CN116821594A - Method and device for detecting abnormity of graphic neural network industrial control system based on frequency spectrum selection mechanism - Google Patents
Method and device for detecting abnormity of graphic neural network industrial control system based on frequency spectrum selection mechanism Download PDFInfo
- Publication number
- CN116821594A CN116821594A CN202310590660.9A CN202310590660A CN116821594A CN 116821594 A CN116821594 A CN 116821594A CN 202310590660 A CN202310590660 A CN 202310590660A CN 116821594 A CN116821594 A CN 116821594A
- Authority
- CN
- China
- Prior art keywords
- data
- industrial control
- control system
- frequency spectrum
- model
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001228 spectrum Methods 0.000 title claims abstract description 81
- 230000007246 mechanism Effects 0.000 title claims abstract description 47
- 238000013528 artificial neural network Methods 0.000 title claims abstract description 45
- 238000000034 method Methods 0.000 title claims abstract description 29
- 238000001514 detection method Methods 0.000 claims abstract description 28
- 230000009467 reduction Effects 0.000 claims abstract description 22
- 238000007781 pre-processing Methods 0.000 claims abstract description 14
- 230000005856 abnormality Effects 0.000 claims abstract description 3
- 230000002159 abnormal effect Effects 0.000 claims description 25
- 238000012549 training Methods 0.000 claims description 22
- 238000012360 testing method Methods 0.000 claims description 12
- 239000011159 matrix material Substances 0.000 claims description 8
- 238000009826 distribution Methods 0.000 claims description 5
- 230000006870 function Effects 0.000 claims description 5
- 238000003860 storage Methods 0.000 claims description 4
- 230000004913 activation Effects 0.000 claims description 3
- 238000010606 normalization Methods 0.000 claims description 3
- 238000005070 sampling Methods 0.000 claims description 3
- 238000012163 sequencing technique Methods 0.000 claims description 3
- 230000009466 transformation Effects 0.000 abstract description 5
- 238000004422 calculation algorithm Methods 0.000 abstract description 3
- 238000012545 processing Methods 0.000 description 8
- 230000000694 effects Effects 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000011156 evaluation Methods 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 210000004556 brain Anatomy 0.000 description 1
- 238000013136 deep learning model Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000003062 neural network model Methods 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 239000012466 permeate Substances 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 230000003595 spectral effect Effects 0.000 description 1
- 238000013179 statistical model Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/10—Pre-processing; Data cleansing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/047—Probabilistic or stochastic networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/048—Activation functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/02—Preprocessing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/02—Preprocessing
- G06F2218/04—Denoising
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2218/00—Aspects of pattern recognition specially adapted for signal processing
- G06F2218/12—Classification; Matching
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- General Physics & Mathematics (AREA)
- Evolutionary Computation (AREA)
- Computing Systems (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Molecular Biology (AREA)
- General Health & Medical Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Probability & Statistics with Applications (AREA)
- Testing And Monitoring For Control Systems (AREA)
Abstract
The application discloses a method and a device for detecting abnormity of a graphic neural network industrial control system based on a frequency spectrum selection mechanism, wherein the method comprises the following steps: performing data preprocessing on sensor data input into an industrial control system; carrying out Fourier transformation on the preprocessed data to obtain a frequency spectrum of the sensor data, randomly selecting the frequency spectrum, including a high-frequency part and a low-frequency part, reordering, carrying out inverse Fourier transformation on the selected frequency spectrum until the length of the frequency spectrum is consistent with that of an original frequency spectrum after zero padding at the tail, and realizing noise reduction on the premise of keeping important information of the data; inputting the processed data into an improved graph neural network, and outputting time sequence prediction data; and realizing industrial control abnormality detection based on the error of the predicted data and the real data. According to the application, the data is preprocessed by utilizing a frequency spectrum selection mechanism, and the future output of the system is predicted by the improved graph neural network, so that the algorithm can effectively improve the accuracy of anomaly detection.
