CN115484102A - Anomaly detection system and method for industrial control system - Google Patents

Abstract

The invention discloses an anomaly detection system and method for an industrial control system, which relate to the field of anomaly detection, and the system comprises: the device comprises a data acquisition module, a data preprocessing module, an anomaly detection model training module, a threshold setting module, an anomaly detection module and a result output module. The method comprises the following steps: step 1, collecting training data; step 2, data preprocessing is carried out; step 3, learning time dimension characteristics; step 4, learning time series correlation; step 5, reconstructing the multidimensional time sequence data; step 6, setting an abnormal threshold value; step 7, real-time online detection; and 8, outputting a detection result. The method can effectively model the time sequence, learn the periodic rule of the normal sequence and effectively perform robust modeling on the abnormally polluted time sequence data; and the reconstruction error in the training process is learned by adopting an extreme value theorem, and the threshold value is automatically set, so that the inconvenience of setting according to an empirical value is avoided.

Description

Anomaly detection system and method for industrial control system

technical field

The invention relates to the field of anomaly detection, in particular to an anomaly detection system and method for industrial control systems.

Background technique

Industrial control systems are widely used in industrial sectors and critical infrastructure such as electrical, water and wastewater, oil and gas, chemical, transportation, pharmaceutical, pulp and paper, food and beverage, and discrete manufacturing such as automotive, aerospace and durable goods ) and other industries. Timely and effective anomaly detection for industrial control systems can ensure the long-term stable operation of industrial production.

In the actual production process, labeled data is often difficult to obtain, so anomaly detection is mostly based on unsupervised methods. The structure of the industrial control system is complex, and it is difficult to apply single-variable time series anomaly detection. In the industrial production process, a large number of sensors generally monitor the current state in real time, and the actuators operate the current system. Therefore, the multi-variable data collected from sensors and actuators Time series data can be used as an important research object in the field of anomaly detection.

Although traditional machine learning-based anomaly detection methods have good interpretability, they need to rely on expert experience to establish complex feature engineering for time series data. With the development of technology and the improvement of computing power, anomaly detection methods based on deep learning have begun to receive widespread attention. Recurrent neural networks can capture long-term dependencies in time series data, but do not take into account the correlation between different time series, so the effect is not ideal when modeling multidimensional time series data with serial potential correlation, and In actual industrial scenarios, changes in workload and noise in the working environment are unavoidable, resulting in poor robustness of the model. In addition, the setting of anomaly detection thresholds mostly depends on experience and lacks flexibility.

Jin Yaohui and others provided a multi-dimensional time series anomaly detection method and detection system in the Chinese invention patent application "a multi-dimensional time series anomaly detection method and detection system" (application number: 202011060906.4), including: The encoder reconstructs the sampled low-dimensional variables into a multidimensional time series, optimizes the model with a regularization method based on the time series Markov smoothing assumption, and calculates outliers of the time series based on the probability distribution of the reconstructed time series. However, this method only learns the law of time series in the time dimension and ignores the potential correlation between time series. The lack of potential correlation between time series will lead to low model accuracy and low detection performance.

Zhao Peihai and others provided a multi-dimensional time series anomaly detection method and detection system in the Chinese invention patent application "Real-time anomaly detection method for multi-dimensional time series data using unsupervised deep neural network" (application number: 202110848400.8), including: The correlation feature matrix SFM is calculated from the data, and the feature matrix sequence is input to the extraction feature reconstruction data module that uses a four-layer convolutional neural network as a feature extractor. Each layer of convolutional neural network adds a layer of LSTM network structure, and each The feature extraction matrix output by the layer LSTM network structure is reconstructed to obtain the reconstruction matrix. All the reconstruction matrices constitute the reconstruction matrix sequence, and the reconstruction matrix sequence is used as the input of a linear regression. The output form of the linear regression is nth order square Collect data for the prediction of PSFM, calculate the difference between PSFM and SFM to get the abnormal score sc, and judge whether the abnormal score sc has reached the abnormal range according to the given threshold δ. Although this method takes into account the correlation between time series, its correlation calculation is limited to linear relationships, and it is difficult to achieve good results for systems with complex relationships.

Pi Dechang and others provided a multi-dimensional time-series data anomaly detection method and system in the Chinese invention patent application "A method and system for detecting anomalies in multi-dimensional time-series data" (application number: 202111371649.0), including the following steps: First, the Satellite telemetry data is preprocessed to obtain coded additional data and time-scale fusion features; then, the fusion coded additional data and fusion features are fused to obtain fused input information; then, the fused input information is input into the Transformer variational autoencoder for encoding and decoding Then to the reconstruction result, the reconstruction error is calculated; then, the weighted moving average method is used to smooth the reconstruction error, and when the smoothing error exceeds the threshold range, it is determined that there is an abnormality in the telemetry data of the satellite to be detected, And record the abnormal time point. This method can effectively capture the correlation between time series, but the threshold setting of anomaly detection still uses empirical values, which lacks flexibility and adaptability.

Therefore, those skilled in the art are devoting themselves to developing a new anomaly detection system and method for industrial control systems to overcome the above-mentioned defects in the prior art.

Contents of the invention

In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to overcome the lack of learning of the potential relationship between time series in the prior art, resulting in low model performance and abnormalities in the case of noise in the training data set Detecting the overfitting of the deep learning model and the setting of the abnormal threshold rely on the defects of experience.

In order to achieve the above purpose, the present invention provides a multi-dimensional time series anomaly detection system and method for industrial control systems, using deep learning methods to learn the normal periodicity of industrial multi-dimensional time series, based on the reconstructed time series probability distribution to analyze the time series Anomaly detection is conducive to improving the accuracy and stability of anomaly detection and enhancing the reliability of the detection model.

A multi-dimensional time series anomaly detection system oriented to an industrial control system provided by the present invention includes:

A data acquisition module, the data acquisition module records the multidimensional time series data of the industrial control system;

A data preprocessing module, the data preprocessing module is connected to the data acquisition module, and preprocesses the collected multidimensional time series data to obtain several batches of multidimensional time series subsequences;

An anomaly detection model training module, the anomaly detection model training module is connected to the data preprocessing module, receives the multi-dimensional time series subsequences of the plurality of batches, and constructs and trains a neural network model for anomaly detection, which is called anomaly detection model, the output of the anomaly detection model training module is the reconstructed data of the input multidimensional time series data;

Threshold value setting module, the threshold value setting module is connected to the abnormality detection model training module, and calculates the error between the reconstructed data and the input multidimensional time series data, which is called reconstruction error. Structural errors are used as sample data, the extreme value theorem is used for learning, and the abnormal threshold is automatically set;

The anomaly detection module inputs the time series data collected in real time into the trained anomaly detection model to calculate the reconstruction error after passing through the data preprocessing module, and uses the reconstruction error as an abnormal score to compare the The abnormal score and the abnormal threshold; when the abnormal score is less than the abnormal threshold, it is considered that there is an abnormality in the time series data collected in real time;

A result output module, the result output module is connected to the anomaly detection module, and outputs an anomaly detection result for the time series data collected in real time of detected anomalies.

Further, the time series data collected in real time is also collected by the data collection module.

Further, in the data preprocessing module, the data preprocessing first adopts sliding window technology to segment, and then divides the subsequences into batches and normalizes them.

Further, in the anomaly detection model training module, the anomaly detection model uses a one-dimensional convolutional neural network to learn the timing characteristics of time series, uses a random recurrent neural network to learn the correlation between time series, and uses variational self-encoding The idea of the device reconstructs the input multidimensional time series data; the loss function is constructed by the reconstruction error, the posterior distribution of the latent space vector and the KL divergence of the hypothetical prior distribution; by optimizing the loss function Perform model training, and save the parameters of the abnormality detection model when the loss function reaches the minimum.

Further, in the result output module, the abnormality detection result includes abnormality occurrence location, occurrence time, and duration.

The present invention also provides a multidimensional time series anomaly detection method oriented to an industrial control system, the method comprising the following steps:

Step 1. Continuously sample the a sensors and b actuators of the industrial control system according to the preset frequency f, and the sampling time length is T, and obtain the sample X of the multidimensional time series data, whose size is X∈R ^N×M , Wherein, N is the sampling data length, calculated by the frequency f and the sampling time length T; M is the sampling data dimension, M=a+b;

Step 2, perform data preprocessing, set a sliding time window, including start time _st and end time e _t ; the length of the sliding time window is w=e _t - _st , and the width is the multidimensional time series data The sampling data dimension M; slide the sliding time window on the multidimensional time series data until the end of the sequence data; set the step size of each sliding as s, and divide the multidimensional time series data into several A subsequence fragment x with a sampling time length of w and a sampling data dimension of M, x∈R ^w×M ; when the sampling time length is less than the length of the sliding time window, the fragment is directly used as a subsequence; selected The batch size is b _s , the divided subsequence fragments are divided into multiple batches of size b _s , and the subsequence size of each batch is (b _s ,w,M);

Step 3. Learning time-dimensional features. First, use several one-dimensional convolutional neural networks to perform one-dimensional convolution on the input multi-dimensional time series data along its time dimension to learn a low-dimensional representation z ₁ of time series features, and then , performing deconvolution on the low-dimensional representation z ₁ of the time series features, and the output is d;

Step 4. Learning time series correlation. First, input d into the variational coding network of the random recurrent neural network to learn the correlation between time series and obtain a low-dimensional representation z ₂ . Then, z ₂ is enhanced through realNVP flow The low-dimensional representation of; said step 3 and said step 4 constitute an approximate inference network in the structure of the variational autoencoder:

Specifically:

in:

表示门控循环单元GRU；f( ) and f ^-1 ( ) represent one-dimensional convolution operation and deconvolution operation,

Represents the gated recurrent unit GRU;

Step 5, reconstructing the multidimensional time series data;

Step 6, setting the abnormal threshold;

Step 7, real-time online detection;

Step 8, outputting the detection result.

Further, in the step 5, deconvolve the low-dimensional representation z1 of the timing feature to obtain the input e _of the decoding network, and use the timing information contained in e as an external input to the random loop In the neural network, the neural network model used for anomaly detection is constructed and trained, which is called an anomaly detection model. At the same time, the multidimensional time series data of the original input is realized by combining the low-dimensional representation z ₂ between time series. Refactoring to get reconstructed data, which can be expressed as:

p _θ (x,z ₁ ,z ₂ )=p _θ (x|z ₁ z,2)p _θ (z ₂ |z ₁ )

Specifically:

Among them: g( ) means to perform deconvolution operation on z ₁ , and construct a loss function to jointly optimize the approximate model and the generative model;

According to the optimization function of the variational autoencoder:

的形式，

form,

The construction optimization function is:

Optimization methods include the use of Monte Carlo sampling, SGVB estimators and heavy parameter techniques.

Further, in the step 6, the error between the reconstructed data and the original input multidimensional time series data is calculated to obtain a series of reconstruction errors error={er ₁ , er ₂ ...};

Taking the reconstruction error as a sample, the extreme value theorem is used to automatically set the threshold as threshold, and the extreme value theorem:

The formula for calculating the abnormal threshold is:

为需要学习的参数，q为设定的概率大小，N为输入样本数，N_t为样本中大于初始阈值的数目，同时添加实时计算的异常分数对检测阈值进行迭代更新。Among them, th is the initial setting threshold,

is the parameter to be learned, q is the set probability, N is the number of input samples, N _t is the number of samples greater than the initial threshold, and the abnormal score calculated in real time is added to iteratively update the detection threshold.

Further, in the step 7, the time series data collected in real time at time t is input into the abnormality detection model to obtain an abnormality score score, which is the reconstruction probability of the input data by the abnormality detection model; When score<threshold, it is considered abnormal, otherwise, it is considered normal.

Further, in the step 8, for the detected abnormal time series fragments, calculate the abnormal possibility of all dimensions of the input data at that moment, sort them from high to low, select the first k dimensions as abnormal, and output the abnormal dimension The name of the corresponding sensor or actuator, the time and duration of the abnormality.

A multi-dimensional time series anomaly detection system and method for industrial control systems provided by the present invention has at least the following technical effects:

1. The technical solution provided by the present invention is based on the strategy of hierarchical variational autoencoder, which not only learns the temporal relationship of multidimensional time series in time, but also captures the potential correlation between different time series, which can effectively Model the time series and learn the periodic law of the normal sequence;

2. The technical solution provided by the present invention uses one-dimensional convolutional network and reverse one-dimensional convolution operation to reconstruct the input to filter the anomalies existing in the original data, and can effectively perform robustness on abnormally polluted time series data. modeling;

3. The technical solution provided by the present invention is to use the extreme value theorem to learn the reconstruction error in the training process, automatically set the threshold, and avoid the inconvenience of setting according to the empirical value.

