CN117055527A - Industrial control system abnormality detection method based on variation self-encoder - Google Patents
Industrial control system abnormality detection method based on variation self-encoder Download PDFInfo
- Publication number
- CN117055527A CN117055527A CN202311114361.4A CN202311114361A CN117055527A CN 117055527 A CN117055527 A CN 117055527A CN 202311114361 A CN202311114361 A CN 202311114361A CN 117055527 A CN117055527 A CN 117055527A
- Authority
- CN
- China
- Prior art keywords
- data
- encoder
- network
- representing
- industrial control
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 47
- 230000005856 abnormality Effects 0.000 title claims abstract description 13
- 238000012549 training Methods 0.000 claims abstract description 17
- 238000009826 distribution Methods 0.000 claims abstract description 15
- 238000003062 neural network model Methods 0.000 claims abstract description 15
- 230000002159 abnormal effect Effects 0.000 claims abstract description 11
- 238000012360 testing method Methods 0.000 claims abstract description 10
- 239000000203 mixture Substances 0.000 claims abstract description 5
- 238000007781 pre-processing Methods 0.000 claims abstract description 4
- 238000000034 method Methods 0.000 claims description 14
- 239000013598 vector Substances 0.000 claims description 9
- 239000011159 matrix material Substances 0.000 claims description 8
- 238000013528 artificial neural network Methods 0.000 claims description 7
- 238000004364 calculation method Methods 0.000 claims description 7
- 238000010606 normalization Methods 0.000 claims description 5
- 238000012545 processing Methods 0.000 claims description 5
- 230000004043 responsiveness Effects 0.000 claims description 3
- 238000005070 sampling Methods 0.000 claims description 2
- 230000000694 effects Effects 0.000 abstract description 5
- 206010000117 Abnormal behaviour Diseases 0.000 abstract 1
- 230000006870 function Effects 0.000 description 7
- 238000004519 manufacturing process Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 2
- 230000007774 longterm Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 2
- 238000012952 Resampling Methods 0.000 description 1
- 230000004913 activation Effects 0.000 description 1
- 230000002547 anomalous effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 238000004880 explosion Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 238000005272 metallurgy Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 239000010865 sewage Substances 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
- G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
- G05B23/0208—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterized by the configuration of the monitoring system
- G05B23/0213—Modular or universal configuration of the monitoring system, e.g. monitoring system having modules that may be combined to build monitoring program; monitoring system that can be applied to legacy systems; adaptable monitoring system; using different communication protocols
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B2219/00—Program-control systems
- G05B2219/20—Pc systems
- G05B2219/24—Pc safety
- G05B2219/24065—Real time diagnostics
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Landscapes
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Engineering & Computer Science (AREA)
- Automation & Control Theory (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The invention provides an industrial control system abnormality detection method based on a variation self-encoder, and belongs to the technical field of industrial control systems. The invention comprises the following steps: s1: collecting industrial control system data; s2: preprocessing the acquired data; s3: constructing a neural network model, and training the model by using the processed normal data; s4: setting a detection threshold; s5: and detecting the test data, determining whether the data is abnormal or not according to the comparison result of the score and the detection threshold value, and outputting the result. The invention can effectively model the data in the industrial control system, and the constructed model can learn the time correlation between the data, so that the normal behavior and the abnormal behavior can be distinguished more accurately; the invention also uses the Gaussian mixture model to model the low-dimensional representation of the data and the distribution of the reconstruction errors, comprehensively considers the influence of the low-dimensional representation of the data and the reconstruction errors, and enhances the anomaly detection effect.
Description
Technical Field
The invention belongs to the technical field of industrial control systems, and mainly relates to an industrial control system abnormality detection method based on a variation self-encoder.
Background
The industrial control system (Industrial Control Systems, ICS) is mainly responsible for real-time data acquisition, system monitoring, automatic control and management of industrial processes, etc., and relates to important fields of transportation, water treatment, manufacturing, electric power, metallurgy, etc., which are important components of national key infrastructure. With the development of information technology, industrial control systems have become more informative and intelligent, and as such, industrial control systems are also facing more and more network attack events. An attacker falsifies the operation parameters of the system through an access point, various physical sensors, a brake and the like for attacking network communication, so that the industrial control system deviates from a normal operation state, and the system is abnormal, thereby causing production disorder and even safety accidents of the industrial control system. Because the industrial control system comprises a large number of production equipment, the coupling relation among the equipment is complex, and the abnormality is difficult to discover in time only by means of manual monitoring, so that the research on abnormality detection theory and technology aiming at the industrial control system is necessary.
The anomaly detection algorithm based on machine learning and deep learning has the advantages of no need of accurately modeling an industrial control system, capability of processing large-scale data and the like, and is the mainstream of the current anomaly detection research. The detection algorithm based on learning can be divided into three types of supervised learning, semi-supervised learning and unsupervised learning, and although the detection effect of the abnormal detection based on the supervised learning and the semi-supervised learning has achieved remarkable results, the data of the industrial control system has high latitude and huge quantity, so huge manpower and material resources are required to be consumed for marking the abnormal data, which in practice brings great cost challenges. To solve this problem, it becomes particularly important to develop a detection algorithm based on unsupervised learning, because it does not need to rely on marked abnormal data, and cost can be effectively reduced. Through unsupervised learning, the neural network can learn the normal mode of the system from a large amount of normal data, and when data tampered with by an attacker is input, an index different from the normal mode is generated, so that abnormality is detected. Currently, depth network-based unsupervised detection methods such as an Automatic Encoder (AE), a variable automatic encoder (variable AutoEncoder, VAE), and a generation countermeasure network (Generative Adversarial Networks, GAN) have achieved a certain effect in applications.
However, the prior art often has the following problems in addressing industrial control system anomaly detection: 1) The time correlation among the data at different moments is not considered when the anomaly detection is carried out, or the time correlation is considered in the method for processing the data by using the sliding window technology, but the network needs to process the data at a plurality of moments in the window, so that the number of parameters of the network is increased, and the training difficulty is increased; 2) In the detection method based on the encoder/decoder framework, only the reconstruction error is considered as a detection index to detect the abnormality, and the information contained in the low-dimensional representation extracted by the encoder is not fully utilized.
Disclosure of Invention
The invention aims to provide an industrial control system anomaly detection method based on a variation self-encoder, which overcomes the defects that the time correlation between data at different time points is not considered and the information contained in the low-dimensional representation of the data is not fully utilized in the prior art, so as to realize the unsupervised anomaly detection of an industrial control system.
The technical solution for realizing the purpose of the invention is as follows:
an industrial control system abnormality detection method based on a variation self-encoder comprises the following steps:
s1: collecting industrial control system data;
s2: preprocessing the collected industrial control system data, including converting label data into numerical values, carrying out minimum and maximum normalization processing on the data, and dividing a training data set and a test data set;
s3: constructing a neural network model based on a variation self-encoder, and training the neural network model by using processed normal data: constructing a GRU-VAEGMM network, which comprises a GRU-VAE network and an estimation network, wherein the GRU-VAE network is used for extracting low-dimensional representation of data and reconstruction errors as characteristic variables, and the estimation network is used for modeling the distribution of the characteristic variables by combining with GMM; the GRU-VAE network adds a jump connection layer formed by the GRU network between the encoder and the decoder based on the variation self-encoder network frame; modeling the distribution of the feature variables using an estimation network in combination with the GMM;
s4: obtaining characteristic variables and reconstruction errors of data by using a trained neural network model, calculating sample energy of the characteristic variables by using GMM, taking the sum of the sample energy and the reconstruction errors as a score of the data, and setting a detection threshold according to the distribution of the scores of normal data;
s5: and detecting the test data by using the trained neural network model, obtaining the score of the data to be tested, if the score is smaller than the detection threshold value, the data is normal, and if the score is larger than the detection threshold value, the data is abnormal, and the data can be tampered by an attacker.
Compared with the prior art, the invention has the remarkable advantages that:
1) Considering the time correlation of the data of the industrial control system, the invention enhances the learning ability of the neural network model on the time correlation of the data by adding a jump connection layer formed by GRU network in the encoder and decoder of the variable self-encoder, and the invention does not use a sliding window to process the data, thereby reducing the parameters of the model and leading the model to be lighter;
2) The Gaussian mixture model is used for modeling the low-dimensional representation and the reconstruction error of the data, so that two factors of the low-dimensional representation and the reconstruction error of the data can be comprehensively considered, and the anomaly detection effect is enhanced.
Drawings
FIG. 1 is a flow chart of an industrial control system anomaly detection method based on a variation self-encoder of the present invention;
FIG. 2 is a network architecture diagram of a GRU-VAEGMM network of the present invention;
figure 3 is a block diagram of a GRU network in a GRU-VAE network of the present invention.
Detailed Description
The invention is further described with reference to the drawings and specific embodiments.
In order to make the technical scheme of the invention clearer, the industrial control system abnormality detection method based on the variation self-encoder is further described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention. The invention is realized by the following steps:
s1: collecting industrial control system data:
the collected data includes multivariate time series data generated by each industrial sensor and industrial actuator of the industrial control system. The invention takes the data of the industrial control system in the normal running state as training data and takes the data of the industrial control system under attack as test data. Wherein the training data is used to train the algorithm model and the test data is used to verify the validity of the method of the invention. The invention adopts SWaT (Secure Water Treatment) data set to actually verify the feasibility of the model, wherein the data set comprises 7-day normal operation data and 4-day attack data acquired from a real sewage treatment experiment table, and the data set can be used for evaluating the attack detection effect. The SWaT dataset contains 51-dimensional sensor and actuator data, and 1-dimensional tags. The present invention removes the first 10 ten thousand records in the first 7 days of normal data in the dataset, which corresponds to the period in which the system has not entered a normal operating state. In addition, 7 executors are deleted, and the data are not changed in normal and attack data, and belong to redundant data, so that the training of the network is not facilitated.
S2: preprocessing the collected industrial control system data, which specifically comprises the following steps:
s21: the tag column of the data set is converted into numbers, wherein the tags of the normal data are converted into 0, the tags of the abnormal data are converted into 1, and the data except the tag column are subjected to minimum maximum normalization (Min-Max Normalization) to normalize the value range of each dimension characteristic to [0,1].
S22: the training data set and the test data set are divided, wherein the training data set only comprises data when the system operates normally, namely, the data in the front 7 days in the processed SWaT data set, and the test data set uses the data under attack in the 4 days after the processed SWaT data set.
S3: constructing a neural network model based on a variation self-encoder, and training the neural network model by using processed normal data, wherein the method specifically comprises the following steps of:
s31: the GRU-VAEGMM (Gate Recurrent Unit-Variational AutoEncoders Gaussian Mixture Models) network is constructed, as shown in figure 2, and comprises a GRU-VAE network and an estimation network, wherein the GRU-VAE network is used for extracting low-dimensional representation of data and reconstruction errors as characteristic variables, and the estimation network is used for modeling the distribution of the characteristic variables in combination with GMM.
S311: the GRU-VAE network is constructed for extracting low-dimensional representation and reconstruction errors of data, and based on a traditional variational self-encoder network framework, a jump connection layer formed by GRU is added between an encoder and a decoder, so that the network can learn time correlation between data better. As shown in fig. 3, the GRU network employs reset gates and update gates to control the flow and filtering of information, thereby enabling modeling of long-term dependencies. The forward propagation formula of the GRU network is:
u t ＝σ(W z x t +U z h t-1 +b z )
r t ＝σ(W r x t +U r h t-1 +b r )
wherein u is t Representing an update gate, r t Indicating reset gate, h t-1 Indicating the hidden state at the previous moment,represents the hidden state of the t candidate at the current moment, h t Represents the hidden state, x of the output at the current moment t t Data representing time t, W z 、U z 、W r 、U r 、W h And U h Is a weight parameter of the GRU network, b z 、b r And b h Is a bias parameter of the GRU network, σ represents a nonlinear activation function, ++>Representing a hadamard product operation. Reset gater t The relation between the input at the current moment and the state at the previous moment can be controlled, so that the problems of gradient elimination and explosion are avoided, and the door u is updated t The degree to which the state was preserved at a previous time may be controlled to enable modeling of long-term dependencies.
S312: as shown in FIG. 2, the encoder and decoder of the GRU-VAE network of the present invention are composed of three layers of fully-connected networks, and the outputs of the first two layers of networks in the encoder are respectively processed by using two GRU networks to obtain the hidden stateAndthen the hidden state ++>And->Vector splicing is carried out on the vector and input variables of the two-layer network of the GRU-VAE decoder respectively, and finally the spliced vectors are input into the two-layer full-connection network of the GRU-VAE decoder respectively. The GRU-VAE network uses the time correlation between the GRU network learning data to transfer information from the encoder to the decoder through the hopping connection layer as shown in fig. 2, so that the whole network has the learning ability of the time correlation of the data and the characteristic information of different layers is fused.
S313: as shown in fig. 2, data x is obtained by an encoder of a GRU-VAE network t Low dimensional representation of (2)Mean. Mu.of (A) t Sum of variances sigma t Then x is obtained using resampling techniques t Low-dimensional representation +.>Reconstructed samples are obtained by the decoder>
[μ t ,σ t ]＝h(x t ；θ h )
Wherein x is t Data representing the time instant t is indicated,represents reconstructed samples, h represents the coding function of the encoder, g represents the decoding function of the decoder, θ h And theta g Representing network parameters, epsilon, of the encoder and decoder, respectively t Is distributed from standard normalSampling the obtained data epsilon t Sum sigma t Having the same dimensions, here ε t The subscript of (a) indicates that each time instant sample generates a new epsilon t 。
S314: obtaining data x t Reconstructing a sampleIs>And cosine similarityHere, the term "vector inner product" means "two-norm". The two norms are +.>Cosine similarity->And low-dimensional representation +.>And splicing to obtain characteristic variables:
wherein z is t Representing the extracted feature variables of the GRU-VAE network.
S315: constructing an estimation network for extracting feature variables z for a GRU-VAE network in combination with GMM t Is modeled. Assuming that the GMM comprises K Gaussian sub-models, the GMM is linearly combined by the K Gaussian sub-models, and the characteristic variable z of different Gaussian sub-models of the GMM is obtained by using an estimation network t Is the response of (a):
wherein,representation of GMM for feature variable z t MLN (x) represents a multi-layer neural network, which is the main part of the estimation network in fig. 2, θ m Parameters representing the multi-layer neural network, softmax (x) representing normalization processing, ensuring that the K Gaussian sub-models of the GMM are specific to the characteristic variable z t The sum of the responsivity of (2) is 1.
S32: using GMM for feature variable z t Modeling of distribution of (2) based on a GRU-VAE network derived feature variable z t And estimating network derived responsivityEstimating parameters of the GMM, wherein the parameters to be estimated comprise weight coefficients of different Gaussian sub-models +.>Mean->And covariance matrix->
Wherein N represents a characteristic variable z for estimating GMM parameters t And responsivityNumber t of (2) 0 Representing the starting time of the data participating in the calculation, selecting t E [ t ] 0 ,t 0 +N]Data of corresponding N moments participate in the calculation, < + >>Representing the kth Gaussian sub-model for the feature variable z t Responsiveness of->Representation->Is superscript () T Representing the transpose of the vector or matrix.