Description
Technical Field
The application relates to the field of industrial system anomaly detection, in particular to a method and a device for detecting anomalies of a graphic neural network industrial control system based on a frequency spectrum selection mechanism.
Background
Industrial control systems have been widely used in the power, nuclear, petrochemical, metallurgical and other industries as the "brain" and "hub" of the industrial field. The deep integration of the Internet and the industry breaks the relatively closed environment in the traditional industrial field, permeates the security threat of the Internet into the industrial field, and the security of the industrial control system faces serious challenges due to massive data generated by the industrial control system and the accompanying continuously-updated attack mode.
The traditional security countermeasure such as misuse detection method constructs attack feature data by extracting the features of the existing attack, and finds out the intrusion attack through feature matching during detection, and the method can effectively detect the attack of the known type, but has poor detection effect on the attack of the unknown type; typical intrusion detection systems cannot detect complex threats and process-related threats, such as deviations from the control flow of an industrial process, because typical intrusion detection systems can only identify known malicious patterns of behavior. Unknown threats can be detected by using an anomaly detection technology, and the method plays a vital role in ensuring the safety of an industrial control system.
In early research of anomaly detection, the detection method is very dependent on a statistical model manually constructed by an expert in a certain field, but the method is time-consuming and labor-consuming and limits the capability of detecting unknown anomalies; at present, some machine learning methods are applied to anomaly detection and achieve good effects, but due to the fact that equipment of an industrial control system is numerous and various equipment are highly coupled, anomalies of single equipment parameters are easily covered by robust responses of other equipment, and therefore attack data with labels are difficult to obtain in a real industrial control scene; in the face of the ever-increasing data volume and the fact that conventional anomaly detection methods requiring expert knowledge in specific fields cannot directly cope with these challenges, deep learning models gradually become the mainstream technology for solving anomaly detection problems due to their powerful modeling capabilities.
The existing industrial control anomaly detection method only considers the relevance between different moments of time series data acquisition when designing a model, and ignores the relevance between different features in space. Since the sensor and the actuator have a connection relationship physically, the correlation between different characteristics contains a large amount of information which is not input into the neural network model. Therefore, it is necessary to design an algorithm to obtain the spatial correlation between features, and by means of the strong model fitting capability of the graph neural network algorithm, the accuracy of industrial control anomaly detection in practical application can be improved, and the loss caused by information leakage and damage to software and hardware systems due to network attack is reduced.
Disclosure of Invention
The embodiment of the application aims to provide a method and a device for detecting the abnormality of an industrial control system of a graph neural network based on a frequency spectrum selection mechanism so as to ensure the safety of the industrial control system.
According to an embodiment of the present application, there is provided a method for detecting anomalies in an industrial control system of a graph neural network based on a spectrum selection mechanism, including:
performing data preprocessing on sensor data input into an industrial control system;
based on a frequency spectrum selection mechanism, carrying out noise reduction treatment on the preprocessed data;
inputting the data subjected to noise reduction into an improved graph neural network, and outputting time sequence prediction data;
in a model training stage, inputting sensor data of an industrial control system under normal operation conditions to a graph neural network based on a frequency spectrum selection mechanism, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model to enable predicted output of the model to approximate to a true value as much as possible;
in the model test stage, the sensor data of the industrial control system under the attacked state is input into a trained model, and whether the industrial control system is abnormal or not is judged according to the root mean square error of the predicted output and the true value of the model.
Optionally, the data preprocessing of the sensor data input into the industrial control system comprises:
the sensor data types input into the industrial control system comprise analog quantity and digital quantity, wherein the data sources can be obtained from a real industrial control system, a industrial test bed and industrial simulation software;
normalization operation is carried out on different characteristics of sensor data input into an industrial control system, and the range of each characteristic value is normalized to [0,1], so that dimension can be eliminated, and the gradient descending process during model training can be accelerated;
judging whether abnormal values exist in the data according to the box graph of the normalized data distribution, and eliminating the abnormal values;
and performing unsteady state data processing on the data with the abnormal values removed. When the industrial control system is started, due to hysteresis, a period of time is often required for the system to reach a steady state, so that the part of unsteady state data can influence the training effect of the model, and the model can learn the mode under the normal operation working condition of the system by deleting the unsteady state data.
Optionally, based on a spectrum selection mechanism, the noise reduction processing is performed on the preprocessed data, including:
performing discrete Fourier transform on the preprocessed data to obtain a transformed spectrum, and assuming that the length of the spectrum is L;
randomly sampling high-frequency signals and low-frequency signals in the frequency spectrum to obtain M frequency spectrums, wherein M is less than L;
sequencing the frequency spectrums according to the frequency, and zero padding the tail of the sequenced frequency spectrums until the tail of the sequenced frequency spectrums are consistent with the original frequency spectrum length L, so as to obtain frequency spectrums after frequency domain selection;
and carrying out Fourier inverse transformation on the spectrum after spectrum selection, so that the sensor data input into the industrial control system can realize data noise reduction on the premise of retaining important information.
Optionally, inputting the noise-reduced data into the improved graph neural network, and outputting the time sequence prediction data, including:
for the data subjected to noise reduction, calculating the similarity between different features in pairs, and constructing an adjacent matrix by taking the front K feature pairs with the highest similarity;
splicing sensor data input into an industrial control system with data subjected to frequency spectrum selection processing to serve as model node input characteristics for calculating attention coefficients;
based on graph structure information provided by the adjacency matrix, calculating the attention coefficients of source nodes adjacent to each target node in the graph structure: splicing the source node characteristics and the target node characteristics, and multiplying the source node characteristics and the target node characteristics by the learnable parameters;
inputting the result into a nonlinear activation function ReLU to obtain a correlation coefficient after nonlinear change;
obtaining a normalized attention coefficient by the phase relation through a Softmax function;
multiplying the normalized attention coefficients among different nodes by node characteristics to obtain a time sequence prediction result of the model;
according to a second aspect of the embodiment of the present application, there is provided an anomaly detection apparatus for a neural network industrial control system based on a spectrum selection mechanism, including:
the data preprocessing module is used for preprocessing the data of the sensor input into the industrial control system;
the frequency spectrum selection module is used for carrying out noise reduction treatment on the preprocessed data;
the prediction module is used for inputting the data subjected to noise reduction into the improved graph neural network and outputting time sequence prediction data;
the training module is used for inputting sensor data of the industrial control system under normal operation conditions into the graph neural network based on the frequency spectrum selection mechanism in a model training stage, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model;
and the test module is used for inputting the sensor data of the industrial control system under the attacked state into a trained model in a model test stage, and judging whether the industrial control system is abnormal or not according to the root mean square error of the predicted output and the true value of the model.
According to a third aspect of an embodiment of the present application, there is provided an electronic apparatus including:
one or more processors;
a memory for storing one or more programs;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of the first aspect.
According to a fourth aspect of embodiments of the present application there is provided a computer readable storage medium having stored thereon computer instructions which when executed by a processor perform the steps of the method according to the first aspect.
The technical scheme provided by the embodiment of the application can comprise the following beneficial effects:
according to the embodiment, the frequency spectrum selection mechanism is adopted, so that data noise reduction can be realized on the premise of keeping important information, and noise data which can influence model training in a data set is removed; and meanwhile, the graphic neural network is improved, the integrated original data and the data processed based on the frequency spectrum selection mechanism are used as model input and respectively calculate the attention coefficients, so that the model learns more knowledge, the model is helped to learn the state of the model under the normal operation condition, and the accuracy rate of anomaly detection can be improved.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the application as claimed.
Drawings
FIG. 1 is a flowchart illustrating a method for anomaly detection for a neural network industrial control system based on a spectrum selection mechanism, according to an exemplary embodiment.