The idea, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings, so as to fully understand the purpose, features and effects of the present invention.

Description of drawings

Fig. 1 is the overall frame diagram of a preferred embodiment of the present invention;

Fig. 2 is the schematic diagram of multidimensional time series and sliding window of Fig. 1 embodiment;

Fig. 3 is the random recurrent neural network of Fig. 1 embodiment;

FIG. 4 is an overall architecture diagram of the anomaly detection model of the embodiment in FIG. 1 .

detailed description

The following describes several preferred embodiments of the present invention with reference to the accompanying drawings, so as to make the technical content clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned herein.

The technical problem to be solved by the present invention is how to overcome the lack of learning of the potential relationship between time series in the prior art, resulting in low model performance and overfitting of the abnormality detection deep learning model under the condition of noise in the training data set, The setting of abnormal threshold depends on the flaw of experience. In order to solve the above technical problems, the present invention uses one-dimensional convolution to learn the temporal relationship of multi-dimensional time series in time, and at the same time captures the potential correlation between different time series through random variational autoencoders, and uses the temporal relationship and correlation Data reconstruction based on information, and model training based on the strategy of variational autoencoder can effectively model time series and learn the periodicity of normal sequences. In addition, the extreme value theorem is used to learn the reconstruction error generated during the training process, and the abnormal detection threshold is automatically set, which avoids the inconvenience of setting according to the empirical value.

The present invention provides a multi-dimensional time series anomaly detection system and method for industrial control systems, using deep learning methods to learn the normal periodicity of industrial multi-dimensional time series, and detecting time series anomalies based on the reconstructed time series probability distribution. It is beneficial to improve the accuracy and stability of anomaly detection and enhance the reliability of the detection model.

As shown in Figure 1, a kind of industrial control system-oriented multi-dimensional time series anomaly detection system provided by the present invention includes:

Data acquisition module, the data acquisition module records the multidimensional time series data of the industrial control system; the data acquisition module records the current status information of the sensors and actuators obtained by continuous sampling at a fixed frequency during the normal operation of the industrial control system, and generates multidimensional time series data. In the model training phase of the anomaly detection system, the data acquisition module constructs the data set required for neural network modeling; in the model operation phase of the anomaly detection system, the data acquisition module collects system status data in real time for anomaly detection;

The data preprocessing module, the data preprocessing module is connected to the data acquisition module, preprocesses the collected multidimensional time series data, and obtains several batches of multidimensional time series subsequences; specifically, the data preprocessing module for the collected The multidimensional time series data is preprocessed, and the multidimensional time series is segmented by sliding window technology, and then the divided subsequences are divided into batches and normalized to obtain several batches of multidimensional time series subsequences.

Anomaly detection model training module, the anomaly detection model training module is connected to the data preprocessing module, receives several batches of multi-dimensional time series subsequences, constructs and trains a neural network model for anomaly detection, called an anomaly detection model, anomaly detection model training The output of the module is the reconstructed data of the input multidimensional time series data. Specifically, the anomaly detection model uses a one-dimensional convolutional neural network to learn the time series characteristics of time series, uses a random recurrent neural network to learn the correlation between time series, and uses the idea of variational autoencoder to process the input multidimensional time series data. Reconstruction; construct a loss function by reconstructing the error, the posterior distribution of the latent space vector, and the KL divergence of the hypothetical prior distribution; perform model training by optimizing the loss function, and save the parameters of the anomaly detection model when the loss function reaches the minimum .

Threshold setting module, the threshold setting module is connected to the anomaly detection model training module to calculate the error between the reconstructed data and the input multidimensional time series data, which is called the reconstruction error. The reconstruction error is used as the sample data, and the extreme value theorem is adopted Carry out learning and automatically set the abnormal threshold;

The anomaly detection module inputs the time series data collected in real time into the trained anomaly detection model to calculate the reconstruction error after passing through the data preprocessing module, takes the reconstruction error as the abnormal score, and compares the abnormal score with the abnormal threshold; when the abnormal score When it is less than the abnormal threshold, it is considered that there is an abnormality in the time series data collected in real time.

Among them, the time series data collected in real time is also collected by the data collection module.

The result output module, the result output module is connected to the abnormality detection module, and outputs the abnormality detection result for the detected abnormal real-time collected time series data. Wherein, the abnormality detection result includes abnormality occurrence location, occurrence time, duration length.

The present invention also provides a multi-dimensional time series anomaly detection method for industrial control systems. First, the signals of sensors and actuators in the industrial production process are measured and collected to generate a multi-dimensional time series, and the collected multi-dimensional time series is divided by a sliding window. Form time series fragments, learn the low-dimensional features of time series hierarchically, use one-dimensional convolutional neural network to learn its time series features along the time dimension of time series, and use random cyclic neural network to learn the time series features along the feature dimension of time series The potential correlation between them, reconstruct the input time series with the learned time series features and correlation information, use the strategy of variational autoencoder to construct the loss function to train and optimize the model, and calculate the relationship between the reconstructed data and the original input The error between them is used as the reconstruction error, the reconstruction error is learned, the abnormal detection threshold is set, the real-time collected data is input into the abnormal detection model, the abnormal score is calculated, and the threshold is judged. If it is judged to be abnormal, an abnormal alarm will be output and locate the exception.

Specifically, the method includes the following steps:

Step 1. Continuously sample the a sensors and b actuators of the industrial control system according to the preset frequency f, and the sampling time length is T, and obtain the sample X of the multidimensional time series data, whose size is X∈R ^N×M , Among them, N is the sampling data length, calculated from the frequency f and the sampling time length T; M is the sampling data dimension, M=a+b;

Step 2, perform data preprocessing, as shown in Figure 2, set the sliding time window, including the start time _st and end time e _t ; the length of the sliding time window is w=e _t -s _t , and the width is a multidimensional time series The sampling data dimension of the data is M; slide the sliding time window on the multidimensional time series data until the end of the sequence data; set the step size of each sliding as s, and divide the multidimensional time series data into several sampling time lengths w , Sampling the subsequence fragment x with dimension M, x∈R ^w×M ; when the sampling time length is less than the length of the sliding time window, the fragment is directly used as a subsequence; the selected batch size is b _s , and the division The final subsequence fragments are divided into multiple batches of size b _s , and the subsequence size of each batch is (b _s , w, M), and then input into the anomaly detection model for training in turn;

Step 3. Learning time-dimensional features. First, use several one-dimensional convolutional neural networks to perform one-dimensional convolution on the input multi-dimensional time series data along its time dimension, and learn the low-dimensional representation z ₁ of time series features. Then, The low-dimensional representation z ₁ of time series features is deconvolved, and the output is d; the purpose of the deconvolution operation is to filter out the abnormal data noise existing in the training data, to ensure the accuracy of the model and the consistency of subsequent time series correlation learning ;

Step 4, learning time series correlation, as shown in Figure 3, first, input d into the variational coding network of the random recurrent neural network, learn the correlation between time series, and obtain a low-dimensional representation z ₂ , then, z ₂ Enhanced low-dimensional representation through realNVP flow; Step 3 and Step 4 constitute the approximate inference network in the structure of the variational autoencoder:

Specifically:

in:

表示门控循环单元GRU；f( ) and f ^-1 ( ) represent one-dimensional convolution operation and deconvolution operation,

Represents the gated recurrent unit GRU;

Step 5. Reconstruct the multi-dimensional time series data, deconvolute the low-dimensional representation z ₁ of the time series features to obtain the input e of the decoding network, and use the time series information contained in e as an external input into the random cyclic neural network to construct and The neural network model trained for anomaly detection is called an anomaly detection model. At the same time, combined with the low-dimensional representation z ₂ between time series to realize the reconstruction of the original input multi-dimensional time series data, the reconstructed data can be expressed for:

p _θ (x,z ₁ ,z ₂ )=p _θ (x|z ₁ ,z ₂ )p _θ (z ₂ |z ₁ )

Specifically:

Among them: g( ) means to perform deconvolution operation on z ₁ , and construct a loss function to jointly optimize the approximate model and the generative model;

According to the optimization function of the variational autoencoder:

的形式，

form,

The construction optimization function is:

Optimization methods include using Monte Carlo sampling, SGVB estimators and heavy parameter techniques;

Step 6. Set the abnormal threshold, as shown in Figure 4, calculate the error between the reconstructed data and the original input multidimensional time series data, and obtain a series of reconstruction errors error={er ₁ , er ₂ ...};

Taking the reconstruction error as a sample, the extreme value theorem is used to automatically set the threshold as the threshold. According to the extreme value theorem:

The formula for calculating the abnormal threshold is:

为需要学习的参数，q为设定的概率大小，N为输入样本数，N_t为样本中大于初始阈值的数目，同时添加实时计算的异常分数对检测阈值进行迭代更新；Among them, th is the initial setting threshold,

is the parameter that needs to be learned, q is the set probability, N is the number of input samples, N _t is the number of samples greater than the initial threshold, and the abnormal score calculated in real time is added to iteratively update the detection threshold;

Step 7. Real-time online detection. For the time series data collected in real time at time t, input it into the anomaly detection model to obtain the abnormal score score, which is the reconstruction probability of the input data by the anomaly detection model; when score<threshold, consider An exception is generated, otherwise, it is considered normal;

Step 8. Output the detection results. For the detected abnormal time series fragments, calculate the abnormal possibility of all dimensions of the input data at that moment, sort them from high to low, select the first k dimensions as abnormal, and output the sensor corresponding to the abnormal dimension or the name of the executor, when and for how long the exception occurred.

The preferred specific embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make many modifications and changes according to the concept of the present invention without creative efforts. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art shall be within the scope of protection defined by the claims.

Claims (10)

1. A multidimensional time series anomaly detection system for industrial control systems, characterized in that it comprises: A data acquisition module, the data acquisition module records the multidimensional time series data of the industrial control system; A data preprocessing module, the data preprocessing module is connected to the data acquisition module, and preprocesses the collected multidimensional time series data to obtain several batches of multidimensional time series subsequences; An anomaly detection model training module, the anomaly detection model training module is connected to the data preprocessing module, receives the multi-dimensional time series subsequences of the plurality of batches, and constructs and trains a neural network model for anomaly detection, which is called anomaly detection model, the output of the anomaly detection model training module is the reconstructed data of the input multidimensional time series data; Threshold value setting module, the threshold value setting module is connected to the abnormality detection model training module, and calculates the error between the reconstructed data and the input multidimensional time series data, which is called reconstruction error. Structural errors are used as sample data, the extreme value theorem is used for learning, and the abnormal threshold is automatically set; The anomaly detection module inputs the time series data collected in real time into the trained anomaly detection model to calculate the reconstruction error after passing through the data preprocessing module, and uses the reconstruction error as an abnormal score to compare the The abnormal score and the abnormal threshold; when the abnormal score is less than the abnormal threshold, it is considered that there is an abnormality in the time series data collected in real time; A result output module, the result output module is connected to the anomaly detection module, and outputs an anomaly detection result for the time series data collected in real time of detected anomalies. 2. The multi-dimensional time-series anomaly detection system oriented to an industrial control system according to claim 1, wherein the time-series data collected in real time is also collected by the data collection module. 3. the multi-dimensional time series anomaly detection system facing industrial control system as claimed in claim 1, is characterized in that, in described data preprocessing module, data preprocessing adopts sliding window technique to segment earlier, and then the segmented Subsequences are batched and normalized. 4. the multidimensional time series anomaly detection system facing industrial control system as claimed in claim 1, is characterized in that, in described anomaly detection model training module, described anomaly detection model adopts one-dimensional convolutional neural network learning time series The timing characteristics of the time series, using the random cycle neural network to learn the correlation between the time series, through the idea of variational autoencoder to reconstruct the input multi-dimensional time series data; through the reconstruction error, the hidden space vector after The prior distribution and the KL divergence of the hypothetical prior distribution are used to construct a loss function; the model training is performed by optimizing the loss function, and when the loss function reaches a minimum, the parameters of the anomaly detection model are saved. 5. The multi-dimensional time series anomaly detection system oriented to industrial control systems according to claim 1, characterized in that, in the result output module, the anomaly detection results include abnormal occurrence location, occurrence time, and duration length. 6. the multidimensional time series anomaly detection method facing industrial control system as claimed in claim 1, is characterized in that, described method comprises the following steps: Step 1. Continuously sample the a sensors and b actuators of the industrial control system according to the preset frequency f, and the sampling time length is T, and obtain the sample X of the multidimensional time series data, whose size is X∈R ^N×M , Wherein, N is the sampling data length, calculated by the frequency f and the sampling time length T; M is the sampling data dimension, M=a+b; Step 2, perform data preprocessing, set a sliding time window, including start time _st and end time e _t ; the length of the sliding time window is w=e _t - _st , and the width is the multidimensional time series data The sampling data dimension M; slide the sliding time window on the multidimensional time series data until the end of the sequence data; set the step size of each sliding as s, and divide the multidimensional time series data into several A subsequence segment x with a sampling time length of w and a sampling data dimension of M, x∈R ^w×M ; when the sampling time length is less than the length of the sliding time window, the segment is directly used as a subsequence; selected The batch size is b _s , the divided subsequence fragments are divided into multiple batches of size b _s , and the subsequence size of each batch is (b _s ,w,M); Step 3. Learning time-dimensional features. First, use several one-dimensional convolutional neural networks to perform one-dimensional convolution on the input multi-dimensional time series data along its time dimension to learn a low-dimensional representation z ₁ of time series features, and then , performing deconvolution on the low-dimensional representation z ₁ of the time series feature, and the output is d; Step 4. Learning time series correlation. First, input d into the variational coding network of the random recurrent neural network to learn the correlation between time series and obtain a low-dimensional representation z ₂ . Then, z ₂ is enhanced through realNVP flow The low-dimensional representation of; said step 3 and said step 4 constitute an approximate inference network in the structure of the variational autoencoder:

Specifically:

in: f( ) and f ^-1 ( ) represent one-dimensional convolution operation and deconvolution operation,

Represents the gated recurrent unit GRU; Step 5, reconstructing the multidimensional time series data; Step 6, setting the abnormal threshold; Step 7, real-time online detection; Step 8, outputting the detection result. 7. the multidimensional time series anomaly detection method facing industrial control system as claimed in claim 6, is characterized in that, in described step 5, deconvolution is carried out to the described low-dimensional representation z1 _of described time series feature to obtain Decoding the input e of the network, using the timing information contained in e as an external input, inputting it into the random cyclic neural network, constructing and training a neural network model for anomaly detection, called an anomaly detection model, and at the same time, combining the time series The low _- dimensional representation z2 between realizes the reconstruction of the multi-dimensional time series data of the original input, and obtains the reconstructed data, which can be expressed as: p _θ (x,z ₁ ,z ₂ )=p _θ (x|z ₁ ,z ₂ )p _θ (z ₂ |z ₁ ) Specifically:

Among them: g( ) means to perform deconvolution operation on z ₁ , and construct a loss function to jointly optimize the approximate model and the generative model; According to the optimization function of the variational autoencoder:

form, The construction optimization function is:

Optimization methods include the use of Monte Carlo sampling, SGVB estimators and heavy parameter techniques. 8. The multidimensional time series anomaly detection method for industrial control systems as claimed in claim 7, characterized in that, in said step 6, calculating the difference between the reconstructed data and the multidimensional time series data of the original input Error, get a series of reconstruction errors error={er ₁ ,er ₂ ...}; Taking the reconstruction error as a sample, the extreme value theorem is used to automatically set the threshold as threshold, and the extreme value theorem:

The formula for calculating the abnormal threshold is:

Among them, th is the initial setting threshold,

is the parameter to be learned, q is the set probability, N is the number of input samples, N _t is the number of samples greater than the initial threshold, and the abnormal score calculated in real time is added to iteratively update the detection threshold. 9. The multi-dimensional time series anomaly detection method oriented to industrial control systems as claimed in claim 8, characterized in that, in said step 7, the time series data collected in real time at time t are input into the anomaly detection model , to obtain the abnormal score score, which is the reconstruction probability of the input data by the abnormal detection model; when score<threshold, it is considered abnormal, otherwise, it is considered normal. 10. The multi-dimensional time series anomaly detection method oriented to industrial control systems according to claim 9, characterized in that in step 8, for the detected abnormal time series fragments, the abnormalities of all dimensions of the input data at that moment are calculated Possibility, and sorted from high to low, select the first k dimensions as anomalies, and output the name of the sensor or actuator corresponding to the anomalous dimension, the time when the anomaly occurred, and the duration.

Images