A detection method, apparatus, electronic device, and computer program product

Abstract

This application provides a detection method, apparatus, electronic device, and computer program product. The method includes: inputting first detection data corresponding to an industrial control system to be detected into a first model and a second model respectively to obtain a first detection result and a second detection result; the first model is a random forest; the second model is XGBoost; using an isolated forest model to determine the anomaly score corresponding to the first detection data; and adjusting a first sliding window based on the anomaly score to obtain a second sliding window; detecting the first detection data based on the second sliding window and a third model to obtain a third detection result; the third model is an LSTM model; inputting the first detection result, the second detection result, and the third detection result into a logistic regression model to obtain a fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect anomalies in the industrial control system. This application can improve the accuracy of anomaly detection.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a detection method, apparatus, electronic device, and computer program product. Background Technology

[0002] Anomaly detection methods in industrial control systems mainly include rule-based and threshold-based anomaly detection, which typically assumes that all system states are measurable and relies on a large amount of expert knowledge, making it difficult to adapt to new or unknown anomaly patterns. Machine learning-based anomaly detection does not consider the temporal structure characteristics of time series data and fails to mine potential useful information in industrial control data, resulting in low accuracy of anomaly detection. Summary of the Invention

[0003] This application provides a detection method, apparatus, electronic device, and computer program product that can improve the accuracy of anomaly detection.

[0004] The technical solution of this application embodiment is implemented as follows: This application provides a detection method, the method comprising: The first detection data corresponding to the industrial control system to be detected is input into the first model and the second model respectively to obtain the first detection result and the second detection result; the first model is a random forest; the second model is an extreme gradient boosting tree (XGBoost); An anomaly score corresponding to the first detected data is determined using an isolated forest model; and a second sliding window is obtained by adjusting the first sliding window based on the anomaly score. The first detection data is detected based on the second sliding window and the third model to obtain a third detection result; the third model is a Long Short-Term Memory (LSTM) network model. The first detection result, the second detection result, and the third detection result are input into a logistic regression model to obtain a fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect abnormal situations in the industrial control system.

[0005] This application provides a detection device, including: The unit is used to input the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, and obtain the first detection result and the second detection result; the first model is a random forest; the second model is XGBoost; An adjustment unit is used to adjust the first sliding window according to the first detection data to obtain a second sliding window; The obtaining unit is further configured to perform detection on the first detection data based on the second sliding window and the third model to obtain a third detection result; the third model is an LSTM model. The detection unit is used to input the first detection result, the second detection result, and the third detection result into a logistic regression model to obtain a fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect abnormal situations in the industrial control system.

[0006] This application provides an electronic device, the electronic component comprising: Memory is used to store executable instructions or computer programs. The processor, when executing computer-executable instructions or computer programs stored in the memory, implements the method provided in the embodiments of this application.

[0007] This application provides a computer program product, including a computer program or computer executable instructions, which, when executed by a processor, implements the detection method provided in this application.

[0008] The embodiments of this application have the following beneficial effects: By inputting the first detection data of the industrial control system to be detected into the first model, the second model, and the third model respectively for detection, the first detection result, the second detection result, and the third detection result are obtained. The complementarity of different models can be utilized, and the anomaly score corresponding to the first detection data can be determined using the isolated forest model. Based on the anomaly score, the first sliding window is adjusted to obtain the second sliding window. By adaptively adjusting the sliding window, the anomalies in the time series of the detection data can be detected more accurately. The first detection result, the second detection result, and the third detection result are input into the logistic regression model to obtain the fourth detection result. The fourth detection result is used to detect anomalies in the industrial control system. Further detection is performed based on the first detection result, the second detection result, and the third detection result, thereby improving the accuracy of anomaly detection. Attached Figure Description

[0009] Figure 1 A schematic flowchart of a detection method provided in an embodiment of this application; Figure 2 A flowchart illustrating an exemplary industrial control anomaly detection method based on ensemble learning, provided for an embodiment of this application; Figure 3 A schematic diagram of an exemplary automatic encoder provided for an embodiment of this application; Figure 4A schematic diagram illustrating a sliding window adjustment based on anomaly scores in an isolated forest, provided for an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a detection device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0010] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0011] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0012] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0013] Industrial Control Systems (ICS) provide basic services for monitoring industrial processes in traditional industrial production. As industrial control networks evolve from relatively closed local area networks (LANs) to the Industrial Internet, while improving efficiency and functionality, they also often expose systems to more security threats. Anomaly detection technology, as a proactive defense technique, can monitor abnormal behaviors inside and outside the system in real time, obtain the current system state through secure configuration strategies, and detect malicious traffic, thereby ensuring the availability and integrity of the entire industrial control system. While related industrial control anomaly detection methods are simple and easy to implement, they typically assume that all system states are measurable and rely heavily on expert knowledge, making them difficult to adapt to new or unknown anomaly patterns. Machine learning-based methods often fail to consider the temporal structure characteristics of time-series data and do not fully extract potentially useful information from industrial control data. Deep learning-based methods generally lack robustness and have poor interpretability; furthermore, they often use fixed time windows when extracting time-series features, making them insensitive to anomalies across different time ranges.