Fig. 2 is a diagram illustrating a neural network architecture based on a spectrum selection mechanism, according to an example embodiment.
FIG. 3 is a block diagram illustrating an anomaly detection apparatus for a neural network industrial control system based on a spectrum selection mechanism, according to an example embodiment.
Detailed Description
Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numbers in different drawings refer to the same or similar elements, unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the application. Rather, they are merely examples of apparatus and methods consistent with aspects of the application as detailed in the accompanying claims.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.
It should be understood that although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the application. The word "if" as used herein may be interpreted as "at … …" or "at … …" or "responsive to a determination", depending on the context.
Fig. 1 is a flowchart illustrating a method for detecting anomalies in a neural network based on a spectrum selection mechanism according to an exemplary embodiment, and fig. 2 is a neural network architecture based on a spectrum selection mechanism according to an exemplary embodiment. As shown in fig. 1 and 2, the method may include the steps of:
s1: performing data preprocessing on sensor data input into an industrial control system;
s2: based on a frequency spectrum selection mechanism, carrying out noise reduction treatment on the preprocessed data;
s3: inputting the data subjected to noise reduction into an improved graph neural network, and outputting time sequence prediction data;
s4: in a model training stage, inputting sensor data of an industrial control system under normal operation conditions to a graph neural network based on a frequency spectrum selection mechanism, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model to enable predicted output of the model to approximate to a true value as much as possible;
s5: in the model test stage, the sensor data of the industrial control system under the attacked state is input into a trained model, and whether the industrial control system is abnormal or not is judged according to the root mean square error of the predicted output and the true value of the model.
According to the embodiment, the data preprocessing based on the data characteristics is adopted, abnormal values are removed based on normalized data distribution, unsteady data are removed based on analysis of the steady state time of the system, so that the preprocessed data are closer to the working condition in normal operation, and the model is facilitated to learn the system characteristics in the normal operation working condition; the frequency spectrum selection mechanism is adopted, so that data noise reduction can be realized on the premise of keeping important information, and noise data which can influence model training in a data set is removed; by adopting the improved graph neural network, the original data and the data processed based on the frequency spectrum selection mechanism are fused together to be used as the model input, so that the model can learn more knowledge, and the accuracy of the industrial control system anomaly detection method is improved.
In a specific implementation of S1, the data preprocessing of the sensor data input into the industrial control system may comprise the sub-steps of:
s11: and carrying out data normalization processing on the sensor data input into the industrial control system.
Specifically, normalizing different characteristics of sensor data input into an industrial control system, calculating a maximum value and a minimum value of the data, and normalizing a range of each characteristic value to [0,1] based on the two values;
s12: and judging and eliminating the abnormal value based on the normalized data distribution.
Specifically, judging whether abnormal values exist in the data according to the box graph of the normalized data distribution, and if the abnormal values obviously deviate from the individual values of most data in the data, judging the abnormal values and eliminating the abnormal values;
s13: and performing unsteady state data processing on the data with the abnormal values removed.
And observing the periodicity of different characteristic data, regarding the previous section of non-periodic data as non-steady state data, deleting the data, and retaining the data in steady state.
In a specific implementation of S2, the noise reduction processing of the preprocessed data based on the spectrum selection mechanism may include the following sub-steps:
s21: and performing discrete Fourier transform on the preprocessed data to obtain a transformed frequency spectrum.
Specifically, assuming that the original input data is X [ n ], the result after fourier transformation is X [ k ], and the calculation formula of discrete fourier transformation is:
s22: the spectral data is randomly selected.
Specifically, assume that the spectrum length is L; randomly sampling high-frequency signals and low-frequency signals in the frequency spectrum to obtain M frequency spectrums, wherein M is less than L; sequencing the frequency spectrums according to the frequency, and zero padding the tail of the sequenced frequency spectrums until the tail of the sequenced frequency spectrums are consistent with the original frequency spectrum length L, so as to obtain frequency spectrums after frequency domain selection; and carrying out inverse Fourier transform on the spectrum after spectrum selection to obtain data with noise reduction.
S23: and performing inverse Fourier transform on the frequency spectrum after random selection.
Specifically, assuming that the randomly selected spectrum data is X [ k ], the result after the inverse fourier transform is X [ n ], and the calculation formula of the inverse discrete fourier transform is:
in the implementation of S3, the method for inputting the noise-reduced data into the improved neural network and outputting the time-series prediction data may include the following sub-steps:
s31: based on the noise-reduced data, feature correlations are calculated, and an adjacency matrix is constructed.
Specifically, for the data X subjected to noise reduction, similarity between different features is calculated pairwise, and the front K feature pairs with the highest similarity are taken to construct an adjacent matrix;
the calculation formula of the similarity is as follows:
s32: and inputting the noise-reduced good data and the adjacent matrix into an improved graph neural network, and outputting a time sequence prediction result.
Specifically, sensor data input into an industrial control system and data after spectrum selection processing are spliced to be used as model node input characteristics for calculating attention coefficients; based on graph structure information provided by the adjacency matrix, calculating the attention coefficients of source nodes adjacent to each target node in the graph structure: splicing the source node characteristics and the target node characteristics, and multiplying the source node characteristics and the target node characteristics by the learnable parameters; inputting the result into a nonlinear activation function ReLU to obtain a correlation coefficient after nonlinear change; obtaining a normalized attention coefficient by the phase relation through a Softmax function; multiplying the normalized attention coefficients among different nodes by node characteristics to obtain a time sequence prediction result of the whole data;
in the specific implementation of S4, in the model training stage, inputting sensor data of an industrial control system under normal operation conditions into a graph neural network based on a frequency spectrum selection mechanism, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model to enable the predicted output of the model to approximate to a true value as much as possible;
specifically, in a model training stage, sensor data of an industrial control system under a normal operation condition are input into a graph neural network based on a frequency spectrum selection mechanism, root mean square errors of model prediction output and real data are calculated, parameters of the model are updated based on an error back propagation and gradient descent mechanism, the sensor data of the industrial control system under the normal operation condition are circularly input, the model is trained, and the prediction output of the model is enabled to be as close to a true value as possible.
In the implementation of S5, in the model test stage, the sensor data of the industrial control system under the attacked state is input into a trained model, and whether the industrial control system is abnormal or not is judged according to the root mean square error of the predicted output and the true value of the model.
Specifically, in the model test stage, the sensor data of the industrial control system in the attacked state is input into a trained graph neural network based on a spectrum selection mechanism, and the root mean square error of model prediction output and real data is calculated. Judging whether the system is abnormal or not based on the set threshold value, if the root mean square error is larger than the threshold value, predicting that the industrial system is abnormal at the moment, and setting the label as abnormal. And calculating evaluation parameters based on the model predictive label and the real label, wherein the evaluation parameters comprise accuracy, recall rate and F1 score, and quantitatively evaluating the abnormal detection effect of the model.
The application also provides an embodiment of the abnormal detection device of the graphic neural network industrial control system based on the frequency spectrum selection mechanism, which corresponds to the embodiment of the abnormal detection method of the graphic neural network industrial control system based on the frequency spectrum selection mechanism.
FIG. 3 is a block diagram illustrating an anomaly detection apparatus for a neural network industrial control system based on a spectrum selection mechanism, according to an example embodiment. Referring to fig. 3, the apparatus includes:
the data preprocessing module 1 is used for preprocessing data of sensor data input into the industrial control system;
the frequency spectrum selection module 2 is used for carrying out noise reduction treatment on the preprocessed data;
the prediction module 3 is used for inputting the data subjected to noise reduction processing into the improved graph neural network and outputting time sequence prediction data;
the training module 4 is used for inputting sensor data of the industrial control system under normal operation conditions into the graph neural network based on the frequency spectrum selection mechanism in a model training stage, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model;
and the test module 5 is used for inputting the sensor data of the industrial control system under the attacked state into a trained model in a model test stage, and judging whether the industrial control system is abnormal or not according to the root mean square error of the predicted output and the true value of the model.
The specific manner in which the various modules perform the operations in the apparatus of the above embodiments have been described in detail in connection with the embodiments of the method, and will not be described in detail herein.
For the device embodiments, reference is made to the description of the method embodiments for the relevant points, since they essentially correspond to the method embodiments. The apparatus embodiments described above are merely illustrative, wherein the elements illustrated as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purposes of the present application. Those of ordinary skill in the art will understand and implement the present application without undue burden.
Correspondingly, the application also provides electronic equipment, which comprises: one or more processors; a memory for storing one or more programs; the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method for anomaly detection for a neural network industrial control system based on a spectrum selection mechanism as described above.
Correspondingly, the application also provides a computer readable storage medium, wherein computer instructions are stored on the computer readable storage medium, and the instructions are executed by a processor to realize the graph neural network industrial control system anomaly detection method based on the frequency spectrum selection mechanism.
Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the application pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.
It is to be understood that the application is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the application is limited only by the appended claims.
Claims (7)
1. The method for detecting the abnormality of the graphic neural network industrial control system based on the frequency spectrum selection mechanism is characterized by comprising the following steps of:
performing data preprocessing on sensor data input into an industrial control system;
based on a frequency spectrum selection mechanism, carrying out noise reduction treatment on the preprocessed data;
inputting the data subjected to noise reduction into an improved graph neural network, and outputting time sequence prediction data;
in a model training stage, inputting sensor data of an industrial control system under normal operation conditions to a graph neural network based on a frequency spectrum selection mechanism, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model to enable predicted output of the model to approximate to a true value as much as possible;
in the model test stage, the sensor data of the industrial control system under the attacked state is input into a trained model, and whether the industrial control system is abnormal or not is judged according to the root mean square error of the predicted output and the true value of the model.
2. The method of claim 1, wherein data preprocessing the sensor data input to the industrial control system comprises:
normalizing the different characteristics of the sensor data input into the industrial control system;
judging whether abnormal values exist in the data according to the normalized data distribution box graph, and eliminating the abnormal values;
and deleting the unsteady state data so that the model can learn the mode under the normal operation condition of the system.
3. The method of claim 1, wherein denoising the preprocessed data based on a spectrum selection mechanism, comprises:
performing discrete Fourier transform on the preprocessed data to obtain a transformed frequency spectrum;
randomly sampling the frequency spectrum by a high-frequency signal and a low-frequency signal to obtain M frequency spectrums;
sequencing the frequency spectrums according to the frequency, and zero padding the tail of the sequenced frequency domain components until the tail of the sequenced frequency domain components are consistent with the original frequency spectrum length L, so as to obtain frequency spectrums after frequency domain selection;
and carrying out inverse Fourier transform on the spectrum subjected to spectrum selection to obtain time sequence data after noise reduction.
4. The method of claim 1, wherein inputting the noise-reduced data into the modified neural network and outputting the time-series prediction data, comprises:
the improved graph neural network calculates the similarity between different features according to the noise-reduced data, and constructs an adjacent matrix corresponding to the features according to the similarity value;
according to the adjacency matrix, the improved graph neural network calculates the attention correlation coefficient of a source node adjacent to a target node, then the attention correlation coefficient is subjected to a nonlinear activation function ReLU, and the result is subjected to Softmax normalization to obtain a graph attention coefficient;
and obtaining a time sequence prediction result through weighted operation of the graph meaning force coefficient and the node characteristic.
5. The utility model provides a graph neural network industrial control system anomaly detection device based on frequency spectrum selection mechanism which characterized in that includes:
the data preprocessing module is used for preprocessing the data of the sensor input into the industrial control system;
the frequency spectrum selection module is used for carrying out noise reduction treatment on the preprocessed data;
the prediction module is used for inputting the data subjected to noise reduction into the improved graph neural network and outputting time sequence prediction data;
the training module is used for inputting sensor data of the industrial control system under normal operation conditions into the graph neural network based on the frequency spectrum selection mechanism in a model training stage, updating parameters of a model based on an error back propagation and gradient descent mechanism, and training the model;
and the test module is used for inputting the sensor data of the industrial control system under the attacked state into a trained model in a model test stage, and judging whether the industrial control system is abnormal or not according to the root mean square error of the predicted output and the true value of the model.
6. An electronic device, comprising:
one or more processors;
a memory for storing one or more programs;
the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any of claims 1-4.
7. A computer readable storage medium having stored thereon computer instructions which, when executed by a processor, implement the steps of the method according to any of claims 1-4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310590660.9A CN116821594B (en) | 2023-05-24 | 2023-05-24 | Method and device for detecting abnormity of graphic neural network industrial control system based on frequency spectrum selection mechanism |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310590660.9A CN116821594B (en) | 2023-05-24 | 2023-05-24 | Method and device for detecting abnormity of graphic neural network industrial control system based on frequency spectrum selection mechanism |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116821594A true CN116821594A (en) | 2023-09-29 |
| CN116821594B CN116821594B (en) | 2023-12-05 |
Family
ID=88121272
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310590660.9A Active CN116821594B (en) | 2023-05-24 | 2023-05-24 | Method and device for detecting abnormity of graphic neural network industrial control system based on frequency spectrum selection mechanism |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116821594B (en) |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150058019A1 (en) * | 2013-08-23 | 2015-02-26 | Kabushiki Kaisha Toshiba | Speech processing system and method |
| US20170140774A1 (en) * | 2014-07-04 | 2017-05-18 | Clarion Co., Ltd. | Signal processing device and signal processing method |
| WO2020073665A1 (en) * | 2018-10-11 | 2020-04-16 | 平安科技（深圳）有限公司 | Method and system for performing speech emotion recognition using spectrum, and storage medium |
| CN111508508A (en) * | 2020-04-15 | 2020-08-07 | 腾讯音乐娱乐科技（深圳）有限公司 | Super-resolution audio generation method and equipment |
| CN113077806A (en) * | 2021-03-23 | 2021-07-06 | 杭州朗和科技有限公司 | Audio processing method and device, model training method and device, medium and equipment |
| US20220269258A1 (en) * | 2020-09-15 | 2022-08-25 | Zhejiang University | Method for anomaly classification of industrial control system communication network |
| CN115147255A (en) * | 2022-06-29 | 2022-10-04 | 浙江大学 | Telecommunication fraud detection method, system and storage medium based on graph neural network |
| CN115373374A (en) * | 2022-10-26 | 2022-11-22 | 山东省计算中心（国家超级计算济南中心） | Industrial control abnormity detection method and system based on graph nerve and gated loop network |
| CN115616358A (en) * | 2022-10-21 | 2023-01-17 | 国网浙江省电力有限公司 | High-voltage cable fault judgment method based on frequency spectrum time chart neural network |
-
2023
- 2023-05-24 CN CN202310590660.9A patent/CN116821594B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20150058019A1 (en) * | 2013-08-23 | 2015-02-26 | Kabushiki Kaisha Toshiba | Speech processing system and method |
| US20170140774A1 (en) * | 2014-07-04 | 2017-05-18 | Clarion Co., Ltd. | Signal processing device and signal processing method |
