentile: , p) （9）； Where: function ) indicates calculation of percentiles; p is the percentile parameter; anomaly detection threshold. It characterizes the maximum allowable degree of natural deviation under normal operating conditions; when the distance between a new input sequence and the normal behavior pattern exceeds this threshold, the deviation is judged as a significant deviation from the normal distribution, thus identifying the input sequence as an abnormal sequence; 5.2: Anomaly Decision-Making for the Test Set: During the anomaly detection phase, for each sequence to be detected in the test set... Perform the following steps: Calculate the sequence to be detected With normal pattern set The normalized edit distance for each pattern P is calculated using the following formula: （10）； Where: function This represents the edit distance between two strings, indicating the absolute amount of the difference; function Indicates the maximum possible edit distance; Iterate through all calculated normalized edit distances and select the minimum value as the minimum normalized edit distance of the sequence to be detected. The formula is as follows: （11）； Where: the function NED() represents the normalized edit distance; Represents the test sequence Deviation from the overall global frequent pattern database It is all normal behavioral patterns A set; If this minimum normalized edit distance exceeds the anomaly detection threshold Then this sequence to be detected If a sequence is identified as abnormal, it is otherwise classified as normal. The final judgment rule is as follows: abnormal: (12); normal: (13).

10. The method for anomaly detection in nuclear power plant DCS logs based on time interval and adaptive support sequence pattern mining according to claim 9, characterized in that: It also includes step 6: evaluation of the anomaly detection method: Using accuracy ( Precision ), recall rate ( Recall ), F1 score ( F1 score These three evaluation metrics are used to comprehensively evaluate the anomaly detection performance of the TA-Prefix Span-AD method; Accuracy ( Precision The ) represents the proportion of actual abnormal sequences among the abnormal sequences predicted by the anomaly detection method, calculated using the following formula: （14）； in: Indicates a true positive result. This indicates a false positive. Recall rate ( Recall The percentage of actual abnormal sequences correctly detected by the anomaly detection method out of all actual abnormal sequences is represented by the following formula: （15）； in: Indicates a true positive result. Indicates a false negative; F1 score ( F1 score The harmonic mean of precision and recall is calculated using the following formula: （16）。

Images