S33: calculating the characteristic variable z according to the parameters of the obtained GMM t Is a sample energy of (2):
wherein E (z) t ) Is the characteristic variable z t Is the matrix determinant.
S34: determining a loss function used for training the neural network:
where L is a loss function, in the first term of LRepresenting data x t Is used to reconstruct the error of the (c) image, | x I 2 Representing first two norms and then squares, < +.>Representation +.>And->Kullback-Leibler divergence of (c),representing a low-dimensional representation obtained by the encoder of the GRU-VAE network>Distribution of->Representing the desired low-dimensional representation +.>Distribution of (3)Here set to a standard normal distribution; e (z) in the second term of L t ) Is the characteristic variable z defined in step S33 t Is a sample energy of (a); the third term of L is to avoid covariance matrix +.>Singularities occur, penalizing small values on diagonal elements of the covariance matrix, where D represents the covariance matrix +.>Diagonal element number of>Representing covariance matrix->The j-th value on the diagonal, K is the number of GMM Gaussian sub-models, and the parameter lambda 1 And lambda (lambda) 2 The weight coefficient representing the loss function L.
S35: and training the GRU-VAEGMM network based on the loss function L of S34, stopping training after the training reaches a set round, and storing trained neural network parameters for use in detection.
S4: calculating the score of normal data by using a trained neural network model, and setting a detection threshold according to the distribution of the score, wherein the method specifically comprises the following steps of:
s41: calculating responsiveness of normal data using trained GRU-VAEGMM networkThen calculate the weight coefficient of each Gaussian sub-model of GMM according to the formula in step S32 +.>Mean->And covariance matrix->
S42: calculation data x t Is a score of (2):
wherein S is t Representing data x t Score of E (z) t ) Is the characteristic variable z defined in step S33 t Is used for the measurement of the energy of the sample,is data x t Is used to reconstruct the error of the error. If x t Is abnormal data, x t And characteristic variable z t Will deviate from the normal distribution, then the sample energy E (z t ) And reconstruction error->Will be a larger value and thus score S t A larger value is also obtained, otherwise, the score S of the normal data t Will be smaller and can therefore be based on the score S t To determine whether the data is anomalous.
S43: further, the score of all normal data used for training is calculated, and the value at the 95% horizontal line is taken as the detection threshold th.
S5: detecting the test data by using the trained neural network model, as shown in the anomaly detection flow in fig. 1, by calculating the score S of the data to be tested t Then judging whether an abnormality occurs according to the comparison result with the threshold th:
wherein Anomaly indicates abnormal data, normal indicates Normal data, if S t A score less than the detection threshold th indicates that the data is normalFor example, score S t If the detection threshold th is greater than or equal to the detection threshold th, the data is abnormal, and the data may be tampered by an attacker.
The above disclosure is intended to be illustrative of only the preferred embodiments of the invention and not exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in detail in order to best explain the principles of the invention and the practical application, to thereby enable others skilled in the art to best understand and utilize the invention. The invention is limited only by the claims and the full scope and equivalents thereof.
Claims (9)
1. The industrial control system abnormality detection method based on the variation self-encoder is characterized by comprising the following steps of:
s1: collecting industrial control system data;
s2: preprocessing the collected industrial control system data, including converting label data into numerical values, carrying out minimum and maximum normalization processing on the data, and dividing a training data set and a test data set;
s3: constructing a neural network model based on a variation self-encoder, and training the neural network model by using processed normal data: constructing a GRU-VAEGMM network, which comprises a GRU-VAE network and an estimation network, wherein the GRU-VAE network is used for extracting low-dimensional representation of data and reconstruction errors as characteristic variables, and the estimation network is used for modeling the distribution of the characteristic variables by combining with GMM; the GRU-VAE network adds a jump connection layer formed by the GRU network between the encoder and the decoder based on the variation self-encoder network frame; modeling the distribution of the feature variables using an estimation network in combination with the GMM;
s4: obtaining characteristic variables and reconstruction errors of data by using a trained neural network model, calculating sample energy of the characteristic variables by using GMM, taking the sum of the sample energy and the reconstruction errors as a score of the data, and setting a detection threshold according to the distribution of the scores of normal data;
s5: and detecting the test data by using the trained neural network model, obtaining the score of the data to be tested, if the score is smaller than the detection threshold value, the data is normal, and if the score is larger than the detection threshold value, the data is abnormal, and the data can be tampered by an attacker.
2. The method for detecting abnormality of industrial control system based on variational self-encoder as claimed in claim 1, wherein the encoder and decoder of the GRU-VAE network are both composed of three layers of fully-connected networks, and the outputs of the first two layers of networks in the encoder are processed by using two GRU networks respectively to obtain hidden statesAnd->Then the hidden state ++>Andvector splicing is carried out on the vector and input variables of the two-layer network of the GRU-VAE decoder respectively, and finally the spliced vectors are input into the two-layer full-connection network of the GRU-VAE decoder respectively.
3. The method for anomaly detection in an industrial control system based on a variable component self-encoder of claim 1, wherein the encoder via a GRU-VAE network obtains the data x t Low dimensional representation of (2)Mean. Mu.of (A) t Sum of variances sigma t Then get x t Low-dimensional representation +.>By decoding againThe device obtains reconstructed samples->
[μ t ,σ t ]＝h(x t ；θ h )
Wherein x is t Data representing the time instant t is indicated,represents reconstructed samples, h represents the coding function of the encoder, g represents the decoding function of the decoder, θ h And theta g Representing network parameters, epsilon, of the encoder and decoder, respectively t Is distributed from normal>Sampling the obtained data, < > data>Representing a hadamard product operation.
4. The method for anomaly detection in an industrial control system based on a variable self-encoder of claim 1, wherein the characteristic variables extracted by the GRU-VAE network are expressed as:
wherein the method comprises the steps ofRepresenting data x t And reconstruct samples->Is>Representing data x t And reconstruct samples->Is the cosine similarity of (1), represents the vector inner product, ali represents ali solving a binary norm; z t Representing the extracted feature variables of the GRU-VAE network.
5. The variation self-encoder based industrial control system anomaly detection method of claim 1, wherein the constructed neural network model has a loss function of:
where L is the loss function, | x I 2 Representing a first two-norms and then a square,representation calculationAnd->Kullback-Leibler divergence,/-for (b)>Representing a low-dimensional representation obtained by the encoder of the GRU-VAE network>Distribution of->Representing the desired low-dimensional representation +.>D represents the covariance matrix +.>Diagonal element number of>Representing covariance matrix->The j-th value on the diagonal, K is the number of GMM Gaussian sub-models, parameter lambda 1 And lambda (lambda) 2 A weight coefficient representing a loss function L; t is t 0 Representing the starting moment of the data involved in the calculation, N represents the characteristic variable z for estimating the GMM parameter t Number of (E) (z t ) Is the characteristic variable z t Is a sample of the energy of the sample.
6. The method for anomaly detection in an industrial control system based on a variable self-encoder as claimed in claim 5, wherein the characteristic variable z t Sample energy E (z) t ):
Wherein the method comprises the steps ofRespectively representing a weight coefficient, a mean value and a covariance matrix of the Gaussian sub-model; k represents the Gaussian model numberThe number, k, represents the kth gaussian sub-model, |x| represents the matrix determinant.
7. The anomaly detection method for an industrial control system based on a variational self-encoder according to claim 6, wherein the parameter calculation formula of the gaussian sub-model is:
wherein the method comprises the steps ofRepresenting the kth Gaussian sub-model for the feature variable z t Responsivity.
8. The anomaly detection method for industrial control system based on a variational self-encoder according to claim 7, wherein the gaussian mixture model obtained by the estimation network is specific to the characteristic variable z t The responsivity of (2) is:
wherein,representing the characteristic variable z of the Gaussian mixture model t MLN (x) represents the responsiveness of the multilayer neural network, θ m Parameters representing the multilayered neural network, softmax (x) representing the normalizationReason (I)>Representation->Is the kth element of (c).
9. The anomaly detection method for an industrial control system based on a variable self-encoder according to claim 6, wherein the score calculation formula of the data is:
wherein S is t Representing data x t Is a score of (2).
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311114361.4A CN117055527A (en) | 2023-08-31 | 2023-08-31 | Industrial control system abnormality detection method based on variation self-encoder |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311114361.4A CN117055527A (en) | 2023-08-31 | 2023-08-31 | Industrial control system abnormality detection method based on variation self-encoder |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117055527A true CN117055527A (en) | 2023-11-14 |
Family
ID=88660772
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311114361.4A Pending CN117055527A (en) | 2023-08-31 | 2023-08-31 | Industrial control system abnormality detection method based on variation self-encoder |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117055527A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118607743A (en) * | 2024-08-07 | 2024-09-06 | 中国信息通信研究院 | Emergency material transportation planning method and system |
-
2023
- 2023-08-31 CN CN202311114361.4A patent/CN117055527A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118607743A (en) * | 2024-08-07 | 2024-09-06 | 中国信息通信研究院 | Emergency material transportation planning method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112101480B (en) | Multivariate clustering and fused time sequence combined prediction method | |
| CN108398268B (en) | Bearing performance degradation evaluation method | |
| CN112087442B (en) | Time sequence related network intrusion detection method based on attention mechanism | |
| CN110516735B (en) | Natural gas pipeline event classification method based on LSTM network and Adam algorithm | |
| Zhang et al. | A novel fault diagnosis method based on stacked LSTM | |
| CN111352977A (en) | Time sequence data monitoring method based on self-attention bidirectional long-short term memory network | |
| Xu et al. | Global attention mechanism based deep learning for remaining useful life prediction of aero-engine | |
| WO2021114320A1 (en) | Wastewater treatment process fault monitoring method using oica-rnn fusion model | |
| Peng et al. | Fault detection of urban wastewater treatment process based on combination of deep information and transformer network | |
| Li et al. | A novel anomaly detection method for digital twin data using deconvolution operation with attention mechanism | |
| CN112327701B (en) | Slow characteristic network monitoring method for nonlinear dynamic industrial process | |
| CN117055527A (en) | Industrial control system abnormality detection method based on variation self-encoder | |
| CN116975645A (en) | Industrial process soft measurement modeling method based on VAE-MRCNN | |
| Yang et al. | Teacher–Student Uncertainty Autoencoder for the Process-Relevant and Quality-Relevant Fault Detection in the Industrial Process | |
| KR102366787B1 (en) | Real-time sliding window based anomaly detection system for multivariate data generated by manufacturing equipment | |
| Tang et al. | Prediction of bearing performance degradation with bottleneck feature based on LSTM network | |
| CN112381213A (en) | Industrial equipment residual life prediction method based on bidirectional long-term and short-term memory network | |
| CN114401135B (en) | Internal threat detection method based on LSTM-Attention user and entity behavior analysis technology | |
| CN116680639A (en) | Deep-learning-based anomaly detection method for sensor data of deep-sea submersible | |
| Gu et al. | Research on prediction of remaining useful life of underwater turntable based on slow feature analysis | |
| Zhong et al. | Industrial Robot Vibration Anomaly Detection Based on Sliding Window One‐Dimensional Convolution Autoencoder | |
| Zhao et al. | Software reliability growth model based on fuzzy wavelet neural network | |
| Liu et al. | Prediction of hydraulic pumps remaining useful life based on LSTM and Transform with dual self-attention | |
| Xiaozhi et al. | Fault Diagnosis Based on Sparse Semi-supervised GAN Model | |
| Zhou et al. | Bearing life prediction method based on parallel multichannel recurrent convolutional neural network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |