Detailed Description
The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.
As shown in fig. 1, the application provides a method for identifying abnormal behavior of an industrial control host based on multi-mode data fusion, which comprises the following steps:
And the industrial control host management system is connected to read the real-time multi-mode monitoring data, the real-time industrial control host environment data and the real-time industrial control host business scene data of the industrial control host.
The multi-mode data fusion refers to the integration and fusion of data from different sensors or different modes to obtain more comprehensive and accurate information. Common multimodal data includes images, video, voice, text, and the like. By performing joint analysis and processing on these different types of data, the reliability and accuracy of the information can be improved. The industrial control host is a special computer host for an industrial automation control system, and has obvious differences in function and design from a common computer host. Industrial control hosts generally have higher stability, reliability and safety to accommodate complex industrial environments. The application provides an industrial control host abnormal behavior identification method based on multi-mode data fusion, which is used for comparing the health multi-mode and real-time multi-mode monitoring data of the industrial control host to generate the health deviation multi-mode of the industrial control host, calculating the health deviation depth coefficient of the industrial control host by combining the health deviation depth identification space of the industrial control host, and constructing an industrial control host abnormal visible cloud picture by combining an industrial control host comprehensive abnormal identification module, thereby achieving the beneficial effects of improving identification accuracy, enhancing robustness, realizing early warning, optimizing resource allocation, improving system safety, supporting decision making, simplifying management flow and the like, being beneficial to improving the overall performance and safety of an industrial control system, and providing powerful technical support for industrial production.
The industrial control host management system is a software system for monitoring, managing and controlling the industrial control host, and is used for obtaining state information, operation data and the like of the industrial control host in real time by communicating with the industrial control host so as to realize comprehensive monitoring and management of the industrial control host. In the application, connecting the industrial control host management system refers to accessing the industrial control host management system and is used for reading real-time multi-mode monitoring data, real-time industrial control host environment data and real-time industrial control host service scene data of the industrial control host, wherein the real-time multi-mode monitoring data refers to collecting various types of data from the industrial control host in real time. The industrial control host is provided with a plurality of sensors, and the plurality of sensors can monitor physical parameters such as temperature data, vibration data, noise data and the like of equipment in real time and transmit the physical parameters monitored in real time to the industrial control host management system, wherein the real-time multi-mode data refer to sensors from a plurality of different sources and types at the same time, for example, the temperature data refer to monitoring the temperature of internal components of the industrial control host, such as a CPU (Central processing unit), a memory and the like, by using the temperature sensors. The environment data in the real-time industrial control host generally refers to the data of the environmental state around the industrial control host, and in the application, the environment data comprises temperature, humidity, air quality, illumination intensity and the like; the real-time industrial control host environment data refers to that the industrial control host management system can collect and display state data of the environment where the industrial control host is located in real time, and is very important in the aspects of knowing whether the working environment of the industrial control host is suitable, whether potential risks exist or not and the like, for example, the performance of the industrial control host is reduced or equipment is damaged due to the fact that the excessive temperature is likely to cause, and therefore real-time monitoring of the temperature data is very important in ensuring the normal operation of the industrial control host. The real-time industrial control host service scene data comprise real-time execution task information of the industrial control host, and the real-time execution task information comprises a real-time execution task name, real-time execution task time, real-time task execution parameters and the like. By the method, the industrial control host management system is connected, the sensor nearby the industrial control host is activated, the real-time multi-mode monitoring data, the real-time industrial control host environment data and the real-time industrial control host service scene data of the industrial control host are obtained, the real-time information about different aspects of the industrial control host is obtained, and the user can comprehensively know the running condition of the industrial control host and effectively manage the industrial control host.
And predicting the health multi-modal of the industrial control host according to the real-time industrial control host environment data and the real-time industrial control host business scene data to obtain the health multi-modal of the industrial control host.
And predicting health multi-modes of the industrial personal computer according to the real-time industrial personal computer environment data and the real-time industrial personal computer service scene data, and integrating the collected real-time industrial personal computer environment data and the real-time industrial personal computer service scene data to form a data set containing a plurality of modes such as temperature, humidity, pressure, flow, service parameters and the like. And predicting health multi-mode of the industrial control host according to the real-time industrial control host environment data and the real-time industrial control host service scene data, for example, under the environment and task scene of the real-time industrial control host environment data and the real-time industrial control host service scene data, the temperature data, vibration data, noise data and the like of the industrial control host, which correspond to the predicted health, can reflect a plurality of health parameter data of the industrial control host, which are healthy in real time, and record the health multi-mode of the industrial control host. By the method, the industrial control host is subjected to health multi-mode prediction to obtain health multi-mode of the industrial control host, such as health temperature data, health vibration data and the like.