| WO2020073665A1 (en) * | 2018-10-11 | 2020-04-16 | 平安科技（深圳）有限公司 | Method and system for performing speech emotion recognition using spectrum, and storage medium |
| CN111508508A (en) * | 2020-04-15 | 2020-08-07 | 腾讯音乐娱乐科技（深圳）有限公司 | Super-resolution audio generation method and equipment |
| US20220269258A1 (en) * | 2020-09-15 | 2022-08-25 | Zhejiang University | Method for anomaly classification of industrial control system communication network |
| CN113077806A (en) * | 2021-03-23 | 2021-07-06 | 杭州朗和科技有限公司 | Audio processing method and device, model training method and device, medium and equipment |
| CN115147255A (en) * | 2022-06-29 | 2022-10-04 | 浙江大学 | Telecommunication fraud detection method, system and storage medium based on graph neural network |
| CN115616358A (en) * | 2022-10-21 | 2023-01-17 | 国网浙江省电力有限公司 | High-voltage cable fault judgment method based on frequency spectrum time chart neural network |
| CN115373374A (en) * | 2022-10-26 | 2022-11-22 | 山东省计算中心（国家超级计算济南中心） | Industrial control abnormity detection method and system based on graph nerve and gated loop network |
Non-Patent Citations (3)
| Title |
|---|
| YAN ZHANG等: "SpecKriging: GNN-Based Secure Cooperative Spectrum Sensing", 《IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS》, vol. 21, no. 11, pages 9936, XP011927046, DOI: 10.1109/TWC.2022.3181064 * |
| 丁超越: "多模态时间序列异常检测研究", 《中国优秀硕士学位论文全文数据库_基础科学辑》, pages 002 - 250 * |
| 蒋宇: "齿轮箱混沌特性与故障诊断研究", 《中国博士学位论文全文数据库_工程科技Ⅱ辑》, pages 029 - 5 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116821594B (en) | 2023-12-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102265227B (en) | Method and apparatus for creating state estimation models in machine condition monitoring | |
| AU2019201857B2 (en) | Sparse neural network based anomaly detection in multi-dimensional time series | |
| JP6740247B2 (en) | Anomaly detection system, anomaly detection method, anomaly detection program and learned model generation method | |
| CN112655004A (en) | Computer-implemented method, computer program product, and system for anomaly detection and/or predictive maintenance | |
| Hou et al. | Generalized Gini indices: Complementary sparsity measures to Box-Cox sparsity measures for machine condition monitoring | |
| CN111079348B (en) | Method and device for detecting slowly-varying signal | |
| CN112418361A (en) | Industrial control system anomaly detection method and device based on deep learning | |
| CN116700206B (en) | Industrial control system anomaly detection method and device based on multi-modal neural network | |
| Lamba et al. | Role of mathematics in machine learning | |
| Ali et al. | Survey on cyber security for industrial control systems | |
| CN116821594B (en) | Method and device for detecting abnormity of graphic neural network industrial control system based on frequency spectrum selection mechanism | |
| Döhler | Subspace-based system identification and fault detection: Algorithms for large systems and application to structural vibration analysis | |
| Jap et al. | Practical side-channel based model extraction attack on tree-based machine learning algorithm | |
| CN108761250B (en) | Industrial control equipment voltage and current-based intrusion detection method | |
| Zhu et al. | Generic process visualization using parametric t-SNE | |
| Huang et al. | An Accurate Prediction Algorithm of RUL for Bearings: Time‐Frequency Analysis Based on MRCNN | |
| Hoang et al. | A bearing fault diagnosis method based on autoencoder and particle swarm optimization–Support Vector Machine | |
| CN113067805B (en) | Internet of things weak electromagnetic interference attack detection method and system based on edge calculation | |
| CN113514246A (en) | Rotary mechanical system damage detection method and device and terminal | |
| Meraneh et al. | SADIS: real-time sound-based anomaly detection for industrial systems | |
| CN117033983B (en) | Unmanned ship self-noise detection and identification method and system | |
| CN114114910B (en) | Model-data hybrid drive-based dynamic anomaly detection method for electric power industrial control system | |
| Wang et al. | Reconstructing distant interactions of multiple paths between perceptible nodes in dark networks | |
| CN118568731A (en) | Monitoring method, system, device, storage medium and processor for information security engineering project drilling process | |
| EP1724704A9 (en) | Method and system for automatic evaluation of feature relevance |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |