A dynamic threshold anomaly detection method for industrial control system based on physical constraints

Abstract

The application provides a kind of dynamic threshold exception detection method of industrial control system based on physical constraint, it is related to industrial control safety exception detection technical field.The method provided by the application comprises: defining standardized physical event rules according to the operation logic of actuator, and constructing physical consistency rules based on the differential equation and conservation relation of each physical variable in the system, and fusing the two types of rules into rule twin model;Meanwhile, introduce the dynamic self-adaptive detection mechanism of sliding window statistics and high-low double threshold value.The application can accurately identify multiple types of anomalies such as sudden attack, gradual hidden attack and actuator logic tampering, and clearly identify the corresponding physical process of anomaly, significantly improve the real-time, accuracy and interpretability of industrial control system anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security anomaly detection technology, and in particular to a dynamic threshold anomaly detection method for industrial control systems based on physical constraints. Background Technology

[0002] Anomaly detection in industrial control systems differs fundamentally from general data analysis tasks. Its operation is highly dependent on physical laws, process constraints, and the causal relationships between sensors and actuators. Variables in industrial control systems primarily include sensor measurement data and actuator status data. Attacks targeting this physical domain data can be broadly categorized into three types: actuator logical violation attacks, where attackers cause actuator commands to contradict current physical conditions, potentially leading to serious consequences such as equipment damage and material leakage; sudden sensor tampering, which simulates hardware failures through instantaneous and drastic jumps, inducing incorrect controller responses; and gradual stealth attacks, which apply small, long-term offsets to sensors, slowly distorting the system state within normal fluctuation ranges, making them highly concealed and difficult to detect early using traditional threshold and statistical methods. Currently, there are two main technical approaches to industrial control anomaly detection methods based on deep learning: one is a reconstruction-based approach, such as OmniAnomaly, which uses a GRU to capture time dependencies, performs probabilistic modeling of multivariate distributions through variational autoencoders and state-space models, and determines anomalies by comparing the deviation between the reconstructed values ​​and the true values; the other is a prediction-based approach, such as the NSIBF framework, which uses a neural network to model time-series data into a hidden state-space model, and then uses an unscented Kalman filter to recursively estimate the hidden states, assessing the degree of anomaly based on observation likelihood, and has better robustness to process noise and observation noise.

[0003] However, existing methods have the following drawbacks: (1) insufficient ability to detect progressive stealth attacks, as they are difficult to capture long-term cumulative offsets due to instantaneous deviations or short-term distribution differences; (2) poor anomaly localization ability, only outputting overall deviation indicators and failing to distinguish specific physical links or variables; (3) reliance on static statistical thresholds and fixed time windows, making it difficult to adapt to non-stationary dynamic characteristics such as operating condition switching and load changes, and making it easy for attackers to use normal fluctuations to cover up attack behavior. The root cause of these drawbacks is that existing models are based solely on data distribution learning and lack explicit modeling of physical laws, control logic, and equipment topology; the models are not interpretable internally and it is difficult to map anomalies to specific physical links; static thresholds and fixed windows cannot follow the dynamic evolution of the system. Therefore, it is urgent to develop a solution to address the above problems. Summary of the Invention

[0004] The purpose of this invention is to provide a dynamic threshold anomaly detection method for industrial control systems based on physical constraints, which improves the problems of existing technologies that are difficult to accurately identify multiple types of anomalies and lack physical interpretability and adaptability to operating conditions.

[0005] The present invention provides a method for dynamic threshold anomaly detection in industrial control systems based on physical constraints, which adopts the following technical solution:

[0006] A method for dynamic threshold anomaly detection in industrial control systems based on physical constraints, specifically including:

[0007] Historical data of actuators and sensors in industrial control systems are acquired. Physical events are extracted from the actuator historical data, and the expected change direction of the sensor historical data after the event occurs is summarized to form physical event rules. Differential equations are constructed based on physical mechanisms, and theoretical derivative estimates are calculated using physical driving methods. Physical residuals are determined based on the theoretical derivative estimates, and the normal range of the physical residual statistics is statistically analyzed to form physical consistency rules. The physical event rules and physical consistency rules are integrated to obtain a rule twin model.

[0008] The actuator status data and sensor numerical data are acquired in real time, and a predetermined number of sampling points before the current moment are maintained using a sliding window; physical events are identified based on the actuator status data, and it is determined whether they conform to the physical event rules. If they do not conform, they are judged as abnormal.

[0009] The theoretical derivative estimate is calculated using a physical-driven approach based on the differential equation, and the physical residual is determined based on the theoretical derivative estimate. The physical residual statistic is calculated within a sliding window. If the statistic does not conform to the physical consistency rule, it is judged as an anomaly. Otherwise, if the statistic exceeds the high threshold, it is judged as an anomaly. If the statistic does not exceed the high threshold, but exceeds the low threshold in at least two consecutive windows and shows a monotonically increasing trend or a stable shift trend, it is judged as a gradual stealth attack.

[0010] This invention provides a dynamic threshold anomaly detection method for industrial control systems based on physical constraints. By constructing a rule twin model that integrates physical event rules and physical consistency rules, and introducing a dynamic adaptive detection mechanism with sliding window statistics and high and low dual thresholds, it can perform hierarchical judgment on physical event violations, physical consistency violations, and abnormal residuals with different amplitude characteristics. It can accurately identify sudden large offsets and capture gradual stealth attacks. The entire architecture does not rely on a large amount of historical data or complex deep models. Instead, it achieves interpretable, high-precision, and real-time industrial control anomaly detection and attack discovery through engineering physical mechanisms. This improves the problems of existing technologies that are difficult to accurately identify multiple types of anomalies and lack physical interpretability and adaptive capability.

[0011] Optionally, when forming physical event rules, the process includes: performing first-order difference on the state sequence in the actuator's historical data, identifying actuator state transitions and abstracting them into physical events; for the identified physical events, statistically analyzing the change direction of the sensor's historical data within a preset response window, and taking the change direction that occurs most frequently under normal operating conditions as the expected change direction corresponding to the physical event.

[0012] Optionally, the differential equations include the water level continuity equation, the pressure-flow dynamics equation, and the drug concentration diffusion and reaction equation.

[0013] Optionally, the physical driving method includes a numerical discretization method and a physical information neural network; wherein, the numerical discretization method uses the Euler method to discretize the differential equation to obtain the theoretical derivative estimate of the system state variables; the physical information neural network embeds the differential equation as a constraint into the training process, and obtains the theoretical derivative estimate by jointly minimizing the data error and physical residual.

[0014] Optionally, the statistics include window cumulative, weighted average, and trend fit.

[0015] Optionally, when integrating physical event rules and physical consistency rules to obtain a rule twin model, the following steps are included: dividing the system's operating conditions into mutually exclusive logical subspaces based on different combinations of actuator states; for each logical subspace, statistically analyzing the probability density distribution of the window accumulation of physical residuals in attack-free historical data; and using the normal range of the statistically obtained window accumulation as the physical boundary, integrating it with the state constraints of the logical subspace to generate a rule twin model.

[0016] Optionally, the high threshold is set based on the high quantile of the statistic in historical normal data; the low threshold is set based on the average value of the statistic in historical normal data.

[0017] Optionally, the monotonically increasing trend is determined when the statistics of two or more consecutive windows are greater than the average window statistics of historical normal data; the stable deviation trend is determined when the standard deviation of the statistics of two or more consecutive windows is greater than the standard deviation of the window statistics of historical normal data.

[0018] Compared with the prior art, the present invention can produce the following beneficial effects:

[0019] 1. By employing dual verification of physical event extraction and physical consistency constraints, this invention not only enables real-time detection of anomalies but also allows for precise location of anomalies based on the specific physical consistency rules and physical event rules violated, significantly improving the efficiency of source tracing and handling.

[0020] 2. By using physical consistency constraints, this invention can amplify global trend shift features and combine them with a dynamic dual threshold mechanism to detect sudden anomalies with a high threshold and track subtle residual changes with a low threshold, thereby achieving early identification of progressive stealth attacks and overcoming the limitation of traditional deep learning in capturing slow-changing anomalies. Attached Figure Description

[0021] Figure 1 The flowchart illustrates a dynamic threshold anomaly detection method for industrial control systems based on physical constraints, as provided in this embodiment of the invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0023] See Figure 1 This invention provides a method for detecting dynamic threshold anomalies in industrial control systems based on physical constraints, comprising the following steps:

[0024] S1. Acquire historical data of actuators and sensors in the industrial control system; extract physical events from the actuator historical data and summarize the expected change direction of the sensor historical data after the event occurs to form physical event rules; construct differential equations based on physical mechanisms; calculate the theoretical derivative estimate using a physical driving method; determine the physical residual based on the theoretical derivative estimate; statistically analyze the normal range of the physical residual statistics to form physical consistency rules; integrate the physical event rules and physical consistency rules to obtain a rule twin model.

[0025] S2. Real-time acquisition of actuator status data and sensor numerical data, maintaining a predetermined number of sampling points prior to the current moment using a sliding window; identification of physical events based on actuator status data, and determination of whether they conform to physical event rules; if not, an anomaly is determined.

[0026] S3. Calculate the theoretical derivative estimate based on the differential equation using a physical-driven approach, and determine the physical residual based on the theoretical derivative estimate; calculate the statistic of the physical residual within a sliding window; if the statistic does not conform to the physical consistency rule, it is judged as an anomaly; otherwise, if the statistic exceeds the high threshold, it is judged as an anomaly; if the statistic does not exceed the high threshold, but exceeds the low threshold in at least two consecutive windows and shows a monotonically increasing trend or a stable shift trend, it is judged as a gradual stealth attack.

[0027] In some embodiments, when acquiring actuator historical data and sensor historical data of the industrial control system in step S1, extracting physical events from the actuator historical data, and summarizing the expected change direction of sensor historical data after the event occurs to form physical event rules, firstly, the industrial control system collects and stores actuator state historical data and sensor value historical data under normal operating conditions without network attacks, equipment failures, or process anomalies. Then, actuator events are identified from the actuator historical data. For actuators such as water pumps and electric valves, their historical data presents as a discrete transition sequence within a finite set of states. By performing first-order difference on the state sequence and comparing the state values ​​at adjacent times, the actual physical action of the equipment can be accurately located. For example, when an actuator's state at the previous time belongs to the closed set and its state at the current time transitions to the open set, it is determined as an "opening event"; conversely, a transition from the open set to the closed set is determined as a "closing event". Each physical event records its occurrence time, equipment identifier, and event type.

[0028] Secondly, sensor events are identified from historical sensor data. For sensors such as level gauges and flow meters, their historical data consists of continuous numerical sequences containing high-frequency noise. This embodiment introduces a sliding window mechanism to convert continuous values ​​into discrete trend events. Let the sliding window length be... For example, to determine an "upward trend event," two conditions must be met simultaneously: the maximum value within the window is not lower than the upper limit extreme value of the sensor in normal historical data, and the difference between the end value and the start value of the window exceeds a preset effective change threshold. This threshold can be set based on the standard deviation of the differences between adjacent sampling points in normal historical data, for example, twice the standard deviation. Similarly, a "downward trend event" can be defined. In this way, the continuous upward or downward trend of sensor values ​​can be abstracted into sensor events with clear physical meaning.

[0029] Finally, the causal relationships between actuator events, sensor events, and sensor changes are modeled as physical event rules. Specifically, after obtaining actuator events and sensor events, based on the process flow description, control logic, and equipment operation mechanism of the industrial control system, for each physical event, within a predefined time window or response interval, the changing trend, direction, and magnitude of relevant sensor variables are analyzed and aligned with the physical mechanism. For example, in a water treatment system, when a "water level valve opens" event is detected, the system automatically associates the corresponding water level, flow rate, and other variables of the water tank or pipe section to verify whether they show an upward trend within a reasonable time—the judgment method is that the difference between the tail value and the first value of the sliding window is greater than a preset change threshold, which is set according to the data disturbance amplitude of each sensor in the normal dataset. As another example, when a "dosing pump starts" event is detected, the system combines the law of conservation of mass and reaction kinetics to determine whether the first derivative of the drug concentration is positive.

[0030] Through continuous analysis and rule summarization of a large number of normal operation logs, the system gradually forms a stable and interpretable set of physical event rules that reflect the relationship between event and variable changes. Each rule clearly constrains the reasonable evolution direction and range of relevant variables under a specific physical event, providing a traceable physical basis for subsequent real-time consistency verification, anomaly localization, and attack identification.

[0031] In some embodiments, when constructing differential equations based on physical mechanisms in step S1, calculating theoretical derivative estimates using a physical-driven approach, determining physical residuals based on theoretical derivative estimates, and statistically analyzing the normal range of physical residual statistics to form physical consistency rules, the specific process is as follows:

[0032] S11. Based on the physical mechanisms of key variables in the industrial control system, construct the corresponding differential equations. For example:

[0033] For the water level change process, based on the law of conservation of mass in fluid mechanics, for a given water storage container, the rate of change of its internal water volume is equal to the difference between the total inflow and outflow per unit time. The water level continuity equation is constructed as follows:

[0034] ;

[0035] in, Indicates the effective cross-sectional area of ​​a water tank or pool; express The actual water level at any given time; Indicates the first The water inlet pipe is in Inflow at any given moment; It is the first The water inlet pipe is in The outflow of data at any given moment;

[0036] For the pressure change process in a pipeline network, based on the empirical laws governing frictional resistance and local resistance, the real-time pressure at the target node in the pipeline network is composed of the system's static head, laminar frictional resistance proportional to the flow velocity, and turbulent or local resistance proportional to the square of the flow velocity. The pressure-flow dynamics equation is constructed as follows:

[0037] ,

[0038] in, Indicates that the target node is in The fluid pressure at any given time or the real-time head provided by the pump (acquired by a pressure sensor). This indicates the system's base pressure; Indicates the internal structure of the pipe Real-time instantaneous flow rate at any given moment (collected by a flow sensor); Indicates the linear drag coefficient; This represents the secondary drag coefficient;

[0039] The industrial dosing process can be approximated as a continuous stirred reactor model. Based on the law of conservation of mass and chemical reaction kinetics, the change in solute mass in the tank equals the input mass minus the output mass, plus or minus the mass produced or consumed in the reaction. The drug concentration diffusion and reaction equations are constructed as follows:

[0040] ,

[0041] in, Indicates in The fluid volume of the mixing tank at any given time; Indicates in Real-time concentration of the target drug or chemical indicator in the mixing tank; Indicates in The volumetric flow rate of the influent entering the mixing tank at all times; Indicates in The volumetric flow rate of the effluent flowing out of the mixing tank at all times; Indicates in The background drug concentration in the incoming water at all times; Indicates in The rate at which the drug is injected by the constant dosing pump; Represents the rate constant of a chemical reaction; Indicates the reaction order;

[0042] S12. In this invention, the physical driving method refers to the specific implementation method of obtaining the theoretical derivative estimates of the system state variables based on the differential equation model, including numerical discretization methods (such as the Euler method) and the Physical Information Neural Network (PINN) method. Specifically:

[0043] Method 1: The continuous differential equation is transformed into a discrete-time model using numerical discretization. Taking the water level differential equation as an example, its discretization formula is as follows:

[0044] ,

[0045] in, Represents the system at the current discrete time. The predicted water level height; This indicates that the system at the previous discrete time... The known water level height; Indicates the system's data sampling step size; This indicates the effective cross-sectional area of ​​a water tank or pool. They represent the previous time step, respectively. The system's total inflow and total outflow; from this, we can derive the discrete time intervals. The theoretical derivative estimate is: Similarly, the theoretical derivative estimates for other process variables can also be obtained;

[0046] Taking the pressure-flow dynamics equation as an example, its discretization formula is as follows:

[0047] ,

[0048] in, Indicates the current time From node To the node Predicted instantaneous flow rate of the pipeline between them; Indicates the previous moment The known flow rate in the pipe; These represent the pipes at the previous time step. Two-end nodes and The actual pressure observation value; Indicates fluid density; This represents the equivalent flow resistance coefficient of the pipe. Indicates the time step; This indicates the cross-sectional area of ​​the pipe; Indicates the length of the pipe;

[0049] Taking the drug concentration diffusion and reaction equation as an example, its discretization formula is:

[0050] ,

[0051] in, Indicates the current time Predicted concentration of the target drug in the mixing tank; Indicates the previous moment Known concentrations within the mixing tank; Indicates the time step; Indicates the previous moment Real-time fluid volume of the mixing tank; and They represent the previous time step, respectively. Inflow and outflow; This represents the background drug concentration constant in the influent; Indicates the previous moment Mass injection rate of the dosing pump; It is the chemical reaction rate or decay constant;

[0052] Method Two: When the physical model parameters are incomplete or the process is complex and difficult to model accurately, a physical information neural network is introduced. The aforementioned differential equations are embedded as soft constraints during the neural network training process. The theoretical derivative estimate is obtained by jointly minimizing data errors and physical residuals. The relevant formulas are as follows:

[0053] ,

[0054] in, This represents the data-driven fitting loss term, used to constrain the network output to fit the actual observations. Residual loss term representing the constraint of physical laws; This represents an adaptive penalty weight, which can be automatically adjusted during training using a dynamic gradient scaling algorithm;

[0055] S13. At each sampling time, the actual rate of change is simultaneously calculated from the sensor numerical data, which can be approximated by first-order difference. The physical residual is determined by calculating the absolute value of the difference between the theoretical derivative estimate and the actual rate of change.

[0056] S14. To suppress sensor noise interference and amplify persistent offset, a sliding window mechanism is introduced. At each sampling time, statistics within the window are calculated sequentially. These statistics include the window cumulative amount of physical residuals within the window, the weighted average, and the trend fit value obtained by linearly fitting the residual sequence within the window. For each operating condition or actuator logic subspace, the values ​​of all window statistics under that condition are collected, and their probability density distribution is statistically analyzed. Specifically, the mean and standard value of the window cumulative amount are calculated, and their normal range is determined; simultaneously, the normal fluctuation range of the trend fit value is statistically analyzed. These statistical results constitute the physical consistency rules.

[0057] In some embodiments, when fusing physical event rules and physical consistency rules in step S1 to obtain a rule twin model, firstly, the system's operating conditions are divided into mutually exclusive logical subspaces based on different combinations of actuator states. For example, in a water treatment system, the open / closed states of actuators such as inlet valves, outlet valves, and dosing pumps can be combined: when the inlet valve is open and the outlet valve is closed, it corresponds to the "water storage" subspace; when the inlet valve is closed and the outlet valve is open, it corresponds to the "drainage" subspace; and when the dosing pump is open, it corresponds to the "dosing" subspace. These subspaces do not overlap and cover all possible normal operating conditions of the system. Secondly, for each logical subspace, the cumulative physical residual window values ​​within all sliding windows under that operating condition are collected from attack-free historical data, and their probability density distribution is statistically analyzed. Finally, the normal range of the statistically obtained window cumulative values ​​is used as the physical boundary and fused with the state constraints of the logical subspaces to generate a rule twin model.

[0058] In some embodiments, actuator status data and sensor numerical data are acquired in real time in step S2, and a predetermined number of sampling points prior to the current moment are maintained using a sliding window. Physical events are identified based on the actuator status data, and it is determined whether they conform to physical event rules. If they do not conform, an anomaly is identified. The system acquires the actuator status data and sensor numerical data from the industrial control system in real time at a fixed sampling period (e.g., once per second). To suppress transient noise and capture persistent anomalies, a sliding window mechanism is used to maintain a predetermined number of sampling points prior to the current moment. Let the window length be W (e.g., 90 sampling points). At each sampling moment, the system adds the data of the current moment to the window and simultaneously removes the oldest sampling point data from the window, ensuring that the window clock covers the dataset of the most recent W sampling points.

[0059] Physical events are identified based on actuator state data. For each actuator, the system records its state value from the previous moment to the current moment. By performing a first-order difference on the state sequence, it determines whether a state transition has occurred, and based on the state transition, it determines whether a physical event has occurred. When a physical event is detected, the system immediately triggers physical event rule verification. Based on the set of physical event rules constructed in step S1, it searches for the expected direction of change corresponding to the physical event. Specifically, each rule specifies the direction of change that the associated sensor variable should exhibit within a preset response window after a specific actuator action occurs, such as increasing, decreasing, or no significant change. Within the preset response window (e.g., 5 seconds or 10 sampling periods), the system monitors the changing trend of the associated sensor values ​​in real time. For example, it calculates the difference between the end value and the beginning value of the window. If the difference is greater than a positive threshold, it is determined to be an increase; if it is less than a negative threshold, it is determined to be a decrease; otherwise, it is no significant change. If the actual direction of change does not match the expected direction in the rule, it is immediately determined to be an anomaly, and the anomaly type and location are output.

[0060] If no physical event is detected at the current moment, or if a physical event is detected but meets the rules, then the subsequent physical consistency rule detection steps will continue to be executed.

[0061] In some embodiments, in step S3, the theoretical derivative estimate is calculated using a physical-driven approach based on the differential equation, and the physical residual is determined based on the theoretical derivative estimate. The statistics of the physical residual are calculated within a sliding window. If the statistics do not conform to the physical consistency rule, an anomaly is determined. First, at each sampling time, the system calculates the theoretical derivative estimate of the system state variables and the physical residual in the same way as in step S1, based on the constructed physical differential equation. Simultaneously, the statistics of the physical residual in the current window are obtained according to the same sliding window length and statistics calculation method as in step S1. Then, the corresponding logical subspace is matched according to the current actuator state combination, and the pre-constructed physical consistency rule under that subspace is invoked. If the current statistics exceed the normal range specified by the rule, an anomaly is determined, and the anomaly type and location are output; otherwise, the subsequent dynamic dual-threshold detection steps continue.

[0062] In some embodiments, in step S3, if the statistic exceeds a high threshold, an anomaly is determined; if the statistic does not exceed the high threshold but exceeds the low threshold in at least two consecutive windows and shows a monotonically increasing trend or a stable shift trend, it is determined to be a gradual stealth attack. First, the system pre-sets a high threshold and a low threshold based on historical normal data, with the high threshold being greater than the low threshold. The low threshold is typically the average of the window statistics in historical normal data, and the high threshold is typically the high quantile (e.g., the 99th percentile) of the window statistics in historical normal data. If the statistic in the current window rapidly exceeds the high threshold within a short period, it is determined to be a sudden anomaly. Such anomalies are usually caused by instantaneous sensor tampering, severe noise, or actuator mutation, characterized by a sharp increase in the statistic within a single window exceeding the high threshold. If triggered by a sensor data jump, "Sudden Sensor Tampering" is output; if caused by an actuator mutation leading to a surge in the statistic, "Actuator Mutation" is output. The time of the anomaly and related variables are recorded.

[0063] If the statistic does not exceed the high threshold, but exceeds the low threshold in at least two consecutive windows and shows a monotonically increasing trend or a stable shift trend, it is considered a gradual stealth attack. A monotonically increasing trend can be determined by comparing the differences in statistics between adjacent windows; if the statistic increases successively across multiple consecutive windows, monotonically increasing is considered to exist. A stable shift trend can be determined by calculating the standard deviation of the current statistics across multiple consecutive windows and comparing it to the standard deviation of window statistics in historical normal data; if it is greater than the normal standard deviation, a stable shift is considered to have occurred.

[0064] Otherwise, the current state is considered normal, and the detection continues to the next sampling time. Through the above dynamic dual-threshold detection mechanism, the system can accurately distinguish between sudden attacks and gradual stealth attacks in high-noise environments, avoiding false alarms or missed detections caused by a single threshold.

[0065] This invention treats actuator state changes as physical events. By extracting rules from the operations of actuators such as valves and pumps and their corresponding physical conditions, operational prerequisites, and operating constraints, it can identify any abnormal operations that violate physical logic or process flow in real time. Simultaneously, based on the physical model in digital twins, a rule-based twin model with real-time physical consistency constraints is constructed. By comparing the residuals of sensor readings with the output values ​​of the rule-based twin model, sudden, large-amplitude sensor tampering attacks can be detected promptly. Such behaviors that violate physical consistency can be accurately identified without relying on historical statistical features of machine learning models, significantly improving the reliability of attack detection. Furthermore, this invention proposes a dual-threshold dynamic detection strategy. A high threshold is used to capture sudden sensor jumps, while a low threshold, combined with residual trend analysis, is used to capture slowly accumulating, incremental stealth attacks. The thresholds are dynamically adjusted according to real-time operating conditions, physical model errors, and adaptive noise levels, effectively preventing stealth attacks from bypassing traditional fixed-threshold detection mechanisms and enabling early detection of stealth attacks. In summary, this invention significantly improves the real-time performance, accuracy, and interpretability of anomaly detection in industrial control systems.

[0066] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A method for dynamic threshold anomaly detection in industrial control systems based on physical constraints, characterized in that, include: This process involves acquiring historical actuator and sensor data from an industrial control system, extracting physical events from the actuator historical data, and summarizing the expected change direction of the sensor historical data after the events occur to form physical event rules. This includes: performing first-order difference analysis on the state sequences in the actuator historical data to identify actuator state transitions and abstract them as physical events; statistically analyzing the change direction of the sensor historical data within a preset response window for each identified physical event, identifying the most frequent change direction under normal operating conditions as the expected change direction corresponding to that physical event; constructing differential equations based on physical mechanisms, calculating theoretical derivative estimates using a physical-driven approach, determining physical residuals based on the theoretical derivative estimates, statistically analyzing the normal range of the physical residual statistics, and forming physical consistency rules; and fusing the physical event rules and physical consistency rules to obtain a rule twin model. This includes: dividing the system's operating conditions into mutually exclusive logical subspaces based on different actuator state combinations; statistically analyzing the probability density distribution of the window accumulation of physical residuals in attack-free historical data for each logical subspace; and fusing the normal range of the statistically obtained window accumulation as the physical boundary with the state constraints of the logical subspace to generate the rule twin model. The actuator status data and sensor numerical data are acquired in real time, and a predetermined number of sampling points before the current moment are maintained using a sliding window; physical events are identified based on the actuator status data, and it is determined whether they conform to the physical event rules. If they do not conform, they are judged as abnormal. The theoretical derivative estimate is calculated using a physical-driven approach based on the differential equation, and the physical residual is determined based on the theoretical derivative estimate. The physical residual statistic is calculated within a sliding window. If the statistic does not conform to the physical consistency rule, it is judged as an anomaly. Otherwise, if the statistic exceeds the high threshold, it is judged as an anomaly. If the statistic does not exceed the high threshold, but exceeds the low threshold in at least two consecutive windows and shows a monotonically increasing trend or a stable shift trend, it is judged as a gradual stealth attack.

2. The method as described in claim 1, characterized in that, The differential equations include the water level continuity equation, the pressure-flow dynamics equation, and the drug concentration diffusion and reaction equation.

3. The method as described in claim 1, characterized in that, The physical driving method includes a numerical discretization method and a physical information neural network; wherein, the numerical discretization method uses the Euler method to discretize the differential equation to obtain the theoretical derivative estimate of the system state variables; the physical information neural network embeds the differential equation as a constraint into the training process, and obtains the theoretical derivative estimate by jointly minimizing the data error and physical residual.

4. The method as described in claim 1, characterized in that, The statistics include window cumulative value, weighted average value, and trend fit value.

5. The method as described in claim 1, characterized in that, The high threshold is set based on the high quantile of the statistics in historical normal data; the low threshold is set based on the average value of the statistics in historical normal data.

6. The method as described in claim 1, characterized in that, The monotonically increasing trend is determined when the statistics of two or more consecutive windows are greater than the average window statistics of historical normal data; the stable deviation trend is determined when the standard deviation of the statistics of two or more consecutive windows is greater than the standard deviation of the window statistics of historical normal data.

Images