CN116820896B - Physical signal-based non-invasive industrial control terminal abnormality detection method - Google Patents
Physical signal-based non-invasive industrial control terminal abnormality detection method Download PDFInfo
- Publication number
- CN116820896B CN116820896B CN202311103329.6A CN202311103329A CN116820896B CN 116820896 B CN116820896 B CN 116820896B CN 202311103329 A CN202311103329 A CN 202311103329A CN 116820896 B CN116820896 B CN 116820896B
- Authority
- CN
- China
- Prior art keywords
- time
- industrial control
- control terminal
- sample
- physical signals
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000005856 abnormality Effects 0.000 title claims abstract description 33
- 238000001514 detection method Methods 0.000 title claims abstract description 21
- 238000000034 method Methods 0.000 claims abstract description 26
- 230000002159 abnormal effect Effects 0.000 claims abstract description 25
- 238000012549 training Methods 0.000 claims abstract description 24
- 238000011524 similarity measure Methods 0.000 claims description 9
- 239000013598 vector Substances 0.000 claims description 9
- 238000012423 maintenance Methods 0.000 claims description 8
- 238000007781 pre-processing Methods 0.000 claims description 6
- 210000005036 nerve Anatomy 0.000 claims description 5
- 238000005516 engineering process Methods 0.000 claims description 3
- 238000005259 measurement Methods 0.000 claims description 3
- 238000012544 monitoring process Methods 0.000 claims description 3
- 241000764238 Isis Species 0.000 claims 3
- 238000004458 analytical method Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 2
- 238000013136 deep learning model Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 1
- 238000011217 control strategy Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000003062 neural network model Methods 0.000 description 1
- 238000007500 overflow downdraw method Methods 0.000 description 1
- 230000002688 persistence Effects 0.000 description 1
- 238000011897 real-time detection Methods 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 238000011895 specific detection Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3058—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations
- G06F11/3062—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations where the monitored property is the power consumption
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3024—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a central processing unit [CPU]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
- G06N3/0455—Auto-encoder networks; Encoder-decoder networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Artificial Intelligence (AREA)
- Health & Medical Sciences (AREA)
- Life Sciences & Earth Sciences (AREA)
- Quality & Reliability (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Software Systems (AREA)
- Alarm Systems (AREA)
Abstract
The invention discloses a non-invasive industrial control terminal abnormality detection method based on physical signals, which comprises the following steps: physical signal acquisition is carried out aiming at the power consumption of the terminal and the running state of the CPU; the method comprises the steps of collecting physical signals in a normal operation period of an industrial control terminal, transmitting the physical signals to computing equipment through a network for model training, constructing a complete portrait of normal operation of a service, and using the complete portrait as a base line to realize abnormal detection of the industrial control terminal; detecting an industrial control terminal in real time, calculating a predicted value at the time t, and judging whether the time t is a normal sample according to the difference between the predicted value and an actual value; if the number of detected abnormality times in a time window with a fixed length exceeds a preset alarm upper limit value, judging that the running state of the terminal is abnormal, and sending an alarm. The invention has high abnormality detection accuracy, strong universality and high flexibility, and is suitable for abnormality detection occasions of various industrial control terminals.
Description
Technical Field
The invention relates to the field of industrial control system terminal equipment safety, in particular to a non-invasive industrial control terminal abnormality detection method based on physical signals.
Background
The industrial control system is a national key information infrastructure, plays a key role in meeting the living demands of people, guaranteeing the sustainable development of economy and the like, and relates to national economic pulse and social stability. If the industrial control system suffers from malicious attack or system failure, the national economy safety and sustainable development can be influenced, and even social turbulence is caused. In order to ensure safe and stable operation of the industrial control system, various types of industrial control terminals are widely deployed in the system, potential malicious attacks possibly suffered by the system are prevented, and the availability, confidentiality, integrity and persistence of the industrial control system are ensured.
The industrial control terminal is widely applied to various industrial control fields such as traffic, finance, electric power, medical treatment, the Internet of things and the like, mainly performs tasks such as data acquisition and operation control, and plays a great role in ensuring stable operation of an industrial control system. However, the normal operation of industrial control terminals themselves is facing a great challenge: (1) The industrial control terminal is operated in overload for many years, can not be stopped for maintenance for a long time, and is difficult to dynamically upgrade on line; (2) The industrial control terminal lacks comprehensive and effective safety protection means, and is difficult to cope with daily and monthly network safety threat challenges; (3) The operation and maintenance after the failure of part of industrial control terminals depends on manufacturer support, the timeliness of problem response is poor, and quick recovery is difficult.
Conventional security operation and maintenance means generally include vulnerability scanning, access control policy, intrusion security detection, etc., however, many proprietary industrial control terminals are difficult to adapt to the conventional security operation and maintenance means: (1) The requirement of continuous and stable operation of the industrial control terminal and limited system resources are difficult to tolerate high-frequency vulnerability scanning; (2) The strict access control strategy can only ensure identity authentication and access management, and is difficult to protect against the existing defects of the industrial control terminal in other aspects such as an operating system, a communication protocol and the like; (3) The invasive security detection needs to be combined with the service, has low universality, can influence the real-time performance of the service operation of the industrial control terminal, and even introduces potential security risks.
Disclosure of Invention
The invention aims to: the invention aims to provide a non-invasive industrial control terminal abnormality detection method with high accuracy and based on physical signals.
The technical scheme is as follows: the invention comprises the following steps:
(1) Implanting a lightweight script for information acquisition into a Linux operating system of an industrial control terminal, and acquiring physical signals aiming at terminal power consumption and CPU running state;
(2) The method comprises the steps of collecting physical signals in a normal operation period of an industrial control terminal, transmitting the physical signals to computing equipment through a network to perform model training, sorting the collected data into a time sequence, preprocessing the data, training a nerve network model based on a transducer, constructing a complete portrait of normal operation of the service, and using the complete portrait as a base line to realize abnormal detection of the industrial control terminal;
(3) After the training of the Transformer network is finished, detecting the industrial control terminal in real time, collecting physical signals at the time t as actual values, combining data at the time t-1 before as input of the Transformer network, calculating a predicted value at the time t, and judging whether the time t is a normal sample according to the difference between the predicted value and the actual value;
(4) Continuously monitoring the industrial control terminal, and if the number of detected abnormality times in a time window with a fixed length exceeds a preset alarm upper limit value, judging that the running state of the terminal is abnormal and giving an alarm.
Further, the CPU running state in the step (1) includes CPU idle time, CPU occupancy rate, interrupt times, and system call times.
Further, the step (1) is based on a fixed time intervalThe physical signal is collected and the physical signal is collected,fixed time interval->Is set by the user according to the actual situation.
Further, the step (2) includes:
(2.1) data preprocessing is performed on the collected physical signals by using a standardized noise reduction technology to obtain time sequence dataWherein->Physical signal vector representing time t, +.>，/>Representing the system power consumption at time t +.>Indicating CPU idle time, +.>Representing CPU occupancy information,>indicates the number of interruptions from time t-1 to time t,/-, and>representing the number of system calls from time t-1 to time t, and splicing the data containing CPU multi-core physical signals into feature vectors;
(2.2) constructing data samples for training, i.e., physical Signal vectors at the previous t-1 momentsAs model input data, in ∈>As a means ofPredicting output data by the model;
and (2.3) training a nerve network model based on a transducer on the basis of the data samples, wherein the model is used for detecting abnormal samples after training.
Further, in the step (2.1), the time t also represents the number of sample records, and the number is set by the user according to the actual situation.
Further, the step (3) includes:
(3.1) the script in the industrial control terminal collects the physical signal of the terminal operation in real time and sends the physical signal to the computing equipment, and the computing equipment preprocesses the received physical signal to obtain the actual value of the sample to be detected；
(3.2) sample records based on the first t moments stored within the computing deviceCalculating to obtain a predicted sample +.A predicted sample at the time t by using a trained transducer network>；
(3.3) calculating prediction samples Using cosine similarityAnd the actual value of the sample to be tested->Similarity measure between->；
(3.4) comparing the current sample to be tested according to the calculated similarity measurement valueMake a judgment if->Greater thanEqual to a pre-set similarity measure threshold +.>Judging that the current sample to be tested has no abnormality, if +.>Less than->Judging that the current sample to be tested is abnormal;
(3.5) updating the sample records of the first t moments stored in the computing device, and if it is determined that there is no abnormality in the current sample, the actual value is calculatedAdding sample record, i.e. use->Calculating a model input value of a prediction sample as the time t+1, otherwise, the prediction value +.>Adding sample record, i.e. use->The model input value of the prediction sample is calculated as time t+1.
Further, a similarity measure threshold in step (3.4)Is set by the user according to the actual situation.
Further, the step (4) includes:
(4.1) sample to be tested at time tWhen it is judged to be abnormal, the program is judged to be in accordance with a predetermined time window length +.>Counting the time T-T to time TThe number of anomalies present;
(4.2) when the total number of occurrences of the abnormality exceeds a preset alarm upper limit valueAnd when the system is used, an alarm is sent to a safety operation and maintenance personnel.
Further, the time window in step (4.1)Is set by the user according to the actual situation.
Further, the alarm upper limit value in the step (4.2)Is set by the user according to the actual situation.
The beneficial effects are that: compared with the prior art, the invention has the following remarkable advantages: the method can monitor the running state of the industrial control terminal in real time, and once an abnormal condition occurs, the abnormal condition can be immediately found and alarmed to inform safety operation and maintenance personnel to process in time; the method is non-invasive, only a lightweight script is needed to be implanted in the industrial control terminal, the occupied original system resources are very few, and the method is completely decoupled with service operation; the Transformer network used in the method belongs to an unsupervised model, and the model training process only needs to use the physical signal data collected by the normal operation of the industrial control terminal, does not need additional abnormal samples, and avoids the problem of unbalance of positive and negative samples of a common training set; the method has high abnormality detection accuracy, and can detect the abnormal operation state of the industrial control terminal immediately and efficiently and alarm; the method is strong in universality and high in flexibility, and is suitable for abnormality detection occasions of various industrial control terminals.
Drawings
FIG. 1 is a flow chart of the present invention;
FIG. 2 is a schematic diagram of an industrial control terminal anomaly detection system deployment;
FIG. 3 is a block diagram of an industrial control terminal abnormality detection method.
Description of the embodiments
The technical scheme of the invention is further described below with reference to the accompanying drawings.
As shown in fig. 1, the method is realized based on a transducer model, and comprises the following steps:
(1) A lightweight script for information acquisition is implanted in the Linux operating system of the industrial control terminal, aiming at physical signals such as terminal power consumption, CPU running state (including CPU idle time, CPU occupancy rate, interrupt times and system call times) and the like, acquisition is carried out based on fixed time intervals,
aiming at the problem of physical signal acquisition of the running state of an industrial control terminal, the method writes an information acquisition script based on the instruction of a Linux operating system at fixed time intervalsInformation such as terminal power consumption, CPU running state (including CPU idle time, CPU occupancy rate, interrupt times and system call times) and the like is collected,
the normal service operation of the industrial control terminal occupies corresponding system resources, and further power consumption and CPU call are generated, so that the physical signals can reflect the operation state of the industrial control terminal.
(2) The method comprises the steps of collecting physical signals in a normal operation period of an industrial control terminal, transmitting the physical signals to computing equipment through a network for model training, and finishing the collected data into a time sequence as shown in fig. 2, preprocessing the data, training a neural network model based on a Transformer, constructing a complete portrait of normal operation of the service, and using the complete portrait as a base line for realizing abnormal detection of the industrial control terminal, wherein the specific training steps are as follows:
(2.1) data preprocessing is performed on the collected physical signals by using a standardized noise reduction technology to obtain time sequence dataWherein->Physical signal vector representing time t, +.>，/>Representing the system power consumption at time t +.>Indicating CPU idle time, +.>Representing CPU occupancy information,>indicates the number of interruptions from time t-1 to time t,/-, and>representing the number of system calls from time t-1 to time t, splicing the data containing CPU multi-core physical signals into feature vectors,
(2.2) constructing data samples for training, i.e., physical Signal vectors at the previous t-1 momentsAs model input data, in ∈>As the model predictive output data,
and (2.3) training a nerve network model based on a transducer on the basis of the data samples, wherein the model is used for detecting abnormal samples after training.
(3) After the training of the transducer network is completed, the industrial control terminal is detected in real time, physical signal data at the t moment is collected to be used as an actual value, the data at the t-1 moment is combined to be used as input of the transducer network, a predicted value at the t moment is calculated, and whether the t moment is a normal sample or not is judged according to the difference between the predicted value and the actual value, as shown in fig. 3. The specific detection process comprises the following steps:
(3.1) the script in the industrial control terminal collects the physical signal of the terminal operation in real time and sends the physical signal to the computing equipmentThe computing equipment preprocesses the received physical signals to obtain the actual value of the sample to be tested，
(3.2) sample records based on the first t moments stored within the computing deviceCalculating to obtain a predicted sample +.A predicted sample at the time t by using a trained transducer network>，
(3.3) calculating prediction samples Using cosine similarityAnd the actual value of the sample to be tested->Similarity measure between->，
(3.4) comparing the current sample to be tested according to the calculated similarity measurement valueMake a judgment if->Is greater than or equal to a preset similarity measure threshold +.>Judging that the current sample to be tested has no abnormality, if +.>Less than->Judging that the current sample to be tested is abnormal,
(3.5) updating storage in a computing deviceThe stored sample records at the first t moments, if the current sample is judged to have no abnormality, the actual value is obtainedAdding sample record, i.e. use->Calculating a model input value of a prediction sample as the time t+1, otherwise, the prediction value +.>Adding sample record, i.e. use->The model input value of the prediction sample is calculated as time t+1.
(4) And continuously monitoring the industrial control terminal, and once the number of detected abnormality times in a time window with a fixed length exceeds a preset alarm upper limit value, judging that the running state of the terminal is abnormal and sending an alarm.
(4.1) sample to be tested at time tWhen it is judged to be abnormal, the program is judged to be in accordance with a predetermined time window length +.>Counting the abnormal times from the T-T moment to the T moment,
(4.2) when the total number of occurrences of the abnormality exceeds a preset alarm upper limit valueAnd when the system is used, an alarm is sent to a safety operation and maintenance personnel.
In the four steps, the number t of sample records and the sampling time intervalSimilarity measure threshold->Time windowAlarm upper limit value->The parameters can be set by the user according to the actual situation.
The invention is based on the side channel analysis facing to the physical signal, assists in constructing an industrial control terminal abnormality detection system by a deep learning model, constructs a physical signal baseline standard for normal operation of the industrial control terminal by a fusion method of physical signal information analysis and the deep learning model, realizes real-time detection of the abnormal operation state of the industrial control terminal on the premise of not disturbing normal service as much as possible, and solves the non-invasive abnormality detection problem of the industrial control terminal. In addition, the method uses an unsupervised model learning method, and the model training process only needs to use the physical signal data collected by the normal operation of the industrial control terminal, does not need additional abnormal samples, and avoids the problem of unbalance of positive and negative samples of a common training set. Compared with the prior art, the method has strong universality and high flexibility, ensures the safe and stable operation of the industrial control terminal, and is beneficial to improving the safety protection level of the industrial control system.
Claims (8)
1. A non-invasive industrial control terminal abnormality detection method based on physical signals is characterized by comprising the following steps:
(1) Implanting a lightweight script for information acquisition into a Linux operating system of an industrial control terminal, and acquiring physical signals aiming at terminal power consumption and CPU running state;
(2) The method comprises the steps of collecting physical signals in a normal operation period of an industrial control terminal, transmitting the physical signals to computing equipment through a network to perform model training, sorting the collected data into a time sequence, preprocessing the data, training a nerve network model based on a transducer, constructing a complete portrait of normal operation of the service, and using the complete portrait as a base line to realize abnormal detection of the industrial control terminal;
(3) After the training of the Transformer network is finished, detecting the industrial control terminal in real time, collecting physical signals at the time t as actual values, combining data at the time t-1 before as input of the Transformer network, calculating a predicted value at the time t, and judging whether the time t is a normal sample according to the difference between the predicted value and the actual value;
(4) Continuously monitoring the industrial control terminal, judging that the running state of the terminal is abnormal if the number of the detected abnormality exceeds the preset alarm upper limit value in a time window with a fixed length, sending an alarm,
the step (2) comprises:
(2.1) data preprocessing is performed on the collected physical signals by using a standardized noise reduction technology to obtain time sequence dataWherein->Physical signal vector representing time t, +.>，/>Representing the system power consumption at time t +.>Indicating CPU idle time, +.>Representing CPU occupancy information,>indicates the number of interruptions from time t-1 to time t,/-, and>representing the number of system calls from time t-1 to time t, and splicing the data containing CPU multi-core physical signals into feature vectors;
(2.2) constructing data samples for training, i.e., physical Signal vectors at the previous t-1 momentsAs model input data, in ∈>Predicting output data as a model;
(2.3) training a nerve network model based on a transducer on the basis of the data samples, wherein the model is used for detecting abnormal samples after training,
the step (3) comprises:
(3.1) the script in the industrial control terminal collects the physical signal of the terminal operation in real time and sends the physical signal to the computing equipment, and the computing equipment preprocesses the received physical signal to obtain the actual value of the sample to be detected；
(3.2) sample records based on the first t moments stored within the computing deviceCalculating to obtain a predicted sample +.A predicted sample at the time t by using a trained transducer network>；
(3.3) calculating prediction samples Using cosine similarityAnd the actual value of the sample to be tested->Similarity measure between；
(3.4) comparing the current sample to be tested according to the calculated similarity measurement valueMake a judgment if->Is greater than or equal to a preset similarity measure threshold +.>Judging that the current sample to be tested has no abnormality, if +.>Less than->Judging that the current sample to be tested is abnormal;
(3.5) updating the sample records of the first t moments stored in the computing device, and if it is determined that there is no abnormality in the current sample, the actual value is calculatedAdding sample record, i.e. use->Calculating a model input value of a prediction sample as the time t+1, otherwise, the prediction value +.>Adding sample record, i.e. use->The model input value of the prediction sample is calculated as time t+1.
2. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 1, wherein the CPU running state in step (1) includes CPU idle time, CPU occupancy rate, interrupt number and system call number.
3. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 1, wherein in the step (1), the detection is based on a fixed time intervalCollecting physical signal at fixed time interval>Is set by the user according to the actual situation.
4. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 1, wherein the time t in the step (2.1) also represents the number of sample records, and is set by a user according to actual conditions.
5. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 1, wherein the similarity measure threshold in step (3.4) isIs set by the user according to the actual situation.
6. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 1, wherein the step (4) includes:
(4.1) sample to be tested at time tWhen it is judged to be abnormal, the program is judged to be in accordance with a predetermined time window length +.>Counting the abnormal times from the T-T moment to the T moment;
(4.2) when the total number of occurrences of the abnormality exceeds a preset alarm upper limit valueAnd when the system is used, an alarm is sent to a safety operation and maintenance personnel.
7. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 6, wherein the time window in the step (4.1) isIs set by the user according to the actual situation.
8. The method for detecting abnormality of a non-invasive industrial control terminal based on physical signals according to claim 6, wherein the alarm upper limit value in the step (4.2) isIs set by the user according to the actual situation.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311103329.6A CN116820896B (en) | 2023-08-30 | 2023-08-30 | Physical signal-based non-invasive industrial control terminal abnormality detection method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311103329.6A CN116820896B (en) | 2023-08-30 | 2023-08-30 | Physical signal-based non-invasive industrial control terminal abnormality detection method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116820896A CN116820896A (en) | 2023-09-29 |
| CN116820896B true CN116820896B (en) | 2023-11-24 |
Family
ID=88118854
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311103329.6A Active CN116820896B (en) | 2023-08-30 | 2023-08-30 | Physical signal-based non-invasive industrial control terminal abnormality detection method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116820896B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2022142120A1 (en) * | 2020-12-31 | 2022-07-07 | 平安科技（深圳）有限公司 | Data detection method and apparatus based on artificial intelligence, and server and storage medium |
| WO2023030513A1 (en) * | 2021-09-05 | 2023-03-09 | 汉熵通信有限公司 | Internet of things system |
| CN115794584A (en) * | 2022-11-24 | 2023-03-14 | 电子科技大学长三角研究院(湖州) | Transformer-based chip whole-chip temperature distribution prediction method, system and medium |
| CN116126569A (en) * | 2022-11-01 | 2023-05-16 | 中国工商银行股份有限公司 | Intelligent operation and maintenance method and device |
-
2023
- 2023-08-30 CN CN202311103329.6A patent/CN116820896B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2022142120A1 (en) * | 2020-12-31 | 2022-07-07 | 平安科技（深圳）有限公司 | Data detection method and apparatus based on artificial intelligence, and server and storage medium |
| WO2023030513A1 (en) * | 2021-09-05 | 2023-03-09 | 汉熵通信有限公司 | Internet of things system |
| CN116126569A (en) * | 2022-11-01 | 2023-05-16 | 中国工商银行股份有限公司 | Intelligent operation and maintenance method and device |
| CN115794584A (en) * | 2022-11-24 | 2023-03-14 | 电子科技大学长三角研究院(湖州) | Transformer-based chip whole-chip temperature distribution prediction method, system and medium |
Non-Patent Citations (2)
| Title |
|---|
| 基于机器学习的电力物联网终端设备安全监测技术研究;厉彦杰;《中国优秀硕士学位论文全文数据库 (工程科技Ⅱ辑)》(第8期);C042-420 * |
| 基于深度学习的变压器故障诊断方法研究;杨涛;黄军凯;许逵;吴建蓉;陈仕军;;电力大数据(06);29-36 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116820896A (en) | 2023-09-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106888205B (en) | Non-invasive PLC anomaly detection method based on power consumption analysis | |
| WO2019200944A1 (en) | Physical intrusion attack detection method for industrial control system based on serial communication bus signal analysis | |
| CN111669375B (en) | Online safety situation assessment method and system for power industrial control terminal | |
| CN114584405B (en) | Electric power terminal safety protection method and system | |
| CN112995161B (en) | Network security situation prediction system based on artificial intelligence | |
| CN114124478B (en) | Method and system for detecting abnormal industrial control flow of power system | |
| CN111740975A (en) | Network security situation awareness system and method | |
| US11657150B2 (en) | Two-dimensionality detection method for industrial control system attacks | |
| CN113670434A (en) | Transformer substation equipment sound abnormality identification method and device and computer equipment | |
| CN115348080A (en) | Network equipment vulnerability comprehensive analysis system and method based on big data | |
| CN115378711A (en) | Industrial control network intrusion detection method and system | |
| CN108809706A (en) | A kind of network risks monitoring system of substation | |
| CN116820896B (en) | Physical signal-based non-invasive industrial control terminal abnormality detection method | |
| CN113721569A (en) | Attack intrusion detection device and method for distributed control system | |
| CN112272176A (en) | Network security protection method and system based on big data platform | |
| CN107277070A (en) | A kind of computer network instrument system of defense and intrusion prevention method | |
| Liao et al. | Research on network intrusion detection method based on deep learning algorithm | |
| CN108924129A (en) | One kind being based on computer network instrument system of defense and intrusion prevention method | |
| CN112787863B (en) | Remote operation and maintenance secure communication method and device and computer readable storage medium | |
| CN115333849A (en) | Computer network safety intrusion detection system | |
| CN112087436A (en) | Monitoring system for information network engineering supervision | |
| CN111103487A (en) | Non-invasive PST anomaly monitoring method based on power consumption analysis | |
| CN117811839B (en) | Network security monitoring device and method for monitoring Internet of things equipment | |
| CN116915506B (en) | Abnormal flow detection method and device, electronic equipment and storage medium | |
| CN113743326B (en) | Safety belt wearing state monitoring system, method, device and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |