CN113094860A - Industrial control network flow modeling method based on attention mechanism - Google Patents
Industrial control network flow modeling method based on attention mechanism Download PDFInfo
- Publication number
- CN113094860A CN113094860A CN202110475603.7A CN202110475603A CN113094860A CN 113094860 A CN113094860 A CN 113094860A CN 202110475603 A CN202110475603 A CN 202110475603A CN 113094860 A CN113094860 A CN 113094860A
- Authority
- CN
- China
- Prior art keywords
- industrial control
- control network
- flow
- network flow
- attention mechanism
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F30/00—Computer-aided design [CAD]
- G06F30/10—Geometric CAD
- G06F30/18—Network design, e.g. design based on topological or interconnect aspects of utility systems, piping, heating ventilation air conditioning [HVAC] or cabling
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F30/00—Computer-aided design [CAD]
- G06F30/20—Design optimisation, verification or simulation
- G06F30/27—Design optimisation, verification or simulation using machine learning, e.g. artificial intelligence, neural networks, support vector machines [SVM] or training a model
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2111/00—Details relating to CAD techniques
- G06F2111/02—CAD in a network environment, e.g. collaborative CAD or distributed simulation
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Evolutionary Computation (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Geometry (AREA)
- Artificial Intelligence (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Data Mining & Analysis (AREA)
- Biophysics (AREA)
- Mathematical Physics (AREA)
- Biomedical Technology (AREA)
- Life Sciences & Earth Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Mathematical Analysis (AREA)
- Mathematical Optimization (AREA)
- Pure & Applied Mathematics (AREA)
- Computational Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Medical Informatics (AREA)
- Feedback Control In General (AREA)
- Traffic Control Systems (AREA)
Abstract
The invention discloses an attention mechanism-based industrial control network flow modeling method, which comprises the steps of collecting communication flow between an upper computer and a lower computer in an industrial control network to generate an industrial control network flow matrix, constructing a neural network framework to model the industrial control network flow, extracting industrial control network flow characteristics, and predicting the flow of the industrial control network at the next moment by inputting historical industrial control network flow. The method comprises the following steps: the flow collection and pretreatment are in charge of collecting and pretreating industrial control network flow data, a model is constructed, the spatial characteristics of the industrial control network flow are extracted through a convolutional neural network, the time characteristics of the industrial control network flow are extracted through a cyclic neural network, the important characteristics of the industrial control network flow are extracted through an attention mechanism, and therefore the flow prediction of the industrial control network is completed through inputting historical flow. According to the method, the attention mechanism is introduced to further extract important characteristics contained in the industrial control network flow by constructing the industrial control network flow modeling method based on the attention mechanism, and a new thought is provided for modeling the industrial control network flow.
Description
Technical Field
The invention relates to the field of artificial intelligence, in particular to an industrial control network flow modeling method based on an attention mechanism.
Background
In recent years, with the continuous development and progress of computer and internet of things technology and the wide application of intelligent control equipment in the industry, the structure of an industrial control network becomes more complex, an industrial control system becomes more flexible and changeable, because the industrial control network needs a more stable operation environment, the equipment nodes of the industrial control network do not change frequently, but the requirement on the real-time performance is high, therefore, it is important to analyze and model the industrial control network traffic system so as to predict the future trend of traffic through the historical traffic of the industrial control network, on one hand, the traffic similar to the real attack traffic or scene traffic can be constructed by performing the industrial control network traffic modeling, data can be provided for the industrial control network security test or network security experiment, on the other hand, the attack on the industrial control network becomes more frequent and the national infrastructure construction is damaged, the traffic modeling of the industrial control network can provide reference for the analysis of abnormal traffic of the industrial control network.
The industrial control network flow has the characteristics of self-similarity, stationarity, burstiness and the like, the traditional industrial control network modeling method mainly utilizes the time sequence characteristics to carry out modeling, and the main modeling method comprises an autoregressive moving average model (ARMA), a differential integration moving average autoregressive model (ARIMA), a fractional differential autoregressive summation moving average model (FARIMA), a Markov model and derivative models thereof and the like, for example, in Shandong, Liu Jiayong and the like, the network flow between an upper computer and a lower computer of an industrial control network is analyzed and modeled by a differential integration moving average autoregressive model (ARIMA), and the model has excellent performance on a linear time sequence, however, with the continuous development of the existing network technology, the industrial control network traffic distribution tends to be complicated, the traditional modeling method can not deal with burst traffic, how to perform nonlinear modeling on industrial control network traffic according to industrial control network characteristics becomes a huge challenge.
In recent years, Neural Networks are developed rapidly and gradually applied to various fields, a Neural Network model is utilized to carry out modeling on industrial control Network flow by utilizing the strong processing capability of a nonlinear problem, Zhang Yan Sheng, Lixiwang and the like use a Convolutional Neural Network to carry out abnormal flow detection on the industrial control Network, common Neural Networks for industrial control Network flow modeling mainly comprise a Convolutional Neural Network (CNN), an automatic encoder (Stacked Autoencoder SAE), a Recurrent Neural Network (RNN), a Restricted Boltzmann Machine (corrected Bolzmann Machine RBM) and the like, but the characteristics of various aspects of the industrial control Network can not be extracted by only adopting a single Neural Network for modeling, the invention combines the Convolutional Neural Network and the recurrent Neural Network to extract space and time characteristics in the industrial control Network, and can extract important characteristics in the industrial control Network flow by introducing an attention Machine, and the problem of LSTM insensitivity to important features can be improved.
Disclosure of Invention
The invention provides an attention mechanism-based industrial control network flow modeling method, which extracts the spatial characteristics of industrial control network flow through a convolutional neural network, extracts the time characteristics of the industrial control network flow through a cyclic neural network, extracts the important characteristics of the industrial control network flow through introducing an attention mechanism, and finally obtains a future flow predicted value from a flow matrix between a historical upper computer and a historical lower computer of the industrial control network through a neural network framework.
The invention provides an attention mechanism-based industrial control network flow modeling method, which comprises the following steps:
(1) data acquisition and preprocessing: aiming at the communication between an upper computer and a lower computer in an industrial control network, namely a process monitoring layer comprises equipment such as an engineer station, an operator station, a data server and the like, the communication with a field control layer equipment controller is carried out, the flow acquisition work is carried out, an industrial control network flow matrix M is generated, and the normalization processing is carried out.
(2) And constructing a model: extracting spatial feature M in industrial control network flow through two-dimensional convolutional neural networksThen extracting the time characteristic M by using the BilSTMtFinally, extracting important characteristics M of industrial control network flow through a multi-head attention mechanismiAnd the modeling of the industrial control network flow is completed through the full connection layer.
(3) Iteration and training: and (3) using the normalized root mean square error (RNMSE) as a loss function, and obtaining the deep learning model based on the attention mechanism by calculating the gradient, reversely propagating the updated parameters, and repeatedly iterating and training.
Further, the pretreatment step described in the step (1) above includes the steps of:
a. the communication flow between the process monitoring layer and the field control layer of the industrial control network is collected, the equipment which needs to be collected by the process monitoring layer respectively comprises an operator station, an engineer station, a monitoring server, a real-time database, an interface server and the like, and the field control layer comprises a controller and collects the flow of all the equipment.
b. Respectively numbering process monitoring layer and field control layer equipment of an industrial control network, numbering the process monitoring layer equipment by (1,2, …, X), numbering the field control layer equipment by (1,2, …, Y), and forming an industrial control network flow matrix M by collected industrial control network flows according to a fixed sequence, wherein the expression mode is as follows, wherein (i, j) represents a network flow value from the process monitoring layer to the field control layer at a certain moment.
c. And setting a time interval T, continuously sampling the network flow value from the process monitoring layer to the field control layer according to the time interval T, and finally generating an industrial control flow matrix M with S dimensions of X multiplied by Y if the sampling frequency is S.
d. And carrying out global normalization on all the collected industrial control flow matrixes M, and unifying all the network flow values to be in a (0,1) range.
Further, the step of constructing the model in step (2) includes the steps of:
a. constructing a two-dimensional convolutional neural network, inputting P X Y industrial control flow matrixes into a model, extracting the characteristics of each industrial control flow matrix by using one two-dimensional convolutional neural network, flattening the extracted two-dimensional matrixes into one-dimensional vectors to obtain the extracted industrial control network flow space characteristics Ms。
b. Constructing a bidirectional cyclic neural network, and inputting the spatial characteristics M of the network flow obtained in the previous stepsExtracting time characteristics contained in network flow by using BilSTM, recombining output at each moment into a characteristic matrix to obtain an extracted industrial control network flow time characteristic matrix Mt。
c. The network traffic time characteristic matrix M generated in the previous step B is processedtAs input, a multi-head self-attention mechanism is adopted, and different weight matrixes W are usedQ、WK、WVPerforming linear transformation to obtain a matrix Q, K, V, dividing the three matrices into H heads respectively, performing zoom click operation, and finally combining the heads to obtain an extracted important characteristic matrix M of the industrial control network traffici
d. Constructing a full connection layer, and extracting the network flow characteristic matrix M from the step CiFlattening the data into one-dimensional vectors as input, constructing a layer of fully-connected network, and obtaining the industrial control network flow of the last P +1 momentQuantitative prediction result MP+1And completing the model construction.
Further, the iteration and training step of the step (3) comprises the following steps:
a. inputting P historical industrial control flow matrixes M1，M2，M3...MP]And (4) outputting the industrial control network flow model based on the attention mechanism through the industrial control network flow model based on the attention mechanism in the step (3).
b. Initializing model parameters, setting a trained batch TbAt TbAnd (3) minimizing a loss function, wherein in order to ensure that an abnormal value does not appear in the predicted flow and ensure the stability of the network flow prediction result, the loss function adopts a normalized root mean square error (RNMSE), an Adam optimizer is used for optimizing a training process, and iteration is performed circularly until the set iteration times are reached.
c. And adjusting parameters, repeating the steps, and storing a model with an optimal result as an industrial control network flow model based on an attention mechanism.
The method can be used for modeling according to historical industrial control network flow data and predicting future industrial control flow values, and has the following advantages compared with the prior art:
1. the invention firstly uses the attention mechanism-based neural network in the modeling of the communication network flow between the upper computer and the lower computer of the industrial control network, and solves the problems that the traditional method can not deal with the burst flow and can not accurately model the nonlinear problem.
2. The method combines the convolutional neural network, the cyclic neural network and the attention mechanism to carry out industrial control network flow modeling, extracts the spatial characteristics of the industrial control network flow through the convolutional neural network, extracts the time characteristics of the industrial control network flow through the cyclic neural network, extracts the important characteristics of the industrial control network flow through introducing the attention mechanism, and extracts the flow characteristics of the industrial control network more comprehensively.
3. The method uses the normalized root mean square error (RNMSE) as a loss function to guide the training of the neural network, accelerates the training speed and improves the accuracy of the model.
Drawings
FIG. 1 is a general flow diagram of the process of the present invention. The device mainly comprises three parts: the system comprises a collecting and preprocessing part, a model building part and a model training part.
FIG. 2 is a schematic diagram of an industrial control network using the method of the present invention, and a schematic diagram of a collecting and preprocessing part
FIG. 3 is an industrial control network deep learning model diagram based on the attention mechanism of the method, and is a partial schematic diagram of model construction.
Detailed Description
The present invention will be described in further detail with reference to the following detailed description and accompanying drawings.
The invention relates to an attention mechanism-based industrial control network flow modeling method, which can predict the communication flow value between future industrial control equipment through the historical network flow of the equipment between an industrial control network process monitoring layer and a field control layer, wherein the specific flow is shown in figure 1, and the method mainly comprises the following steps:
step 101, carrying out communication flow collection on an industrial control network process monitoring layer and a field control layer, and carrying out preprocessing work such as normalization. The method comprises the following specific steps:
(1) the schematic diagram of the industrial control network is shown in fig. 2, and the simulation industrial control network comprises 3 parts, a process monitoring layer, a network exchange layer and a field monitoring layer. The equipment that the process monitoring layer needs to gather contains operator station, engineer station, monitoring server, real-time database, interface server etc. respectively, and network switching layer mainly contains the switch, and the field control layer includes the controller, and the traffic collection process mainly is the communication flow of collecting between industrial control network process monitoring layer and the field control layer, gathers promptly at network switching layer.
(2) Respectively numbering process monitoring layer and field control layer equipment of an industrial control network, numbering the process monitoring layer equipment by (1,2, …, X), numbering the field control layer equipment by (1,2, …, Y), and forming an industrial control network flow matrix M by collected industrial control network flows according to a fixed sequence, wherein the expression mode is as follows, wherein (i, j) represents a network flow value from the process monitoring layer to the field control layer at a certain moment.
(3) And continuously sampling the network flow value from the process monitoring layer to the field control layer according to a time interval of 2min, continuously sampling for a period of time, setting the sampling frequency as S, finally generating S industrial control flow matrixes M with X multiplied by Y dimensions, and constructing an industrial control flow data set by using all the acquired data.
(4) Performing global normalization on all the collected industrial control traffic matrixes M, and unifying all the network traffic values in a (0,1) range, wherein the normalization function is as follows, and an input variable x represents the industrial control network traffic matrix M:
step 201, a deep learning model of the industrial control network flow based on the attention mechanism is constructed through the combination of the convolutional neural network, the cyclic neural network and the attention mechanism. The method comprises the following specific steps:
(5) constructing a two-dimensional convolutional neural network, inputting 20X Y industrial control flow matrixes into the model, extracting the characteristics of each industrial control flow matrix by using one two-dimensional convolutional neural network, flattening the extracted two-dimensional matrixes into one-dimensional vectors, and obtaining the extracted industrial control network flow space characteristics Ms。
(6) Constructing a bidirectional cyclic neural network, and inputting the spatial characteristics M of the network flow obtained in the previous stepsIn order to capture the long-distance bidirectional dependency relationship, the BilSTM is adopted to extract the time characteristics contained in the network traffic, the output at each moment is recombined into a characteristic matrix, and the extracted industrial control network traffic time characteristic matrix M is obtainedt。
(7) Extracting important characteristics of industrial control network flow by using an attention mechanism, and using the network flow time characteristic matrix generated in the last step BMtAs input, a multi-head self-attention mechanism is adopted, and different weight matrixes W are usedQ、WK、WVPerforming linear transformation to obtain a matrix Q, K, V, dividing the three matrices into 3 heads respectively, performing zoom click operation, and finally combining the heads to obtain an extracted important characteristic matrix M of the industrial control network traffici
(8) Constructing a full connection layer, and extracting the network flow characteristic matrix M from the step CiFlattening the vector into a one-dimensional vector as input, constructing a layer of fully-connected network, and obtaining an industrial control network flow prediction result M at the next moment21And completing the model construction.
Step 301, using the normalized root mean square error as a loss function for iterative updating of the model, performing continuous iteration and training to obtain a final model, specifically including the following steps:
(9) inputting 20 historical industrial control flow matrixes M1，M2，M3...M20]And (4) outputting the industrial control network flow model based on the attention mechanism through the industrial control network flow model based on the attention mechanism in the step (3).
(10) Initializing model parameters, and setting a trained batchbAt TbIn order to ensure that an abnormal value does not appear in the predicted flow and ensure the stability of the network flow prediction result, the loss function adopts a normalized root mean square error (RNMSE), and the formula is as follows: wherein
Representing the predicted value of network traffic, y represents the true value,
the mean value is indicated.
The training process is optimized using an Adam optimizer, and iterations are cycled until a set number of iterations is reached.
(11) And adjusting parameters, repeating the steps, and storing a model with an optimal result as an attention-based industrial control network flow model.
The above description is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (4)
1. An industrial control network flow modeling method based on an attention mechanism is characterized by comprising the following steps:
A. data acquisition and preprocessing: aiming at the communication between an upper computer and a lower computer in an industrial control network, namely a process monitoring layer comprises equipment such as an engineer station, an operator station, a data server and the like, the communication with a field control layer equipment controller is carried out, the flow acquisition work is carried out, an industrial control network flow matrix M is generated, and the normalization processing is carried out.
B. Constructing a model: extracting spatial feature M in industrial control network flow through two-dimensional convolutional neural networksThen extracting the time characteristic M by using the BilSTMtFinally, extracting important characteristics M of industrial control network flow through a multi-head attention mechanismiAnd the modeling of the industrial control network flow is completed through the full connection layer.
C. Iteration and training: and (3) using the normalized root mean square error (RNMSE) as a loss function, and obtaining the deep learning model based on the attention mechanism by calculating the gradient, reversely propagating the updated parameters, and repeatedly iterating and training.
2. The method for industrial control network traffic modeling based on attention mechanism as claimed in claim 1, wherein said step a comprises the steps of:
A. the communication flow between the process monitoring layer and the field control layer of the industrial control network is collected, the equipment which needs to be collected by the process monitoring layer respectively comprises an operator station, an engineer station, a monitoring server, a real-time database, an interface server and the like, and the field control layer comprises a controller and collects the flow of all the equipment.
B. Respectively numbering process monitoring layer and field control layer equipment of an industrial control network, numbering the process monitoring layer equipment by (1,2, …, X), numbering the field control layer equipment by (1,2, …, Y), and forming an industrial control network flow matrix M by collected industrial control network flows according to a fixed sequence, wherein the expression mode is as follows, wherein (i, j) represents a network flow value from the process monitoring layer to the field control layer at a certain moment.
C. And setting a time interval T, continuously sampling the network flow value from the process monitoring layer to the field control layer according to the time interval T, and finally generating an industrial control flow matrix M with S dimensions of X multiplied by Y if the sampling frequency is S.
D. Performing global normalization on all the collected industrial control traffic matrixes M, and unifying all the network traffic values in a (0,1) range, wherein the normalization function is as follows, and an input variable x represents the industrial control network traffic matrix M:
3. the method for industrial control network traffic modeling based on attention mechanism as claimed in claim 1, wherein said step B comprises the steps of:
A. constructing a two-dimensional convolutional neural network, inputting P X Y industrial control flow matrixes into a model, extracting the characteristics of each industrial control flow matrix by using one two-dimensional convolutional neural network, flattening the extracted two-dimensional matrixes into one-dimensional vectors to obtain the extracted industrial control network flow space characteristics Ms。
B. Constructing a bidirectional cyclic neural network, and inputting the spatial characteristics M of the network flow obtained in the previous stepsIn order to capture the long-distance bidirectional dependency relationship, the BilSTM is adopted to extract the time characteristics contained in the network traffic, the output at each moment is recombined into a characteristic matrix, and the extracted industrial control network traffic time characteristic matrix M is obtainedt。
C. Extracting important characteristics of industrial control network flow by using an attention mechanism, and carrying out time characteristic matrix M on the network flow generated in the previous step BtAs input, a multi-head self-attention mechanism is adopted, and different weight matrixes W are usedQ、WK、WVPerforming linear transformation to obtain a matrix Q, K, V, dividing the three matrices into H heads respectively, performing zoom click operation, and finally combining the heads to obtain an extracted important characteristic matrix M of the industrial control network traffici
D. Constructing a full connection layer, and extracting the network flow characteristic matrix M from the step CiFlattening the vector into a one-dimensional vector as input, constructing a layer of fully-connected network, and obtaining the industrial control network flow prediction result M of the last P +1 momentP+1And completing the model construction.
4. The method for industrial control network traffic modeling based on attention mechanism as claimed in claim 1, wherein said step C comprises the steps of:
A. inputting P historical industrial control flow matrixes M1,M2,M3…MP]And (4) outputting the industrial control network flow model based on the attention mechanism through the industrial control network flow model based on the attention mechanism in the step (3).
B. Initializing model parameters, setting a trained batch TbAt TbIn order to ensure that an abnormal value does not appear in the predicted flow and ensure the stability of the network flow prediction result, the loss function adopts a normalized root mean square error (RNMSE), and the formula is as follows: wherein
Representing the predicted value of network traffic, y represents the true value,
the mean value is indicated.
The training process is optimized using an Adam optimizer, and iterations are cycled until a set number of iterations is reached.
C. And adjusting parameters, repeating the steps, and storing a model with an optimal result as an industrial control network flow model based on an attention mechanism.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110475603.7A CN113094860B (en) | 2021-04-29 | 2021-04-29 | Industrial control network flow modeling method based on attention mechanism |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110475603.7A CN113094860B (en) | 2021-04-29 | 2021-04-29 | Industrial control network flow modeling method based on attention mechanism |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113094860A true CN113094860A (en) | 2021-07-09 |
| CN113094860B CN113094860B (en) | 2023-09-01 |
Family
ID=76680728
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110475603.7A Active CN113094860B (en) | 2021-04-29 | 2021-04-29 | Industrial control network flow modeling method based on attention mechanism |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113094860B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113572752A (en) * | 2021-07-20 | 2021-10-29 | 上海明略人工智能(集团)有限公司 | Abnormal flow detection method and device, electronic equipment and storage medium |
| CN113691542A (en) * | 2021-08-25 | 2021-11-23 | 中南林业科技大学 | Web attack detection method based on HTTP request text and related equipment |
| CN113807027A (en) * | 2021-10-09 | 2021-12-17 | 华北电力大学（保定） | Health state evaluation model, method and system for wind turbine generator |
| CN114553718A (en) * | 2022-02-20 | 2022-05-27 | 武汉大学 | Network traffic matrix prediction method based on self-attention mechanism |
| CN115442253A (en) * | 2022-09-15 | 2022-12-06 | 西安电子科技大学 | Network flow prediction method using attention mechanism |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180103052A1 (en) * | 2016-10-11 | 2018-04-12 | Battelle Memorial Institute | System and methods for automated detection, reasoning and recommendations for resilient cyber systems |
| CN111030889A (en) * | 2019-12-24 | 2020-04-17 | 国网河北省电力有限公司信息通信分公司 | Network traffic prediction method based on GRU model |
| CN111209933A (en) * | 2019-12-25 | 2020-05-29 | 国网冀北电力有限公司信息通信分公司 | Network traffic classification method and device based on neural network and attention mechanism |
| US20200204571A1 (en) * | 2018-12-19 | 2020-06-25 | AVAST Software s.r.o. | Malware detection in network traffic time series |
| CN111818052A (en) * | 2020-07-09 | 2020-10-23 | 国网山西省电力公司信息通信分公司 | CNN-LSTM-based industrial control protocol homologous attack detection method |
| CN111970163A (en) * | 2020-06-30 | 2020-11-20 | 网络通信与安全紫金山实验室 | Network flow prediction method of LSTM model based on attention mechanism |
| CN112350876A (en) * | 2021-01-11 | 2021-02-09 | 南京信息工程大学 | Network flow prediction method based on graph neural network |
| CN112418361A (en) * | 2021-01-22 | 2021-02-26 | 杭州木链物联网科技有限公司 | Industrial control system anomaly detection method and device based on deep learning |
-
2021
- 2021-04-29 CN CN202110475603.7A patent/CN113094860B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180103052A1 (en) * | 2016-10-11 | 2018-04-12 | Battelle Memorial Institute | System and methods for automated detection, reasoning and recommendations for resilient cyber systems |
| US20200204571A1 (en) * | 2018-12-19 | 2020-06-25 | AVAST Software s.r.o. | Malware detection in network traffic time series |
| CN111030889A (en) * | 2019-12-24 | 2020-04-17 | 国网河北省电力有限公司信息通信分公司 | Network traffic prediction method based on GRU model |
| CN111209933A (en) * | 2019-12-25 | 2020-05-29 | 国网冀北电力有限公司信息通信分公司 | Network traffic classification method and device based on neural network and attention mechanism |
| CN111970163A (en) * | 2020-06-30 | 2020-11-20 | 网络通信与安全紫金山实验室 | Network flow prediction method of LSTM model based on attention mechanism |
| CN111818052A (en) * | 2020-07-09 | 2020-10-23 | 国网山西省电力公司信息通信分公司 | CNN-LSTM-based industrial control protocol homologous attack detection method |
| CN112350876A (en) * | 2021-01-11 | 2021-02-09 | 南京信息工程大学 | Network flow prediction method based on graph neural network |
| CN112418361A (en) * | 2021-01-22 | 2021-02-26 | 杭州木链物联网科技有限公司 | Industrial control system anomaly detection method and device based on deep learning |
Non-Patent Citations (4)
| Title |
|---|
| 孟智慧;: "基于深度置信网络的互联网流量预测方法", 电信工程技术与标准化, no. 10 * |
| 孟瑾;: "基于烟草工业网络流量监测分析与安全防护应用", 网络安全技术与应用, no. 02 * |
| 李青;徐子闻;: "基于集成降噪自编码的网络入侵多模式匹配算法设计", 广西大学学报(自然科学版), no. 03 * |
| 高一为;周睿康;赖英旭;范科峰;姚相振;李琳;: "基于仿真建模的工业控制网络入侵检测方法研究", 通信学报, no. 07 * |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113572752A (en) * | 2021-07-20 | 2021-10-29 | 上海明略人工智能(集团)有限公司 | Abnormal flow detection method and device, electronic equipment and storage medium |
| CN113572752B (en) * | 2021-07-20 | 2023-11-07 | 上海明略人工智能(集团)有限公司 | Abnormal flow detection method and device, electronic equipment and storage medium |
| CN113691542A (en) * | 2021-08-25 | 2021-11-23 | 中南林业科技大学 | Web attack detection method based on HTTP request text and related equipment |
| CN113807027A (en) * | 2021-10-09 | 2021-12-17 | 华北电力大学（保定） | Health state evaluation model, method and system for wind turbine generator |
| CN113807027B (en) * | 2021-10-09 | 2023-08-18 | 华北电力大学（保定） | Wind turbine generator system health state evaluation model, method and system |
| CN114553718A (en) * | 2022-02-20 | 2022-05-27 | 武汉大学 | Network traffic matrix prediction method based on self-attention mechanism |
| CN115442253A (en) * | 2022-09-15 | 2022-12-06 | 西安电子科技大学 | Network flow prediction method using attention mechanism |
| CN115442253B (en) * | 2022-09-15 | 2023-07-18 | 西安电子科技大学 | Network flow prediction method utilizing attention mechanism |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113094860B (en) | 2023-09-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113094860A (en) | Industrial control network flow modeling method based on attention mechanism | |
| CN106951695A (en) | Plant equipment remaining life computational methods and system under multi-state | |
| CN112712209B (en) | Reservoir warehousing flow prediction method and device, computer equipment and storage medium | |
| CN104331635B (en) | The method of power optical fiber Communication ray power prediction | |
| CN108090621B (en) | Short-term wind speed prediction method and system based on staged overall optimization | |
| CN112101480A (en) | Multivariate clustering and fused time sequence combined prediction method | |
| CN111127246A (en) | Intelligent prediction method for transmission line engineering cost | |
| CN109523155B (en) | Power grid risk assessment method of Monte Carlo and least square support vector machine | |
| CN112187554B (en) | Operation and maintenance system fault positioning method and system based on Monte Carlo tree search | |
| CN115347571B (en) | Photovoltaic power generation short-term prediction method and device based on transfer learning | |
| CN116663419A (en) | Sensorless equipment fault prediction method based on optimized Elman neural network | |
| CN116451567A (en) | Leakage assessment and intelligent disposal method for gas negative pressure extraction pipeline | |
| CN116599857B (en) | Digital twin application system suitable for multiple scenes of Internet of things | |
| CN112381279B (en) | Wind power prediction method based on VMD and BLS combined model | |
| CN116525135B (en) | Method for predicting epidemic situation development situation by space-time model based on meteorological factors | |
| CN116881665A (en) | CMOA optimization-based TimesNet-BiLSTM photovoltaic output prediction method | |
| CN117131654A (en) | Target observation method based on nonlinear optimal disturbance of pre-analysis initial guess condition | |
| CN115616333A (en) | Power distribution network line loss prediction method and system | |
| CN114881338A (en) | Power distribution network line loss prediction method based on maximum mutual information coefficient and deep learning | |
| CN115577856A (en) | Method and system for predicting construction cost and controlling balance of power transformation project | |
| CN114880917A (en) | Method and device for building health state model and predicting performance trend of pumped storage unit | |
| CN114202106A (en) | Air conditioning system load prediction method based on deep learning | |
| CN113988210A (en) | Method and device for restoring distorted data of structure monitoring sensor network and storage medium | |
| CN112270123A (en) | Basin reservoir group runoff random generation method based on convolution generation countermeasure network | |
| CN117767579B (en) | AutoML-based power grid big data analysis method and automatic modeling system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |