Industrial Internet Anomaly Detection via Distribution Space Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security methods for industrial Internet are inefficient in processing high-dimensional, nonlinear data from industrial control systems, leading to low detection efficiency, low detection quality, and unstable results due to noise in data and the propensity of algorithms like decision trees and support vector machines to overfit or require excessive resources.
Innovation Solution
An abnormal data detection method that utilizes a minimax adversarial encoder, generator, and discriminator to process real data distributions, extract and enhance normal features, and calculate anomaly scores, thereby improving detection accuracy and stability by enabling dual detection and efficient communication permission updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional machine learning algorithms (decision tree, support vector machine) are used for anomaly detection, then detection capability is provided, but detection efficiency is low and system resources are excessively consumed
Solution Approach 1:
The patent transforms the detection approach by changing the parameter space from direct feature space comparison to distribution space comparison. By modeling the probability distribution of normal data and comparing test data distributions against this model, the system achieves both high detection accuracy and efficiency. The distribution-based approach (using methods like KS-test, JS-divergence, or KL-divergence) processes data more efficiently than traditional algorithms while maintaining reliable anomaly detection capability.
2Reliability
If traditional machine learning algorithms are used, then anomaly detection is performed, but detection results are unstable due to parameter sensitivity and sample dependence
Solution Approach 1:
The patent introduces a distribution model as an intermediary between the training data and test data. Instead of directly comparing test samples against training samples (which causes instability due to sample dependence), the system first learns the normal data distribution characteristics and stores them as a reference model. This intermediary distribution model provides a stable baseline for comparison, eliminating the instability caused by varying training samples and parameter sensitivity.
3Measurement precision
If feature space anomaly detection is used, then anomalies are detected by measuring deviations, but detection quality is low due to noise in high-dimensional industrial data
Solution Approach 1:
The patent moves the detection problem from the original high-dimensional feature space to a distribution space. Instead of measuring deviations of individual features (which are noisy in high-dimensional data), the system compares the entire data distribution. This dimensional transformation allows the system to capture underlying patterns and relationships that are obscured by noise in the original feature space, thereby improving both measurement precision and detection quality.
Data Source
AI summary
The present invention relates to the technical field of network security, and in particular to an abnormal data detection method, system and device for industrial Internet. This detection method compares data distribution of an initial node with a normal feature expression performance in first normal data distribution subject to extraction processing to obtain a first anomaly score, compares the data distribution of the initial node with the normal feature expression performance in second normal data distribution subject to enhancement processing to obtain a second anomaly score, obtains a risk level of the node based on the first anomaly score and the second anomaly score, and immediately provides corresponding limits on a node communication permission; and the method provides dual detection, is high in accuracy and stable in detection results, and facilitates the maintenance of industrial Internet security.