[0014] This application provides a detection method. Figure 1This is a flowchart illustrating a detection method provided in an embodiment of this application; as shown below. Figure 1 As shown, the method includes: S101. Input the first detection data corresponding to the industrial control system to be tested into the first model and the second model respectively to obtain the first detection result and the second detection result.

[0015] The first model is Random Forest; the second model is XGBoost.

[0016] It should be noted that the first detection data can be understood as the industrial control data corresponding to the industrial control system, including the time sequence of the data. The first detection data is the detection data obtained after processing the original detection data. The first model is a random forest; the second model is XGBoost. The first detection data corresponding to the industrial control system to be detected is input into the first and second models respectively to obtain the first and second detection results. This can also be understood as inputting the first detection data into a random forest for detection to obtain the first detection result, and then inputting the first detection data into XGBoost for detection to obtain the second detection result. Furthermore, inputting the first detection data into the first and second models respectively to obtain the first and second detection results can also be understood as inputting the first detection data into the first and second models respectively for training to obtain the first training result (i.e., the first detection result) and the second training result (i.e., the second detection result). The first and second models can be understood as base learners.

[0017] S102. Use the isolated forest model to determine the anomaly score corresponding to the first detection data; and adjust the first sliding window based on the anomaly score to obtain the second sliding window.

[0018] It should be noted that the first sliding window can be understood as the preset original window, which includes a first window size (width) and a first step length (step). The specific values ​​of the first window size and the first step length can be determined according to the actual situation and are not limited here. The second sliding window can be understood as a sliding window after adjusting the first window size and the first step length of the first sliding window.

[0019] It should be noted that using the Isolation Forest model to determine the anomaly score corresponding to the first detected data can be understood as using the Isolation Forest model to calculate the anomaly score corresponding to the first detected data. The calculation process of the Isolation Forest model is as follows: First, the model is initialized, setting the number of randomly generated trees and the ratio of the maximum number of samples to anomalies; then, a subset of data is randomly selected, and features are randomly selected from it. For each selected feature, a cut point is randomly chosen to split the sample in two, repeating the above process until all samples are isolated or the maximum depth of the tree is reached; multiple random trees are repeatedly constructed, each learning from different subsets, thus forming an Isolation Forest. When calculating the anomaly score, it is generated based on the path length of each sample; this sample can be understood as the first detected data.

[0020] It should be noted that adjusting the first sliding window based on the abnormal scores can be understood as dynamically adjusting the sliding window based on the abnormal scores.

[0021] The solution in this application embodiment can adaptively adjust the sliding window according to the current state of the system, enabling more intensive monitoring of data changes and more accurate detection of minor or sudden anomalies in the time series, thereby improving the model's fine-grained processing capability in anomaly detection.

[0022] S103. Based on the second sliding window and the third model, the first detection data is detected to obtain the third detection result.

[0023] The third model is the LSTM model.

[0024] It should be noted that the third model is also a base learner; that is, the first, second, and third models mentioned above are all base learners. Detecting the first detection data based on the second sliding window and the third model to obtain the third detection result can be understood as slicing the first detection data based on the second sliding window, inputting the sliced ​​first detection data into the third model, and obtaining the third detection result. Furthermore, inputting the sliced ​​first detection data into the third model to obtain the third detection result can also be understood as inputting the sliced ​​first detection data into the third model for training, and obtaining the third training result (i.e., the third detection result).

[0025] S104. Input the first detection result, the second detection result, and the third detection result into the logistic regression model to obtain the fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect abnormal situations in the industrial control system.

[0026] It should be noted that the logistic regression model can be understood as a meta-learner. Inputting the first, second, and third detection results into the logistic regression model yields the fourth detection result corresponding to the industrial control system. This can be understood as inputting the first, second, and third detection results into the logistic regression model for detection (or training) to obtain the fourth detection result (or fourth training result). The fourth detection result is used to detect anomalies in the industrial control system. Specifically, it can be understood as detecting abnormal data in the first detection data and determining the anomalies in the industrial control system based on the abnormal data.

[0027] The solution in this application embodiment involves inputting the first detection data of the industrial control system to be detected into a first model, a second model, and a third model for detection, respectively, to obtain a first detection result, a second detection result, and a third detection result. This approach leverages the complementarity of different models and adjusts the first sliding window based on the first detection data. By adaptively adjusting the sliding window, it is possible to more accurately detect anomalies in the time series of the detection data. Furthermore, the first, second, and third detection results are input into a logistic regression model to obtain a fourth detection result. This fourth detection result is used to detect anomalies in the industrial control system. Further detection is then performed based on the first, second, and third detection results, thereby improving the accuracy of anomaly detection.

[0028] In this embodiment of the application, the process of adjusting the first sliding window based on the anomaly score to obtain the second sliding window specifically includes: obtaining the first window size and first step length corresponding to the first sliding window; adjusting the first window size and first step length based on the anomaly score, a first threshold, and a second threshold to obtain the second window size and second step length corresponding to the second sliding window; the first threshold is less than the second threshold.