Loading a plurality of groups of health multi-mode records of the industrial control host according to the industrial control host management system; performing registration analysis on the health multi-mode records of the plurality of groups of industrial control hosts according to the real-time industrial control host environment data and the real-time industrial control host service scene data to obtain a registration health multi-mode record set; performing multi-mode clustering according to the registration health multi-mode record set to obtain a multi-mode health sample area; traversing the multi-modal health sample area to perform centralized interval calculation to generate a multi-modal health characteristic interval; and adding the multi-mode health characteristic interval to the industrial control host health multi-mode.
And uploading a plurality of groups of history industrial control host health multi-mode records from a database of the industrial control host management system, wherein the records generally comprise health state information of the industrial control host under different environments at different times. And collecting real-time industrial control host environment data such as temperature, humidity, pressure and the like, and collecting real-time industrial control host business scene data, wherein the real-time industrial control host business scene data comprises real-time execution task information of an industrial control host, the real-time execution task information comprises real-time execution task names, real-time execution task time, real-time task execution parameters and the like, namely, the real-time industrial control host environment data and the real-time industrial control host business scene data, and performing registration analysis on a plurality of groups of historical health multi-mode records by using the real-time industrial control host environment data and the business scene data, wherein the registration analysis is an alignment and matching process and aims at finding a history record similar to or related to the current real-time data. By comparing the features in the real-time data and the historical data, the historical health multi-mode record closest to the current environment and the service scene can be screened out. The historical health multi-mode records screened through registration analysis are formed into a new set, namely a registration health multi-mode record set, multi-mode clustering is carried out on the registration health multi-mode record set, the multi-mode clustering is a technology for clustering by utilizing a plurality of data sources or features, similar health multi-mode records are grouped, a clustering algorithm can divide the records into different categories according to the features and the similarity of the data, and each category represents a health state or mode. A plurality of multi-mode health sample areas are obtained through cluster analysis, and each multi-mode health sample area represents a specific health state or mode and consists of a group of health multi-mode records for judging health. Traversing each multi-mode health sample area to perform centralized interval calculation. The centralized interval calculation is to count and analyze the distribution of the characteristic values in the sample area, and determine the health range or threshold value of each characteristic. And generating a multi-mode health characteristic interval for each multi-mode health sample area according to the result of the centralized interval calculation, wherein the health range or threshold value of each characteristic of the industrial control host is described in the sample area. The generated multi-mode health characteristic interval is added into the health multi-mode of the industrial control host and is used as an important basis for evaluating the health state of the current industrial control host. By the method, the industrial control host management system can generate and update the health multi-mode information of the industrial control host by utilizing the plurality of groups of history health multi-mode records and the real-time data, and powerful support is provided for subsequent health assessment and fault prediction.
Extracting a first group of industrial control host health multi-modal records according to the plurality of groups of industrial control host health multi-modal records, wherein the first group of industrial control host health multi-modal records comprise a first industrial control host multi-modal health monitoring sample, a first industrial control host environment sample and a first industrial control host business scene sample; performing similar recognition according to the real-time industrial control host environment data and the first industrial control host environment sample to obtain a first environment sample similarity coefficient; performing similar recognition according to the real-time industrial control host service scene data and the first industrial control host service scene sample to obtain a first service scene sample similarity coefficient; weighting calculation is carried out on the first environmental sample similarity coefficient and the first business scene sample similarity coefficient according to the registration analysis weight condition, and a first registration analysis coefficient is generated; judging whether the first registration analysis coefficient meets registration analysis constraint; if the first registration analysis coefficient meets the registration analysis constraint, adding the first industrial control host multi-modal health monitoring sample to the registration health multi-modal record set; and according to the registration analysis weight condition and the registration analysis constraint, continuously carrying out iterative registration analysis on the multi-group industrial control host health multi-mode records by combining the real-time industrial control host environment data and the real-time industrial control host service scene data to generate the registration health multi-mode record set.
Extracting any group of industrial control host health multi-mode records according to the plurality of groups of industrial control host health multi-mode records to study, and recording the records as a first group of industrial control host health multi-mode records, wherein the first group of industrial control host health multi-mode records comprise a first industrial control host multi-mode health monitoring sample, a first industrial control host environment sample and a first industrial control host business scene sample, and the first industrial control host multi-mode health monitoring sample refers to multi-mode health data, such as health temperature data and the like, for judging that the industrial control host is in a health state; the first industrial control host environment sample and the first industrial control host business scene sample refer to target environment conditions and target task conditions for predicting the health multi-mode records of the first group of industrial control hosts; Performing similarity calculation on the real-time industrial control host environment data and a first industrial control host environment sample to obtain a first environment sample similarity coefficient, performing similarity calculation on the real-time industrial control host business scene data and the first industrial control host business scene sample to obtain a first business scene sample similarity coefficient, wherein similarity identification refers to analyzing the similarity of the real-time industrial control host environment data and the first industrial control host environment sample, for example, the temperature data in the real-time industrial control host environment data is 26 ℃, the temperature data in the first industrial control host environment sample is 30 ℃, and calculating the similarity is to judge the similarity of 26 ℃ and 30 ℃, And calculating the similarity one by one according to all the parameter data of the real-time industrial control host environment data and all the parameter data of the first industrial control host environment sample, and then calculating the average value or weighted average value and the like of all the parameter data to obtain a first environment sample similarity coefficient, wherein the first business scene sample similarity coefficient obtaining method is used for calculating the first environment sample similarity coefficient as described above. And weighting two groups of similarity coefficients, namely the environment sample similarity coefficient and the business scene sample similarity coefficient, when calculating the first registration analysis coefficient according to the registration analysis weight condition, namely the registration analysis weight condition obtained based on expert knowledge, historical data or a machine learning model. This weighting process allows the system to adjust the importance of different data sources according to actual needs. For example, if the environmental data is more important to the registration results, the environmental sample similarity coefficients may be given higher weight. And carrying out weighted calculation on the first environment sample similarity coefficient and the first business scene sample similarity coefficient to generate a first registration analysis coefficient, wherein the first registration analysis coefficient synthesizes the similarity of the environment and the business scene. judging whether the first registration analysis coefficient meets the preset registration analysis constraint, wherein the registration analysis constraint is set by a technician, the technician does not interfere with the registration analysis constraint, if the first registration analysis coefficient meets the registration analysis constraint, adding the first industrial control host multi-mode health monitoring sample to the registration health multi-mode record set, continuing to perform iterative registration analysis on the rest multi-group industrial control host health multi-mode records according to the registration analysis weight condition and the registration analysis constraint, repeating the steps of similarity identification, weighting calculation and registration analysis constraint judgment in each iteration, sequentially adding the industrial control host multi-mode health monitoring sample meeting the condition to the registration health multi-mode record set, After multiple iterations, repeating the operations of the multi-group industrial control host health multi-mode records, and finally generating a registration health multi-mode record set containing industrial control host multi-mode health monitoring samples matched with the real-time industrial control host environment and the service scene. by the method, the generated registration health multi-mode record set has higher correlation with the actual running environment and business scene of the real-time industrial control host, so that more valuable data support is provided for subsequent tasks such as fault diagnosis, performance prediction and the like.
And performing multi-mode deviation comparison fusion on the real-time multi-mode monitoring data according to the industrial control host health multi-mode to generate the industrial control host health deviation multi-mode.
And performing multi-mode deviation comparison fusion on the real-time multi-mode monitoring data according to the health multi-mode of the industrial control host, respectively calculating the deviation between the real-time monitoring data and the health multi-mode record according to each mode such as temperature, humidity and vibration, and calculating the difference value, the ratio, the relative deviation and the like between the real-time monitoring data and the health multi-mode record. According to actual demands and domain knowledge, determining how to fuse deviations of different modes, and the fusion strategy can be based on methods such as simple weighting, principal component analysis, neural network and the like. And fusing the deviations of different modes according to the determined fusion strategy. For example, if a simple weighting method is employed, each modality may be assigned a weight and the weighted deviations are then added or multiplied to obtain a composite deviation. The fused multi-mode deviation is used as a new multi-mode data set, namely the health deviation multi-mode of the industrial control host, and deviation information of the industrial control host relative to the health state in a real-time monitoring state is contained. By the method, the real-time multi-mode monitoring data are subjected to multi-mode deviation comparison and fusion based on the health multi-mode record of the industrial control host, so that the health deviation multi-mode of the industrial control host is generated, and powerful data support is provided for health management of the industrial control host.
And inputting the health deviation multi-mode of the industrial control host into a preset industrial control host health deviation depth identification space to obtain the health deviation depth coefficient of the industrial control host.
The industrial control host health deviation depth recognition space is built based on a deep learning technology, can process the industrial control host health deviation multi-mode data, is trained and optimized through a large amount of marked historical data, and can recognize different health deviation modes. And taking the previously generated multi-modal data of the health deviation of the industrial control host as input data, preparing to input the input multi-modal data into the health deviation depth identification space of the industrial control host, receiving the input multi-modal data, performing forward propagation through an internal network structure of the multi-modal data, automatically extracting characteristics in the data, and comparing and matching the characteristics with the previously learned health deviation modes. The industrial control host health deviation depth identification space outputs a coefficient representing the degree of the industrial control host health deviation, and the coefficient is recorded as the industrial control host health deviation depth coefficient, so that the severity of the industrial control host in different health deviation aspects can be represented. By the method, the health deviation of the industrial control host is input into the preset industrial control host health deviation depth identification space in a multi-mode, the health deviation depth coefficient of the industrial control host is obtained, and accurate assessment and guidance are provided for health management of the industrial control host.
Performing attribute identification according to the multi-modal of the health deviation of the industrial control host to obtain multi-modal attribute characteristics of the health deviation of the industrial control host; building a multi-modal coordinate system of the health deviation of the industrial control host according to the multi-modal attribute characteristics of the health deviation of the industrial control host; according to preset capacity constraint and the industrial control host health deviation multi-mode attribute characteristics, the industrial control host management system is interacted, and an industrial control host health deviation depth identification record set is called, wherein the industrial control host health deviation depth identification record set comprises an industrial control host health deviation multi-mode record set and an industrial control host health deviation depth coefficient record set; performing data quality optimization according to the industrial control host health deviation depth identification record set to obtain an optimized industrial control host health deviation depth identification record set; and inputting the optimized industrial control host health deviation depth identification record set into the industrial control host health deviation multi-mode coordinate system to generate the industrial control host health deviation depth identification space.
And carrying out attribute identification according to the health deviation multi-mode of the industrial control host, identifying attribute characteristics in each mode, including temperature deviation, humidity deviation, vibration frequency deviation and the like, extracting and representing the attribute characteristics by using a characteristic extraction technology to obtain the health deviation multi-mode attribute characteristics of the industrial control host, constructing an industrial control host health deviation multi-mode coordinate system according to the identified health deviation multi-mode attribute characteristics of the industrial control host, wherein each dimension represents a key attribute of one mode, an origin of the coordinate system can be set as a reference value in a health state, in the health deviation multi-mode coordinate system of the industrial control host, the health deviation state of each industrial control host can be represented by a point, and the coordinates of the point reflect the deviation degree of different modes. According to the preset capacity constraint and the multi-modal attribute characteristics of the health deviation of the industrial control host, the industrial control host management system is interacted with to obtain an industrial control host health deviation depth identification record set which comprises the multi-modal record set of the health deviation of the industrial control host and the health deviation depth coefficient record set of the industrial control host, wherein the industrial control host health deviation depth identification record set comprises multi-modal data of the industrial control host in different health states and corresponding depth coefficients in the past time. And carrying out data quality optimization on the called industrial control host health deviation depth identification record set, namely checking the integrity, accuracy and consistency of data, removing or correcting abnormal values, missing values or error data, improving the data quality by using technologies such as data cleaning, interpolation, smoothing and the like, and obtaining an optimized industrial control host health deviation depth identification record set after the data quality optimization, wherein the data of the optimized industrial control host health deviation depth identification record set is more accurate and reliable, and can better reflect the health deviation condition of the industrial control host. The optimized industrial control host health deviation depth identification record set is input into the industrial control host health deviation multi-mode coordinate system, training and learning are carried out in the industrial control host health deviation multi-mode coordinate system by using the optimized industrial control host health deviation depth identification record set, a depth identification model or space is built, and the health deviation degree and type of the industrial control host can be rapidly and accurately identified according to new industrial control host health deviation multi-mode data. By the method, the attribute identification is carried out according to the health deviation multi-mode of the industrial control host, the coordinate system is built, and the history record set is utilized for optimization to generate the health deviation depth identification space of the industrial control host, so that powerful support is provided for health management of the industrial control host.
And judging whether the health deviation depth coefficient of the industrial control host is larger than/equal to the health deviation depth threshold of the industrial control host.
Setting a threshold value of the health deviation depth of the industrial control host, determining according to the performance requirement, historical data, industry standard, expert experience and other factors of the industrial control host, wherein the threshold value generally represents a critical point of the health deviation of the industrial control host, and when the deviation exceeds the threshold value, the industrial control host may have abnormal conditions. Comparing the obtained health deviation depth coefficient of the industrial control host with a preset health deviation depth threshold value, and if the health deviation depth coefficient is larger than or equal to the threshold value, indicating that the health deviation of the industrial control host exceeds an allowable range, and further processing is needed. By the method, whether the health deviation depth coefficient of the industrial control host is larger than or equal to the health deviation depth threshold of the industrial control host can be effectively judged, and support is provided for subsequent maintenance of the health state of the industrial control host by taking corresponding measures according to the judgment result.
And if the health deviation depth coefficient of the industrial control host is larger than or equal to the health deviation depth threshold of the industrial control host, activating an industrial control host comprehensive abnormality identification module constructed based on the industrial control host abnormal feature learning function.
And judging whether the health deviation depth coefficient of the industrial control host is larger than or equal to a preset health deviation depth threshold of the industrial control host, if the health deviation depth coefficient of the industrial control host is larger than or equal to the health deviation depth threshold of the industrial control host, activating an industrial control host comprehensive abnormality recognition module constructed based on an industrial control host abnormal feature learning function, loading an abnormal feature learning function pre-trained in the industrial control host comprehensive abnormality recognition module, and extracting and recognizing abnormal features from multi-mode data of the industrial control host. And collecting real-time multi-mode data of the industrial control host, wherein the data are used as input of the industrial control host comprehensive abnormality identification module, the loaded abnormality feature learning function is used for processing the real-time data, the feature related to the abnormality is extracted, the extracted abnormality feature is compared with a predefined abnormality mode or threshold value, and whether the industrial control host is abnormal or not is judged. By the method, the comprehensive abnormality identification module can be effectively activated when the health deviation depth coefficient of the industrial control host exceeds a threshold value, and the industrial control host is subjected to real-time abnormality identification and diagnosis based on the abnormality characteristic learning function. The reliability and the stability of the industrial control host are improved, and the influence of faults on production operation is reduced.
According to the industrial control host management system, an industrial control host health deviation multi-mode sample set is called, and an industrial control host abnormal behavior identification sample set and an industrial control host abnormal risk detection sample set corresponding to the industrial control host health deviation multi-mode sample set are called; based on the abnormal characteristic learning function of the industrial control host, establishing an abnormal behavior identification channel of the industrial control host according to the multi-mode sample set of the health deviation of the industrial control host and the abnormal behavior identification sample set of the industrial control host; based on the abnormal characteristic learning function of the industrial control host, identifying a sample set and an abnormal risk detection sample set of the industrial control host according to the abnormal behavior of the industrial control host, and building an abnormal risk detection channel of the industrial control host; and connecting the industrial control host abnormal behavior recognition channel with the industrial control host abnormal risk detection channel to generate the industrial control host comprehensive abnormal recognition module.
The method comprises the steps of calling an industrial control host health deviation multi-mode sample set from the industrial control host management system, wherein the industrial control host health deviation multi-mode sample set comprises multi-mode data, such as operation logs, sensor data, network flow and the like, generated when the industrial control host is in deviation in health state, and meanwhile, calling an industrial control host abnormal behavior identification sample set and an industrial control host abnormal risk detection sample set corresponding to the industrial control host health deviation multi-mode sample set, and comprises known abnormal behavior and related information of abnormal risk. According to the characteristics and data characteristics of the industrial control host, a machine learning model capable of capturing abnormal characteristics, namely an industrial control host abnormal behavior recognition channel, is designed and trained based on the industrial control host abnormal characteristic learning function, and how to recognize patterns related to abnormal behaviors from multi-mode data is learned, and similar patterns are detected in real-time data streams. The method comprises the steps of training a model capable of evaluating the severity of the abnormal risk of the industrial control host by using an industrial control host abnormal characteristic learning function and combining an industrial control host abnormal behavior recognition sample set and an industrial control host abnormal risk detection sample set, namely building an industrial control host abnormal risk detection channel, learning how to predict possible risk levels according to the characteristics of abnormal behaviors, and providing information about the severity of the risk for management staff. And connecting the industrial control host abnormal behavior recognition channel with the industrial control host abnormal risk detection channel to form a complete industrial control host comprehensive abnormal recognition module. The comprehensive abnormality recognition module of the industrial control host can simultaneously execute two tasks of abnormality behavior recognition and abnormality risk detection, and provides comprehensive abnormality information for an administrator. By the method, an industrial control host comprehensive abnormality recognition module is constructed based on the industrial control host management system so as to support real-time monitoring and abnormality management of the industrial control host.
The industrial control host abnormal characteristic learning function is as follows:
，
，
Wherein ICMLS represents an industrial control host abnormal feature learning index, ICMLSY represents an industrial control host abnormal feature learning operator, LSCW represents a preset abnormal feature learning accurate expected deviation weight, LSCO represents a preset expected abnormal feature learning accurate coefficient, LSC represents an abnormal feature learning accurate coefficient, LSLW represents an abnormal feature learning error expected deviation weight, LSLO represents a preset expected abnormal feature learning error coefficient, LSL represents an abnormal feature learning error coefficient, and the sum of LSCW and LSLW is 1.
The industrial control host abnormal characteristic learning function is as follows:
，
，
The abnormal characteristic learning function of the industrial control host is used for extracting and learning abnormal characteristics from multi-mode data of the industrial control host so as to perform subsequent abnormal behavior identification and abnormal risk detection. Wherein ICMLS characterizes an industrial control host abnormal feature learning index, which is a comprehensive index, is used for quantifying the effect of industrial control host abnormal feature learning, ICMLSY characterizes an industrial control host abnormal feature learning operator, LSCW characterizes a preset abnormal feature learning accurate expected deviation weight, which is a weight parameter used for adjusting the abnormal feature learning accurate coefficient, LSCO characterizes the preset expected abnormal feature learning accurate coefficient, which is usually a constant or preset value, represents the expected or target of the abnormal feature learning accuracy, which may be used as a reference value or reference point, LSC characterizes the abnormal feature learning accurate coefficient, which is a dynamic value, represents the accuracy of current abnormal feature learning, LSLW characterizes the abnormal feature learning error expected deviation weight, is used for adjusting the abnormal feature learning error coefficient, LSLO characterizes the preset expected abnormal feature learning error coefficient, and l characterizes the importance of calculating the abnormal feature learning error coefficient ICMLS, and the sum of LSCW and LSLW is 1, which ensures that LSC and LSL have relative importance in calculating ICMLS and allow weight adjustment to adapt to different application scenarios or demands, and LSC and LSL are usually based on the dynamic performance of LSCO and LSCO in static or preset function. The method can be used for obtaining the abnormal characteristic learning function of the industrial control host, can be used for monitoring and optimizing the abnormal characteristic learning process of the industrial control host, and can balance the relationship between learning accuracy and errors by continuously adjusting the weights LSCW and LSLW so as to obtain the optimal abnormal characteristic learning effect. Meanwhile, by comparing ICMLS with a preset threshold or target value, the performance of the current learning process can be evaluated, and corresponding measures can be taken to improve.
Activating an industrial control host abnormal characteristic learning group, wherein the industrial control host abnormal characteristic learning group comprises a plurality of industrial control host abnormal characteristic learners; randomly extracting a first industrial control host abnormal characteristic learner according to the industrial control host abnormal characteristic learning group; training and testing the first industrial control host abnormal characteristic learner by taking the industrial control host health deviation multi-mode sample set as input data and the industrial control host abnormal behavior identification sample set as output data to obtain a first industrial control host abnormal behavior identification model and a first model characteristic test result, wherein the first model characteristic test result comprises a first abnormal characteristic learning accurate coefficient and a first abnormal characteristic learning error coefficient; inputting the first model feature test result into the abnormal feature learning function of the industrial control host to obtain a first industrial control host abnormal feature learning index; judging whether the first industrial control host abnormal characteristic learning index is larger than/equal to a preset industrial control host abnormal characteristic learning index; if the abnormal characteristic learning index of the first industrial control host is larger than/equal to the abnormal characteristic learning index of the preset industrial control host, adding the abnormal behavior recognition model of the first industrial control host to the abnormal behavior recognition channel of the industrial control host; if the abnormal characteristic learning index of the first industrial control host is smaller than the abnormal characteristic learning index of the preset industrial control host, an industrial control host abnormal behavior identification loss data set is obtained, and the first industrial control host abnormal behavior identification model is optimized and trained according to the industrial control host abnormal behavior identification loss data set, so that the industrial control host abnormal behavior identification channel is generated.
The method comprises the steps of activating an industrial control host abnormal feature learning group, wherein the industrial control host abnormal feature learning group comprises a plurality of industrial control host abnormal feature learners, and the industrial control host abnormal feature learners have the capability of extracting and learning abnormal features from multi-mode data. Randomly extracting a learner from an abnormal characteristic learning group of an industrial control host as a first industrial control host abnormal characteristic learner, using a health deviation multi-mode sample set of the industrial control host as input data, using an abnormal behavior identification sample set of the industrial control host as a reference of output data, training the first industrial control host abnormal characteristic learner to enable the first industrial control host abnormal characteristic learner to learn the capability of identifying abnormal behaviors from multi-mode data, testing by using an independent test data set, namely inputting the health deviation multi-mode sample set of the industrial control host to obtain corresponding identification data, obtaining the abnormal behavior identification sample set of the industrial control host according to the health deviation multi-mode sample set of the industrial control host, The corresponding identification data is adjusted through the abnormal behavior identification sample set of the industrial control host, the first industrial control host abnormal feature learner is supervised and trained, the corresponding identification data is close to the corresponding abnormal behavior identification sample set of the industrial control host through adjusting model parameters, so that the abnormal behavior identification sample set of the industrial control host can learn the capability of identifying abnormal behaviors from multi-mode data, the first industrial control host abnormal feature learner is tested through a test data set, a first industrial control host abnormal behavior identification model and a first model feature test result are obtained, the first model feature test result comprises a first abnormal feature learning accuracy coefficient and a first abnormal feature learning error coefficient, Inputting the first model feature test result into the abnormal feature learning function of the industrial control host, calculating a first industrial control host abnormal feature learning index according to a function definition, and comparing the first industrial control host abnormal feature learning index with a preset industrial control host abnormal feature learning index threshold. If the abnormal characteristic learning index of the first industrial personal host is larger than or equal to a preset threshold value, the abnormal behavior recognition model of the first industrial personal host meets the requirement, if the abnormal characteristic learning index of the first industrial personal host is smaller than the preset threshold value, the model needs to be further optimized, if the abnormal characteristic learning index of the first industrial personal host meets the requirement, the abnormal behavior recognition model of the first industrial personal host is added to the abnormal behavior recognition channel of the industrial personal host, if the abnormal characteristic learning index of the first industrial personal host does not meet the requirement, an abnormal behavior recognition loss data set of the industrial personal host is collected, the abnormal behavior recognition model of the first industrial personal host is optimized and trained according to the loss data set, if the model parameters are adjusted, the network structure is changed, and the steps are repeated until the model meets the requirements, and the optimized model is added to the abnormal behavior recognition channel of the industrial control host. When the abnormal behavior recognition models of the industrial control host meeting the requirements are enough, the abnormal behavior recognition models of the industrial control host are connected, and a complete abnormal behavior recognition channel of the industrial control host is constructed. The industrial control host abnormal behavior recognition channel is used for detecting abnormal behaviors of the industrial control host in real time. By the method, a high-efficiency, robust, self-adaptive, modularized, real-time and accurate industrial control host abnormal behavior recognition channel is constructed by combining the multi-mode data, the learners and the quantifiable evaluation criteria, and a laying cushion is provided for subsequent researches.
As shown in fig. 2, the industrial control host health deviation is input into the industrial control host abnormal behavior recognition channel in a multi-mode manner, and an industrial control host abnormal behavior recognition result is obtained; inputting the abnormal behavior identification result of the industrial control host into the abnormal risk detection channel of the industrial control host to obtain an abnormal risk detection coefficient of the industrial control host; and integrating the abnormal behavior identification result of the industrial control host, the abnormal risk detection coefficient of the industrial control host, the real-time multi-mode monitoring data, the real-time industrial control host environment data, the real-time industrial control host business scene data, the multi-mode health deviation of the industrial control host and the depth coefficient of health deviation of the industrial control host, and drawing the abnormal visible cloud image of the industrial control host.
And inputting the industrial control host health deviation into the industrial control host abnormal behavior recognition channel in a multi-mode manner to obtain an industrial control host abnormal behavior recognition result, wherein the industrial control host abnormal behavior recognition result comprises information such as the type, severity and possible influence of the abnormal behavior. And inputting the identification result of the abnormal behavior of the industrial control host into an abnormal risk detection channel of the industrial control host, evaluating the risk possibly brought by the abnormal behavior, and outputting an abnormal risk detection coefficient of the industrial control host. The industrial control host abnormal risk detection coefficient reflects a quantification index of potential risks possibly caused by abnormal behaviors on the industrial control host and the operation environment thereof. After the industrial control host abnormal behavior identification result, the industrial control host abnormal risk detection coefficient, the real-time multi-mode monitoring data, the real-time industrial control host environment data, the real-time industrial control host business scene data, the industrial control host health deviation multi-mode and the industrial control host health deviation depth coefficient are obtained, the information can be integrated to draw an industrial control host abnormal visual cloud picture. The industrial control host abnormal visual cloud picture is a graphical tool for intuitively displaying the abnormal condition of the industrial control host. The method utilizes a visualization technology to display the various data and information in a cloud picture form, so that a user can clearly know the health condition, the distribution and the type of abnormal behaviors, the severity of potential risks and the like of the industrial control host. When the cloud picture is drawn, different visualization methods and techniques can be adopted according to different data types and information characteristics. For example, visual elements such as color, size, shape, etc. may be used to represent the severity and type of abnormal behavior; displaying the change trend of the real-time data by using the dynamic effect; an interactive interface is used to allow a user to screen, sort, and in-depth analyze data, etc. By the method, the abnormal visual cloud image of the industrial control host is constructed, and a user can more comprehensively know the abnormal condition and potential risk of the industrial control host, so that countermeasures and decision schemes can be formulated more accurately, and the stable operation, safety and reliability of the industrial control system are ensured.
And inputting the health deviation of the industrial control host into the comprehensive abnormality identification module of the industrial control host in a multi-mode manner, and generating an abnormal visible cloud picture of the industrial control host.
When multi-modal data of the industrial control host health deviation is input to the industrial control host comprehensive abnormality identification module, the industrial control host comprehensive abnormality identification module analyzes and processes the multi-modal data to identify abnormal behaviors of the industrial control host. In the process of abnormality identification, the industrial control host comprehensive abnormality identification module considers data of various sources, such as real-time multi-mode monitoring data, real-time industrial control host environment data, real-time industrial control host business scene data and the like, and historical data such as multi-mode industrial control host health deviation and industrial control host health deviation depth coefficient and the like. These data provide comprehensive information about the health and potential problems of the industrial control host. When an abnormal situation is identified, the industrial control host comprehensive abnormality identification module generates an abnormality report which comprises detailed information such as the type, severity, occurrence time and possible reasons of the abnormality, and the abnormality report is displayed in a cloud picture form by utilizing a visualization technology according to the abnormality report, namely, an industrial control host abnormality visual cloud picture. The abnormal visual cloud image of the industrial control host is an intuitive and easy-to-understand graphical representation mode, and can help a user to quickly know the abnormal condition of the industrial control host. In a cloud image, different anomalies may be represented in different colors, sizes, or shapes so that a user can see at a glance which anomalies are more important or urgent. In addition, the cloud image can also display the distribution situation of the anomalies in time and space, so that the user can be helped to find the relevance and trend among the anomalies. By the method, the real-time data and the historical data are integrated, the comprehensive abnormality identification module of the industrial control host can provide a comprehensive and accurate abnormality identification result, and the result is displayed in a visual mode through the abnormal visual cloud picture of the industrial control host. Therefore, the user can know the health condition of the industrial control host more conveniently, discover and process potential problems in time, and ensure the stable operation, safety and reliability of the industrial control system.
In summary, the beneficial effects of the application include:
1. by fusing multi-mode data from different sources and different types, more comprehensive and richer information can be obtained, so that abnormal behaviors of an industrial control host can be identified more accurately, and compared with data analysis of a single data source or a single mode, the accuracy and reliability of identification can be improved remarkably.
2. Due to the fact that multi-mode data are used, the method can solve the problems of data loss, noise interference and the like under different conditions, and has high robustness. Even if the data of one mode is problematic, the data of other modes can still provide effective information support, so that the persistence and stability of abnormal behavior identification are ensured.
3. By collecting and processing the multi-mode data in real time, the method can discover abnormal behaviors of the industrial control host in time and take corresponding countermeasures. This real-time nature is critical to ensuring stable operation of the industrial control system and avoiding potential risks.
4. By generating the industrial control host anomaly visible cloud image, the method can present complex anomaly information to a user in an intuitive and easy-to-understand manner. The visual support not only can help a user to quickly know the health condition and abnormal condition of the industrial control host, but also can provide powerful support for subsequent fault analysis and processing.
In conclusion, the industrial control host abnormal behavior recognition method based on multi-mode data fusion improves recognition accuracy and robustness, enhances real-time performance and visual support, provides powerful support for decision of users, and improves expandability and flexibility of the system by fusing various types of data information. The industrial control host abnormal behavior identification method based on multi-mode data fusion has wide application prospect and important practical value.
Specific embodiments of the method for identifying abnormal behavior of the industrial control host based on multi-modal data fusion may be referred to above and will not be described herein.
The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.
The above examples illustrate only a few embodiments of the application, which are described in detail and are not to be construed as limiting the scope of the application. It should be noted that it will be apparent to those skilled in the art that several variations and modifications can be made without departing from the spirit of the application, which are all within the scope of the application.