电子学报 ›› 2021, Vol. 49 ›› Issue (8): 1561-1568.DOI: 10.12263/DZXB.20180015

• 学术论文 • 上一篇    下一篇

基于SAE-LSTM的工艺数据异常检测方法

尚文利1, 石贺2,3,4, 赵剑明2,3,4, 曾鹏2,3,4   

  1. 1.广州大学电子与通信工程学院,广东 广州 510006
    2.中国科学院沈阳自动化研究所,辽宁 沈阳 110016
    3.中国科学院大学,北京 100039
    4.中科院网络化控制系统重点实验室,辽宁 沈阳 110016
  • 收稿日期:2018-12-29 修回日期:2021-05-31 出版日期:2021-08-25 发布日期:2021-08-25
  • 作者简介:尚文利 男,1974年生于黑龙江省望奎县.博士,研究员,博士生导师.现为广州大学“百人计划”学科带头人,原中国科学院沈阳自动化研究所工业控制系统信息安全方向学术带头人.主要研究方向为工业控制系统信息安全、计算智能与机器学习、边缘计算.E-mail:shangwl@gzhu.edu.cn
    石 贺 男,1993年生于辽宁省沈阳市.中国科学院大学硕士研究生.研究方向为机器学习、数据挖掘、工业控制系统信息安全.E-mail:shihe@sia.cn
  • 基金资助:
    国家自然科学基金(61773368);之江实验室开放课题资助(2021KF0AB06)

An Anomaly Detection Method of Process Data Based on SAE-LSTM

Wen-li SHANG1, He SHI2,3,4, Jian-ming ZHAO2,3,4, Peng ZENG2,3,4   

  1. 1.School of Electronic and Communication Engineering,Guangzhou University,Guangzhou,Guangdong 510006,China
    2.Shenyang Institute of Automation,Chinese Academy of Science,Shenyang,Liaoning 110016,China
    3.University of Chinese Academy of Sciences,Beijing 100039,China
    4.Key Laboratory of Networked Control System,CAS,Shenyang,Liaoning 110016,China
  • Received:2018-12-29 Revised:2021-05-31 Online:2021-08-25 Published:2021-08-25

摘要:

为解决工业网络安全防护中工艺数据异常检测误报率较高的问题,本文提出一种基于时间序列的异常检测方法.该方法对工艺数据进行相关性分析、向量映射等处理,再采用堆叠自编码神经网络(SAE)对工艺数据特征进行降维,根据工艺数据在传输序列间的相互关联性,设计基于长短期记忆神经网络(LSTM)的异常检测模型,最后进行工艺数据异常检测仿真实验验证分析.实验结果表明,基于时间序列的异常检测模型能有效提高工艺数据异常检测准确率,并且误报率要低于传统隐马尔可夫异常检测模型,同时获得较好的异常检测实时性.

关键词: 工业控制系统, 工控异常检测, 自编码神经网络, 长短期记忆神经网络

Abstract:

In order to solve the problem of high false alarm rate of abnormal detection of process data in industrial network security protection, this paper proposes an anomaly detection method based on time series. In this method, the process data is analyzed by association analysis and vector mapping, and the stacked auto-encoder neural network (SAE) is used to reduce the dimension of process data features. According to the correlation of process data in the transmission sequence, an anomaly detection model based on long and short term memory neural network (LSTM) is designed. Finally, the simulation analysis of abnormal detection of process data is carried out. The experimental results show that the anomaly detection model based on time series can greatly improve the accuracy of process data anomaly detection, and the false positive rate is lower than the traditional hidden Markov anomaly detection model, and at the same time get better real-time performance of anomaly detection.

Key words: industrial control system, industrial control anomaly detection system, auto-encoder neural network, long and short term memory neural network

中图分类号: