Industrial control anomaly detection method for industrial control system with insufficient samples

Abstract

The invention relates to the technical field of comprehensive factory control, and discloses an industrial control anomaly detection method for an industrial control system with insufficient samples, and the method comprises the steps: constructing a classifier through employing a machine learning algorithm, and monitoring the reading of each sensor in the industrial control system through employing the classifier, so as to judge whether the current state is in an industrial control anomaly state or not. According to the method, all the sample features are arranged in a descending order by judging the influence degree of the sample features on the response, and then the sample features which are ranked in the front are intercepted for training, so that the TrAdaBoost algorithm can still be normally used for machine learning when the dimensions of the sample features of the source domain and the target domain are inconsistent; by improving back-filling parameters, the difference between a source domain and a target domain is considered, and the AUC value of the classifier is improved; by adopting a genetic algorithm, the optimal value of the number of iterations and the optimal value of the number of base classifiers are screened out with a small calculation amount.

Description

technical field [0001] The invention relates to the technical field of comprehensive factory control, in particular to an industrial control abnormality detection method for an industrial control system with insufficient samples. Background technique [0002] In recent years, as industrial control systems are widely used in various fields, industrial control anomaly detection algorithms have become particularly important. The anomaly detection algorithm performs machine learning on a large number of sample data, and grasps the characteristics of the data according to the label. [0003] Machine learning requires a large amount of sample data, but for most factories, the incidence of industrial control anomalies is very low, so the amount of samples that can be obtained is also very small, which is far from enough to meet the needs of machine learning. Even chemical plants with a lot of equipment still have a wide operating range, within which the normal operation of DCS can...

AI Technical Summary

Problems solved by technology

The most commonly used transfer learning algorithm is TrAdaBoost and its variants. The data set that has been machine-learned in the algorithm is called the source domain, and the data set to be machine-learned is called the target domain. The TrAdaBoost algorithm requires the above two data sets to have the same structure. However, due to the scarcity of data sources for industrial control anomalies and few optional source domains, it is difficult to make the two data sets have the same structure; even if the TrAdaBoost algorithm can be used, the AUC value of the classifier will be caused by the large difference between the source domain and the target domain. (It can be roughly understood as the accuracy of the classifier) ​​is not high

In addition, the inventor found that when using the TrAdaBoost algorithm for machine learning, the number of iterations is not as large as possible, but there is an optimal value, but limited by the amount of calculation, it is difficult to find this optimal value

Images