CN-121723356-B - Industrial control system abnormality detection method driven by time sequence double-view imaging

CN121723356BCN 121723356 BCN121723356 BCN 121723356BCN-121723356-B

Abstract

The invention discloses a time sequence double-view imaging-driven industrial control system anomaly detection method, which relates to the technical field of industrial automation system state monitoring and comprises the steps of constructing a short-view and long-view 1D sequence for each time point to be detected, converting the time-dependent context view imaging and the time-independent numerical correlation view imaging into a 2D image to form a fine-granularity time point-level double-view image representation, constructing a frame of an anomaly detection model, reconstructing comparison of a target time point of short-view image reconstruction and a same time point of long-view image reconstruction, learning a short-view and long-view mode difference as an anomaly criterion, and aggregating the mode difference in a multivariate level to generate a robust anomaly score. According to the invention, the 1D time sequence is expanded into complementary 2D double-view representation, and the abnormality detection precision is improved while the timeliness and the resource consumption are ensured by combining multi-view learning and time sequence imaging, so that the high-precision and fine-granularity time point level abnormality detection is realized.

Inventors

CHEN LEI
XU YEPENG
He Tingqin
Peng Jiaao
LU MING
ZOU YING

Assignees

湖南科技大学

Dates

Publication Date: 20260512
Application Date: 20260213

Claims (5)

1. The industrial control system abnormality detection method driven by time sequence double-view imaging is characterized by comprising the following steps of: acquiring multi-sensor time sequence data of an industrial control system, and respectively constructing a short view sequence and a long view sequence corresponding to each time point to be detected; Converting the short view sequence and the long view sequence into 2D images through time-dependent context view imaging and time-independent numerical correlation view imaging respectively to form fine-granularity time point-level double-view image characterization; constructing a frame of an anomaly detection model, and enhancing the identifiability of an anomaly mode by feature extraction and sharing of the difference between a short-view mode and a long-view mode based on the cooperation of a short-view double-view image and a long-view double-view image of a target time point; Performing aggregation scoring on a multivariate level based on the learned pattern difference, generating a robust anomaly score of each time point, and realizing anomaly detection of the time point level according to the anomaly score; constructing the short field sequence and the long field sequence to be judged at the current time point To terminate, intercept the succession in the history direction Time points, constitute time points Corresponding short field sequence at time point G times of sampling are performed at fixed intervals L in the history direction as an end point, thereby generating a time point A corresponding long-field sequence; Extracting features in the 2D image by adopting a feature extractor based on a bidirectional large convolution kernel, wherein the feature extractor adopts the large convolution kernel to simulate a feature mode to be learned, and the large convolution kernel is shared in a short-view learning process and a long-view learning process so that the two learning processes learn the same feature mode; The frame of the abnormality detection model consists of three components, namely time point-level double-view time sequence imaging, double-view coupled short-view-long-view contrast learning and multivariate combined abnormality scoring; the time point-level double-view time sequence imaging component maps a 1D short-view and long-view sequence mode corresponding to each time point from two views to a 2D image, namely a time-independent relevance view of a time-independent context view; The dual-view coupled short-view-long-view contrast learning component captures the difference of the short-view-long-view modes at each time point through contrast learning between two branches of reconstruction of a short-view 2D image to a certain time point and reconstruction of a long-view 2D image to the same time point; the multivariate combined anomaly scoring component aggregates the short-field-long-field pattern differences across all variables, generating a final anomaly score for each time point.
2. The method for detecting anomalies in a time-series dual-view imaging-driven industrial control system according to claim 1, wherein the feature extractor based on bidirectional large-kernel convolution performs the following operations: convolving along the horizontal direction of the input two-dimensional image by using a first 1D large convolution kernel to obtain a first direction feature map; convolving along the vertical direction of the input two-dimensional image by using a second 1D large convolution kernel to obtain a second direction characteristic diagram; And fusing the first direction feature image and the second direction feature image to obtain the bidirectional feature representation of the input 2D image.
3. The method for detecting anomalies in a time-series dual-view imaging-driven industrial control system of claim 1, wherein the time-point-level dual-view time-series imaging component covers the local behavior and long-term regularity of each time point, including the following: Complementary double-view construction, namely simultaneously describing characteristic information from two view angles aiming at each time point, wherein the characteristic information comprises a time-dependent context view and a time-independent relevance view, and forming double-view characterization from two complementary paths; Short-field-long-field joint imaging, generating short-field and long-field 2D images for each time point under each view, respectively; bidirectional information is embedded, bidirectional mode information is explicitly embedded in each 2D image, and extractable features contained in the 2D images are enhanced.
4. The method for anomaly detection in a time-series dual-view imaging driven industrial control system of claim 3, wherein the dual-view coupled short-field-long-field contrast learning assembly is comprised of 3 modules, comprising: Reconstructing and learning the short-field 2D image to a single time point, taking the short-field 2D image under a double-view at the time point as input, and reconstructing an observation value at the time point by using a shared 1D large convolution kernel to perform bidirectional convolution; The reconstruction study from the long-view 2D image to a single time point uses the long-view 2D image under the double view of the same time point as input, and the observation value of the time point is reconstructed by utilizing a bidirectional shared large convolution kernel; Short-view-long-view contrast learning, combining and optimizing two learning branches, and introducing a contrast learning process without a negative sample to guide the learning of the whole framework.
5. The method for detecting anomalies in a time series dual view imaging driven industrial control system of claim 4, wherein the training loss of the frame of the anomaly detection model comprises a contrast loss, a short field reconstruction loss and a long field reconstruction loss, wherein the short field reconstruction loss constrains the reconstruction errors of the short field reconstruction values and their corresponding input images, and wherein the long field reconstruction loss constrains the reconstruction errors of the long field reconstruction values and their corresponding input images.

Description

Industrial control system abnormality detection method driven by time sequence double-view imaging Technical Field The invention relates to the technical field of industrial automation system state monitoring, in particular to a time sequence double-view imaging driven industrial control system abnormality detection method. Background Industrial control systems typically employ a variety of sensors, actuators, and controllers to continuously monitor and control the underlying industrial equipment. However, industrial control systems operate in harsh and dynamically changing environments such as high humidity, corrosion, electromagnetic interference, mechanical vibration, dust, and the like, often cause frequent anomalies in the underlying equipment or sensor signals, manifested as periodic fluctuations, data drift, or sudden deviations from normal operation. These unusual lights lead to instability of the industrial control system, while heavy ones cause equipment failure, production stoppage, and huge economic losses and casualties. Thus, anomaly detection is critical to the safety and stability of industrial control systems. It is unlikely that a mathematical model of anomaly detection will be directly constructed, subject to the high degree of nonlinearity and strong coupling of the industrial control system itself. Therefore, a data-driven method, particularly an unsupervised deep learning method independent of external tags, has become a core approach for constructing an industrial control system anomaly detection model. Moreover, conventional coarse-grained anomaly detection (anomaly detection of entire sequences or fragments) has been difficult to meet the need for fine-grained monitoring. The existing unsupervised time-point level fine-grained time-series anomaly detection model generally performs anomaly detection directly on the original 1D time-series signal. However, the varied production environments and complex control instructions result in the inclusion of a variety of complex patterns of features in the industrial control system, such as long and short periods, seasonality, trends, context evolution, multi-variable coupling, and the like. When these complex feature patterns are compressed in a time series of 1D, a plurality of normal patterns are interleaved with each other, making the feature patterns difficult to extract, and the degree of discrimination of information is not high. In addition, these interleaved normal feature patterns exhibit frequent numerical fluctuations in the 1D sequence that exhibit similarity to the data fluctuations exhibited by noise/abnormal behavior, resulting in abnormal behavior that is easily confused with complex normal patterns, increasing false detection and false omission risk. Therefore, the existing industrial control system-oriented time series anomaly detection model faces a common challenge that in a 1D time series with low information discrimination, anomaly patterns are difficult to accurately identify or separate from complex normal behaviors. Existing solutions are mainly deployed along two technical routes: (1) The first route is a scheme based on multi-view learning. The method is represented by multi-period modeling, time-frequency joint modeling and the like, takes an original 1D time sequence as input, regards various hidden characteristic modes in the sequence as different views, and designs an independent learning path aiming at each view, so that the abnormality is identified under the single characteristic mode, and the difficulty of abnormality identification is reduced. However, the detection performance of such methods depends to a large extent on the quality of view construction and the stability of the multi-view fusion mechanism, often exhibiting instability in complex industrial scenarios. (2) The second route is a scheme based on time series imaging. The method is characterized in that the 1D time sequence is mapped into the 2D image representation, and the information discrimination is enhanced through feature dimension expansion, so that the discrimination of the abnormal mode is improved. For example IMAGENTIME maps the 1D sequence to 2D image space and performs a time series generation task in conjunction with a diffusion model to generate a higher quality synthetic sequence, imageAE and TimeMixer ++ convert the 1D data to 2D space by means of time series imaging and perform time series prediction using a custom depth neural network, IMTS further performs time series classification of the time series imaging in combination with GAN and bi-directional RNN. TimesNet further map the 1D time series to a 2D periodic representation from a multi-periodic perspective, thereby improving the accuracy of isochronous tasks such as anomaly detection and prediction. Similarly, TIAN combines time series imaging with generation of countermeasure learning to build deep association networks to support anomaly detection in human activity reco