[0029] It should be noted that the first threshold can be understood as the low threshold for abnormal scores; the second threshold can be understood as the high threshold for abnormal scores; the first threshold is less than the second threshold; the specific values ​​of the first and second thresholds can be determined according to the actual situation, and are not limited here.

[0030] In this embodiment, the process of adjusting the size of the first window and the first step length based on the anomaly score, a first threshold, and a second threshold to obtain the size of the second window and the second step length corresponding to the second sliding window specifically includes: when the anomaly score is less than the first threshold, obtaining time information that the anomaly score is less than the first threshold; adjusting the size of the first window and the first step length based on the time information to obtain the size of the second window and the second step length corresponding to the second sliding window; or, when the anomaly score is greater than or equal to the first threshold and less than the second threshold, reducing the size of the first window or keeping the size of the first window to obtain the size of the second window; using the first step length as the second step length; or, when the anomaly score is greater than or equal to the second threshold, reducing the size of the first window and the first step length respectively to obtain the size of the second window and the second step length.

[0031] It should be noted that the case where the abnormal score is less than the first threshold can be understood as a normal state, that is, the first detection data is in a normal state; the time information of the abnormal score being less than the first threshold can be understood as the duration of the normal state, that is, the time information of the first detection data maintaining a normal state.

[0032] In this embodiment of the application, the step of adjusting the size of the first window and the first supplement based on time information to obtain the size of the second window and the second step length corresponding to the second sliding window specifically includes: when the time information is greater than or equal to the time threshold, increasing the size of the first window and the first step length respectively to obtain the size of the second window and the second step length.

[0033] It should be noted that the time threshold can be understood as the duration threshold of the normal state (situation). When the anomaly score is less than the first threshold, the time information of the anomaly score being less than the first threshold is obtained; and when the time information is greater than or equal to the time threshold, the first window size and the first step length are increased respectively to obtain the second window size and the second step length. This can be understood as, when the anomaly score is in the normal state and the duration of the normal state is greater than or equal to the duration threshold, the first window size is increased to obtain the second window size, and the first step length is increased to obtain the second step length. The percentage increase of the first window size and the first step length can be determined according to the actual situation and is not limited here; the percentage increase of the first window size and the percentage increase of the first step length can be the same or different.

[0034] It should be noted that an anomaly score greater than or equal to the first threshold and less than the second threshold can be understood as an anomaly score greater than or equal to the lower threshold and greater than the higher threshold; this indicates a slight anomaly state, meaning the first detection data is in a slightly anomaly state. When the anomaly score is greater than or equal to the first threshold and less than the second threshold, the first window size is reduced or kept the same to obtain the second window size. Using the first step length as the second step length can be understood as follows: when the anomaly score is in a slightly anomaly state, the first window size is reduced or kept the same to obtain the second window size, while the first step length remains unchanged; the percentage by which the first window size is reduced can be determined based on the actual situation, but the second window size must not be less than the minimum window value. The specific value of the minimum window value is determined based on the actual situation and is not limited here.

[0035] It should be noted that an anomaly score greater than or equal to the second threshold can be understood as an anomaly score greater than or equal to a higher anomaly score threshold, indicating a clearly abnormal state, meaning the first detection data is in a clearly abnormal state. When the anomaly score is greater than or equal to the second threshold, the first window size and the first step length are reduced respectively to obtain the second window size and the second step length. This can be understood as, when the anomaly score is in a clearly abnormal state, reducing the first window size yields the second window size; reducing the first step length yields the second step length. The percentage reduction in the first window size and the first step length can be determined based on the actual situation and is not limited here; the percentage reduction in the first window size and the percentage reduction in the first step length can be the same or different.

[0036] The percentage increase in the size of the first window and the percentage decrease in the size of the first window can be the same or different. Similarly, the percentage increase in the length of the first step and the percentage decrease in the length of the first step can be the same or different.

[0037] In this embodiment of the application, the method further includes: when the abnormal score is less than a first threshold and the time information is less than a time threshold, not adjusting the size of the first window and the length of the first step.

[0038] It should be noted that when the abnormal score is less than the first threshold and the time information is less than the time threshold, the size of the first window and the first step length are not adjusted. When the abnormal score is in a normal state and the duration of the normal state is less than the duration threshold, the size of the first window and the first step length remain unchanged. The size of the first window is the size of the second window, and the first step length is the second step length.

[0039] The solution in this application, based on the method of dynamically adjusting the sliding window length and overlap ratio according to the anomaly score of isolated forests, can adaptively adjust according to the current state of the system. When the data shows an abnormal trend, the window and step size become smaller, enabling more intensive monitoring of data changes and more accurate detection of minor or sudden anomalies in time series, thus improving the model's fine-grained processing capability in anomaly detection. Compared with the fixed window solution, the adaptive adjustment mechanism can more flexibly cope with the changing anomaly patterns in industrial control systems, minimizing the omission of important information.

[0040] In this embodiment of the application, before inputting the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, the method further includes: obtaining the second detection data corresponding to the industrial control system; encoding the classification features in the second detection data to obtain classification coding features; performing feature transformation and scaling processing on the classification coding features to obtain classification feature data; and performing data augmentation on the classification feature data to obtain the first detection data.

[0041] It should be noted that the second detection data can be understood as the raw detection data of the industrial control system, i.e., the original industrial control data. The second detection data includes the time sequence of the data. Encoding the categorical features in the second detection data yields categorical coded features. This can be understood as dividing the second detection data into training and testing sets, preserving the time sequence in each dataset. Both datasets contain normal and abnormal behaviors. 80% of the data is used as the training dataset, and the remaining 20% ​​as the testing dataset. The data is then checked for corrupted or missing values. For corrupted values, the corresponding samples are directly deleted; for missing values, they are marked as invalid data. One-hot encoding is applied to encode the categorical features present in the dataset (second detection data), yielding categorical coded features. These categorical coded features can be understood as binary features generated based on each distinct categorical value.

[0042] It should be noted that performing feature transformation and scaling on categorical coding features to obtain categorical feature data can be understood as converting the categorical coding features into continuous feature vectors through the embedding layer, and then scaling the continuous feature vectors by minimum and maximum values ​​so that each feature is within the range of [0,1] to obtain categorical feature data.

[0043] In this embodiment of the application, the process of performing data augmentation on the classification feature data to obtain the first detection data specifically includes: obtaining the first quantity information corresponding to the feature data of each category in the classification feature data; finding the second quantity information corresponding to the feature data of the first category from the classification feature data based on the first quantity information; the feature data of the first category is the feature data of a minority of categories in the classification feature data; synthesizing the feature data of the first category to obtain the synthesized feature data of the first category; determining the first detection data based on the synthesized feature data of the first category and the feature data of the second category; the second category is the other data in the classification feature data besides the feature data of the first category.

[0044] It should be noted that the first quantity information refers to the quantity of feature data corresponding to each category, and its specific value can be determined according to the actual situation, without limitation here. The feature data of the first category can be understood as the feature data of the minority category in the classification feature data, and the feature data of the first category can also be understood as the abnormal feature data; the second quantity information can be understood as the quantity of feature data of the minority category; the feature data of the second category can be understood as the feature data of the majority type in the classification feature data, and the feature data of the second category can also be understood as the normal feature data; the feature data of the first category and the feature data of the second category are merged into the classification feature data. Data synthesis is performed on the feature data of the first category to obtain the synthesized feature data of the first category. This can be understood as using the imbalanced data sampling method (Adaptive Synthetic, ADASYN) algorithm to synthesize the feature data of the first category to obtain the synthesized feature data of the first category. The first detection data is determined based on the synthesized feature data of the first category and the feature data of the second category. This can be understood as merging the synthesized feature data of the first category and the feature data of the second category into the first detection data.

[0045] It should be noted that after data augmentation of the categorical feature data, feature dimensionality reduction needs to be performed on the augmented categorical feature data to obtain the first detection data. Specifically, an autoencoder is used for feature dimensionality reduction.

[0046] The solution in this application embodiment, by synthesizing the feature data of the first type, can solve the data imbalance problem caused by the scarcity of abnormal data in industrial control systems.

[0047] To facilitate understanding, the above method is illustrated with an example. This detection method can be described as an industrial control anomaly detection method based on ensemble learning. It employs a stacked ensemble approach, combining the outputs of multiple base learners and leveraging the complementarity of different models to improve the overall detection performance. Random Forest, XGBoost, and LSTM with a dynamic sliding window are used as base learners, and a logistic regression model is used as a meta-learner to further learn from the outputs of the three base learners, thus obtaining the final anomaly detection result. By integrating multiple detection models, the feature learning capabilities of different models are fully utilized. Furthermore, considering the data imbalance problem, the ADASYN algorithm is used to synthesize samples to improve the learning ability of minority class samples.

[0048] Figure 2 A flowchart illustrating an exemplary industrial control anomaly detection method based on ensemble learning, provided as an embodiment of this application; Figure 2 As shown, the specific steps are as follows: 1. Data preprocessing.

[0049] It should be noted that both the training and test sets are preprocessed simultaneously.

[0050] 2. Data augmentation.

[0051] 3. Feature dimensionality reduction.

[0052] 4. Random Forest.

[0053] 5. XGBoost.

[0054] 6. LSTM.

[0055] It should be noted that LSTM includes feature augmentation, sliding window dynamic adjustment, and model training (this step is skipped for the test set).

[0056] 7. Logistic Regression.

[0057] 8. Final prediction.

[0058] Random Forest, XGBoost, and LSTM are the three base learners; the test set data undergoes data preprocessing, feature dimensionality reduction, the three base learners, and logistic regression to obtain the final prediction.

[0059] The steps described above are explained in detail below.

[0060] Step 1: Data preprocessing.

[0061] (1) Divide the original dataset into a training set and a test set, and preserve the time order in each dataset. Both datasets contain normal behavior and abnormal behavior. Use 80% of the data as the training dataset and the remaining 20% ​​as the test dataset.

[0062] (2) Check whether the data contains damaged or missing values. For damaged values, delete the corresponding samples directly. For missing values, mark the missing values ​​as invalid data.

[0063] (3) One-hot encoding is applied to encode the categorical features in the dataset, generating a binary feature for each different categorical value. Then, the one-hot encoded categorical features are converted into continuous feature vectors through an embedding layer, and the continuous features are scaled by minimum-maximum value so that each feature is in the range [0,1]. The scaled feature values ​​can be determined by formula (1).

[0064] (1) in, Represents the original feature vector. It is the minimum value of this feature in the training data. It is the maximum value of this feature in the training data. This represents the scaled feature value, which ranges from [0,1]. It is a constant vector that prevents division by zero.

[0065] Step 2: Data Augmentation. Industrial control data is prone to imbalance due to the scarcity of outlier samples. Therefore, this solution uses the ADASYN algorithm to synthesize more samples for the few more difficult-to-learn categories. Specific steps include: (1) Calculate the number of samples G to be synthesized. G can be determined by referring to formula (2).

[0066] (2) in, Indicates the number of the majority sample. Indicates the number of minority samples. This indicates the balance level of the created data.

[0067] (2) For each minority class sample, calculate K neighbors using Euclidean distance. The ratio of majority class samples in the neighbors is used as... express, You can refer to formula (3) to determine it.

[0068] (3) Where K represents the number of current neighbors, This indicates the number of majority class samples among the current neighbors.

[0069] (3) The sample ratio Normalize and calculate the number of samples to be synthesized for each minority class sample based on G. , You can refer to formula (4) to determine it.

[0070] (4) (4) Perform data sample synthesis. Data sample synthesis can be determined by referring to formula (5).

[0071] (5) in, This indicates a newly synthesized sample. Indicates the current minority of samples, Indicates from A small number of samples randomly selected from K neighbors, .

[0072] Step 3: Feature Dimensionality Reduction. To remove redundant information, retain the main features of the original data, and reduce model computational costs, this proposal employs an autoencoder for feature dimensionality reduction. An autoencoder is an unsupervised learning network architecture with the same input and output dimensions, capable of learning the latent representation of compressed data to achieve dimensionality reduction. Figure 3 A schematic diagram of an exemplary automatic encoder provided in this application embodiment; as shown Figure 3 As shown, the model includes an input layer, hidden layers, and an output layer, as well as an encoder and a decoder. A dropout operation is introduced during the encoder process. Both the encoder and decoder consist of three fully connected layers. The encoder compresses the original data to obtain a lower-dimensional representation, setting the number of compressed features to 16. The decoder then reconstructs the original data from the compressed data. The activation function is the Rectified Linear Unit (ReLU), and the model is compiled using an Adaptive Moment Estimation (Adam) optimizer and Mean-Square Error (MSE) as the loss function. Simultaneously, to enhance the model's robustness, a dropout operation is introduced in the encoder, ensuring that each neuron has a probability of being active during the network's training iterations. It was discarded.

[0073] Step 4: Training the base learners. Based on the idea of ​​ensemble learning, this embodiment uses three base learners: Random Forest, XGBoost, and LSTM with adaptive sliding window support, which are described in detail below: (1) Random Forest. The random forest algorithm is a collection of decision trees. A decision tree is a binary classifier consisting of a root node, multiple internal splitting nodes, and leaf nodes for classification. When constructing a random forest, the Bootstrap method (sampling with replacement) is used to generate m training sets from the original dataset for each decision tree. Then, a decision tree is constructed for each training set. Some features are randomly selected, and the optimal solution for feature splitting is found among the extracted features. The splitting criterion of the decision tree adopts the Gini coefficient, which can be determined by formula (6).

[0074] (6) in, It is a category The probability, It represents the total number of categories. Random forests classify data by constructing multiple decision trees and having them vote on each other. The value can be determined by referring to formula (7).

[0075] (7) in It is the first Trees for input feature vectors The prediction results.

[0076] (2) XGBoost: XGBoost is a strong classifier based on multiple weak classifiers. It optimizes the model's classification performance through multiple iterations. In each iteration, the first and second derivatives of the loss function are calculated, and a decision tree is constructed based on their values. The splitting of the tree is based on a greedy algorithm to select the feature that maximizes the information gain, which can be determined by formula (8).

[0077] (8) in, The first derivative, It is the second derivative. This represents the regularization parameter. Then, the newly generated tree is used to update the model. The above process is repeated to gradually reduce the model classification error. The loss function used here is log loss, which can be determined by formula (9).

[0078] (9) (3) Use LSTM with dynamic sliding window.

[0079] Feature Enhancement: An outlier score is calculated for each sample using an isolated forest. First, the model is initialized, setting the number of randomly generated trees and the maximum ratio of samples to outliers. Then, a subset of data is randomly selected, and features are randomly chosen from it. For each selected feature, a cutoff point is randomly chosen to split the sample in two directions. This process is repeated until all samples are isolated or the maximum tree depth is reached. Multiple random trees are repeatedly constructed, each learning from different subsets, thus forming an isolated forest. When calculating the outlier score, an outlier score is generated based on the path length of each sample. This score is then concatenated as a feature with the dimensionality-reduced feature vector to achieve feature enhancement.

[0080] Dynamically Adjusting Sliding Window Size and Overlap Ratio Based on Anomaly Scores: Traditional LSTM models typically use a fixed-size sliding window. To adapt to different data characteristics and trends, this application proposes a strategy for dynamically adjusting the sliding window size and overlap ratio based on anomaly scores in isolated forests. Figure 4 This application provides a schematic diagram of a sliding window adjustment process based on anomaly scores in an isolated forest; as shown in the embodiments. Figure 4 As shown, Indicates the outlier score of isolated forests. This indicates a low threshold for abnormal scores; This indicates a high threshold for abnormal scores; , and Indicates the percentage by which the window size increases or decreases; and Indicates the percentage increase or decrease in step size; This represents the duration threshold under normal circumstances; the specific steps are as follows: 1. Begin.

[0081] 2. Initialize the window size (width) and step size (step).

[0082] 3. .

[0083] It should be noted that, in Less than In this case, proceed to step 4; Greater than or equal to In this case, proceed to step 7.

[0084] 4. .

[0085] It should be noted that when t is less than In the case where t is greater than or equal to t, proceed to step 5; In this case, proceed to step 6.

[0086] 5. width=width, step=step.

[0087] 6. , .

[0088] 7. .

[0089] It should be noted that, in Less than In this case, proceed to step 8; Greater than or equal to In this case, proceed to step 9.

[0090] 8. , .

[0091] 9. , .

[0092] 10. End.

[0093] The above steps are explained in detail here. First, the basic window size and step size are initialized, and high and low thresholds for outlier scores are set based on the historical distribution of outlier scores and domain knowledge. To reduce the impact of short-term fluctuations and avoid frequent adjustments, this proposal uses a moving average method to smooth outlier scores, setting smoothing parameters and calculating the moving average of the current outlier scores. After each new sample is acquired, the data is processed based on the current window and compared with the thresholds: for normal states, the window size and step size remain unchanged; for minor outliers, the window size remains unchanged or is appropriately reduced (not lower than the minimum window value), and the step size remains unchanged; for obvious outliers, the window size is reduced while the step size is decreased; for normal states that have been maintained for a period of time, the window size (not exceeding the maximum window value) and step size (not exceeding the maximum step size) are increased.

[0094] Model training. During LSTM training, MSE is used as the loss function. The weights and biases are updated layer by layer through backpropagation, and the Adam optimization algorithm is used to adjust the parameters to minimize the loss. The loss function formula can be found in formula (10).

[0095] (10) in, Indicates the number of training samples. Represents training data, This represents the predicted data.

[0096] Step 5: Train the meta-learner. This proposal uses a stacking ensemble approach, using the logistic regression (LR) model as the meta-learner. The training results of the three base learners are input into the meta-learner for training to obtain the final prediction result.

[0097] The solution in this application utilizes the advantages of multiple models through ensemble learning. By combining feature dimensionality reduction, anomaly score generation, and different learners, data processing becomes more flexible, reducing the sensitivity of a single model to data bias or noise and improving the overall robustness of detection. The method simplifies high-dimensional data through feature dimensionality reduction using an autoencoder and uses anomaly scores generated by isolated forests as augmenting features to provide an interpretable measure of anomalies for the samples. This allows the LSTM model to learn based on a more meaningful feature set, making it more efficient and interpretable than general deep learning models. Furthermore, the method considers the imbalance between normal and abnormal samples in industrial control systems and addresses this imbalance problem by using the ADASYN method to synthesize samples.

[0098] The solution in this application, based on the method of dynamically adjusting the sliding window length and overlap ratio according to the anomaly score of isolated forests, can adaptively adjust according to the current state of the system. When the data shows an abnormal trend, the window and step size become smaller, enabling more intensive monitoring of data changes and more accurate detection of minor or sudden anomalies in time series, thus improving the model's fine-grained processing capability in anomaly detection. Compared with the fixed window solution, the adaptive adjustment mechanism can more flexibly cope with the changing anomaly patterns in industrial control systems, minimizing the omission of important information.

[0099] This application provides a detection device. Figure 5 This is a schematic diagram of the structure of a detection device provided in an embodiment of this application; as shown below. Figure 5 As shown, the detection device 500 includes: Unit 501 is used to input the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, and obtain the first detection result and the second detection result; the first model is a random forest; the second model is XGBoost; The adjustment unit 502 is used to determine the anomaly score corresponding to the first detection data using the isolated forest model; and to adjust the first sliding window based on the anomaly score to obtain a second sliding window; The obtaining unit 501 is further configured to detect the first detection data based on the second sliding window and the third model to obtain a third detection result; the third model is an LSTM model. The detection unit 503 is used to input the first detection result, the second detection result and the third detection result into the logistic regression model to obtain the fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect abnormal situations in the industrial control system.

[0100] In some embodiments, the adjustment unit 502 is further configured to obtain the first window size and the first step length corresponding to the first sliding window; adjust the first window size and the first step length based on the anomaly score, the first threshold and the second threshold to obtain the second window size and the second step length corresponding to the second sliding window; the first threshold is less than the second threshold.

[0101] In some embodiments, the adjustment unit 502 is further configured to: acquire time information indicating that the abnormal score is less than the first threshold when the abnormal score is less than the first threshold; adjust the first window size and the first step length based on the time information to obtain the second window size and the second step length corresponding to the second sliding window; or, reduce the first window size or maintain the first window size when the abnormal score is greater than or equal to the first threshold and less than the second threshold to obtain the second window size; and use the first step length as the second step length; or, reduce the first window size and the first step length respectively when the abnormal score is greater than or equal to the second threshold to obtain the second window size and the second step length.

[0102] In some embodiments, the adjustment unit 502 is further configured to increase the first window size and the first step length respectively when the time information is greater than or equal to the time threshold, so as to obtain the second window size and the second step length.

[0103] In some embodiments, the adjustment unit 502 is further configured to not adjust the first window size and the first step length when the abnormal score is less than a first threshold and the time information is less than the time threshold.

[0104] In some embodiments, before inputting the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, the detection device 500 further includes: The acquisition unit is used to acquire the second detection data corresponding to the industrial control system; The encoding unit is used to encode the classification features in the second detection data to obtain classification encoded features; The feature transformation and scaling processing unit is used to perform feature transformation and scaling processing on the classification coding features to obtain classification feature data; The data augmentation unit is used to augment the classification feature data to obtain the first detection data.

[0105] In some embodiments, the data augmentation unit is further configured to obtain first quantity information corresponding to the feature data of each category in the classification feature data; The second quantity information corresponding to the feature data of the first category is found from the classification feature data based on the first quantity information; the feature data of the first category is the feature data of a minority category in the classification feature data; the feature data of the first category is synthesized to obtain the feature data of the synthesized first category; the first detection data is determined based on the feature data of the synthesized first category and the feature data of the second category; the second category is the other data in the classification feature data besides the feature data of the first category.

[0106] This application also provides an electronic device. Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application; as shown below. Figure 6 As shown, the electronic device 600 includes a processor 601 and a memory 603. Optionally, the electronic device 600 may also include a communication bus 602.

[0107] In specific embodiments, the processor 601 described above can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), CPU, controller, microcontroller, and microprocessor. It is understood that for different devices, the electronic device used to implement the above processor function can also be other types, and this embodiment does not specifically limit it.

[0108] In this embodiment, the communication bus 602 is used to establish communication between the processor 601 and the memory 603; when the processor 601 executes the running program stored in the memory 603, it implements the following detection method: The first detection data corresponding to the industrial control system to be detected is input into the first model and the second model respectively to obtain the first detection result and the second detection result; the first model is a random forest; the second model is XGBoost; the anomaly score corresponding to the first detection data is determined using the isolated forest model; and the first sliding window is adjusted based on the anomaly score to obtain the second sliding window; the first detection data is detected based on the second sliding window and the third model to obtain the third detection result; the third model is an LSTM model; the first detection result, the second detection result and the third detection result are input into the logistic regression model to obtain the fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect anomalies in the industrial control system.

[0109] Furthermore, the processor 601 is also configured to obtain the first window size and the first step length corresponding to the first sliding window; adjust the first window size and the first step length based on the anomaly score, the first threshold and the second threshold to obtain the second window size and the second step length corresponding to the second sliding window; the first threshold is less than the second threshold.

[0110] Furthermore, the processor 601 is also configured to: when the abnormal score is less than the first threshold, obtain time information indicating that the abnormal score is less than the first threshold; adjust the first window size and the first step length based on the time information to obtain the second window size and the second step length corresponding to the second sliding window; or, when the abnormal score is greater than or equal to the first threshold and less than the second threshold, reduce the first window size or maintain the first window size to obtain the second window size; use the first step length as the second step length; or, when the abnormal score is greater than or equal to the second threshold, reduce the first window size and the first step length respectively to obtain the second window size and the second step length.

[0111] Furthermore, the processor 601 is also configured to increase the first window size and the first step length respectively when the time information is greater than or equal to the time threshold, to obtain the second window size and the second step length.

[0112] Furthermore, the processor 601 is also configured to not adjust the first window size and the first step length when the abnormal score is less than the first threshold and the time information is less than the time threshold.

[0113] Furthermore, before inputting the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, the processor 601 is also used to acquire the second detection data corresponding to the industrial control system; encode the classification features in the second detection data to obtain classification coding features; perform feature transformation and scaling processing on the classification coding features to obtain classification feature data; and perform data augmentation on the classification feature data to obtain the first detection data.

[0114] Furthermore, the processor 601 is also configured to acquire first quantity information corresponding to the feature data of each category in the classification feature data; find second quantity information corresponding to the feature data of the first category from the classification feature data based on the first quantity information; the feature data of the first category is the feature data of a minority of categories in the classification feature data; synthesize the feature data of the first category to obtain the synthesized feature data of the first category; determine the first detection data based on the synthesized feature data of the first category and the feature data of the second category; the second category is the other data in the classification feature data besides the feature data of the first category.

[0115] This application provides a storage medium storing a computer program thereon. The computer-readable storage medium stores one or more programs, which can be executed by one or more processors. The computer program implements the detection method described above.

[0116] Based on the above embodiments, this application provides a computer program product, including a computer program that can be executed by one or more processors, and the computer program implements the detection method described above.

[0117] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0118] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause an image display device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this disclosure.

[0119] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A detection method, characterized in that, The method includes: The first detection data corresponding to the industrial control system to be detected is input into the first model and the second model respectively to obtain the first detection result and the second detection result; the first model is a random forest; the second model is an extreme gradient boosting tree (XGBoost); An anomaly score corresponding to the first detected data is determined using an isolated forest model; and a second sliding window is obtained by adjusting the first sliding window based on the anomaly score. The first detection data is detected based on the second sliding window and the third model to obtain a third detection result; the third model is a Long Short-Term Memory (LSTM) network model. The first detection result, the second detection result, and the third detection result are input into a logistic regression model to obtain a fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect abnormal situations in the industrial control system.

2. The method according to claim 1, characterized in that, The step of adjusting the first sliding window based on the abnormal score to obtain the second sliding window includes: Obtain the size of the first window and the length of the first step corresponding to the first sliding window; The size of the first window and the first step length are adjusted based on the anomaly score, the first threshold and the second threshold to obtain the second window size and the second step length corresponding to the second sliding window; the first threshold is less than the second threshold.

3. The method according to claim 2, characterized in that, The step of adjusting the first window size and the first step length based on the anomaly score, the first threshold, and the second threshold to obtain the second window size and the second step length corresponding to the second sliding window includes: If the abnormal score is less than the first threshold, obtain the time information when the abnormal score is less than the first threshold; Based on the time information, the size of the first window and the first step length are adjusted to obtain the second window size and the second step length corresponding to the second sliding window; Alternatively, if the abnormal score is greater than or equal to the first threshold and less than the second threshold, the first window size is reduced or the first window size is maintained to obtain the second window size; the first step length is used as the second step length. Alternatively, if the abnormal score is greater than or equal to the second threshold, the first window size and the first step length are reduced respectively to obtain the second window size and the second step length.

4. The method according to claim 3, characterized in that, Based on the time information, the size of the first window and the first step length are adjusted to obtain the second window size and the second step length corresponding to the second sliding window, including: If the time information is greater than or equal to the time threshold, the first window size and the first step length are increased respectively to obtain the second window size and the second step length.

5. The method according to claim 4, characterized in that, The method further includes: If the abnormal score is less than the first threshold and the time information is less than the time threshold, the first window size and the first step length will not be adjusted.

6. The method according to claim 1, characterized in that, Before inputting the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, the method further includes: Obtain the second detection data corresponding to the industrial control system; The classification features in the second detection data are encoded to obtain classification coding features; The classification coding features are subjected to feature transformation and scaling to obtain classification feature data; The classification feature data is augmented to obtain the first detection data.

7. The method according to claim 6, characterized in that, The step of performing data augmentation on the classification feature data to obtain the first detection data includes: Obtain the first quantity information corresponding to the feature data of each category in the classification feature data; Based on the first quantity information, the second quantity information corresponding to the feature data of the first category is found from the classification feature data; the feature data of the first category is the feature data of a minority category in the classification feature data; The feature data of the first category are synthesized to obtain the synthesized feature data of the first category; The first detection data is determined based on the synthesized feature data of the first category and the feature data of the second category; the second category is other data in the classification feature data besides the feature data of the first category.

8. A detection device, characterized in that, The device includes: The unit is used to input the first detection data corresponding to the industrial control system to be detected into the first model and the second model respectively, and obtain the first detection result and the second detection result; the first model is a random forest; the second model is an extreme gradient boosting tree (XGBoost); An adjustment unit is used to adjust the first sliding window according to the first detection data to obtain a second sliding window; The obtaining unit is further configured to detect the first detection data based on the second sliding window and the third model to obtain a third detection result; the third model is a Long Short-Term Memory (LSTM) network model. The detection unit is used to input the first detection result, the second detection result, and the third detection result into a logistic regression model to obtain a fourth detection result corresponding to the industrial control system; the fourth detection result is used to detect abnormal situations in the industrial control system.

9. An electronic device, characterized in that, The electronic device includes: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the method according to any one of claims 1 to 7.

10. A computer program product comprising a computer program or computer-executable instructions, characterized in that, When the computer program or computer-executable instructions are executed by a processor, they implement the method described in any one of claims 1 to 7.

Images