CN111709437A - Petrochemical industry field process behavior oriented abnormal behavior detection method - Google Patents

Petrochemical industry field process behavior oriented abnormal behavior detection method Download PDF

Info

Publication number
CN111709437A
CN111709437A CN201911050917.1A CN201911050917A CN111709437A CN 111709437 A CN111709437 A CN 111709437A CN 201911050917 A CN201911050917 A CN 201911050917A CN 111709437 A CN111709437 A CN 111709437A
Authority
CN
China
Prior art keywords
data
dis
center
clustering
distance
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201911050917.1A
Other languages
Chinese (zh)
Other versions
CN111709437B (en
Inventor
尚文利
尹隆
陈德童
赵剑明
佟国毓
陈春雨
张野
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenyang Institute of Automation of CAS
Original Assignee
Shenyang Institute of Automation of CAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenyang Institute of Automation of CAS filed Critical Shenyang Institute of Automation of CAS
Priority to CN201911050917.1A priority Critical patent/CN111709437B/en
Publication of CN111709437A publication Critical patent/CN111709437A/en
Application granted granted Critical
Publication of CN111709437B publication Critical patent/CN111709437B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G06F18/232—Non-hierarchical techniques
    • G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
    • G06F18/23213—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Landscapes

  • Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Evolutionary Computation (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Testing Or Calibration Of Command Recording Devices (AREA)

Abstract

The invention relates to a petrochemical field-oriented process behavior abnormal behavior detection method, in particular to a detection method based on a behavior characteristic knowledge base for petrochemical field abnormal behavior detection.

Description

Petrochemical industry field process behavior oriented abnormal behavior detection method
Technical Field
The invention relates to an abnormal behavior detection method for petrochemical industry field process behaviors, which is constructed based on an industrial field behavior feature knowledge base to improve the relevance between an industrial control safety detection technology and the industrial field behaviors, so that an abnormal behavior detection alarm represents the characteristics of the industrial field behaviors, and belongs to the field of industrial control network information safety.
Background
The research result of the invention breaks through the limitation of the blank of the construction technology of the industrial field behavior characteristic knowledge base at home and abroad at present, improves the relevance between the industrial control safety detection technology and the industrial field behavior, enables an abnormal detection alarm to represent the characteristics of the industrial field behavior, and simultaneously has certain help for reducing the 'missing report rate' and the 'false report rate' of abnormal detection. The traditional method usually needs to deeply understand and know the internal operation rules of a research object, the internal operation structures of most systems are complex, and the internal rules are difficult to be completely summarized from the mechanism, so that the detection accuracy is low.
The invention mainly aims at the detection of abnormal behaviors in the petrochemical industry field to develop the detection method research based on the behavior characteristic knowledge base, the project researches a business operation process behavior baseline by combining with the actual factory production environment, establishes a production control behavior model by principal component description and expert knowledge, summarizes and abstracts the business behavior of the industrial field, establishes the incidence relation between the operation process behavior baseline and the attack behavior, realizes the construction of the behavior characteristic knowledge base facing the industrial field, and realizes the automatic learning and updating mechanism of the behavior base by the research of an online self-learning optimization mechanism. On the basis, an efficient industrial field covert abnormal behavior detection alarm mechanism is realized by research based on a process behavior feature extraction algorithm and combination of an established behavior feature knowledge base
Disclosure of Invention
Aiming at the technical defects, the invention aims to provide an abnormal behavior detection method for the field process behavior of the petrochemical industry. The invention provides an industrial control system situation understanding algorithm based on unsupervised learning by combining the concept of situation perception, models the normal working condition of the system by combining the on-site real-time data of a rectifying tower through unsupervised learning algorithms such as an autoencoder and K-means, obtains the deviation degree of the system state and the normal working condition at each moment by taking the model as a reference to serve as a safety situation element, performs fusion calculation on the safety situation element in the time dimension to obtain the current situation of the system, and provides a data base for the subsequent situation prediction stage.
The technical scheme adopted by the invention for realizing the purpose is as follows:
an abnormal behavior detection method for the field process behavior of the petrochemical industry comprises the following steps:
1) preprocessing historical process data;
2) performing K-means clustering on the preprocessed data to obtain a clustering center and a data set of a corresponding category;
3) calculating the distance from each data point in each category of data set to its corresponding cluster center, and taking out the maximum value dismaxjObtaining a maximum value set Dis of the distance from the data point corresponding to the maximum value to the clustering center;
4) preprocessing the real-time detected process data, obtaining the distance between the preprocessed data and each clustering center, obtaining a distance set Dis _ t from the preprocessed data to the clustering center, calculating the difference between Dis _ t and Dis, and obtaining d ═ d { d }j＝(dis_tj-dismaxj) 1,2, 3.. k }; k denotes the number of classes, dis _ tjRepresenting the distance of the data point itself from the center of each cluster, djDenotes dis _ tjTo dismaxjD represents djCollecting;
5) if it is not
Figure BDA0002255312640000031
Recording the degree of the system state deviating from the normal working condition of the system at the moment as min (d), otherwise recording the degree as 0, and taking the state as a situation element;
6) fusing in time dimension with a sliding window of length L to obtain a mean value in the time intervalavgSum variancesFinally, get the binary system S ═ of the characteristic system situation (S ═ c: (avg，s)。
The preprocessing is to perform self-encoder data dimension reduction on the process data and filter out redundant information.
The K-means clustering algorithm comprises the following steps:
1) determining the value of the category number k, wherein k is 5 in the patent;
2) randomly selecting k data points from an input data set D to form an initial clustering center set C;
3) sequentially calculating the Euclidean distance between each data point in the data set D and each cluster center in the set C, and allocating the data point to the cluster center with the minimum distance; assigning a cluster center to all data points;
4) updating the clustering center, and calculating the centers of all data points distributed to the clustering center to obtain a new clustering center;
5) calculating an update iteration minimization cost of a cluster center
Figure BDA0002255312640000032
Wherein c isjAs a cluster center point, xiAs data points, argminjIs a variable value representing the time when the objective function is minimized;
6) repeating steps 3), 4) and 5) until the data converges to a minimum.
And 6), the mean value is used for reflecting the degree of the system deviating from the normal working condition in the current time period, and the variance is used for reflecting the stability of the system state.
The invention has the following beneficial effects and advantages:
1. aiming at the problem that data of an industrial control system field control layer is not labeled, an industrial control system situation understanding algorithm based on unsupervised learning is provided. The method comprises the steps of modeling the normal working condition of the system by using an auto-encoder, K-means and other unsupervised learning algorithms, calculating the degree of deviation of the system state from the normal state at each moment by using data detected at each moment in real time to serve as a system situation element, correctly representing and quantifying the safety situation of the system, providing reliable decision information for system managers, and providing effective data input for subsequent situation prediction research.
2. The modeling of key equipment of a petrochemical control system through big data can more clearly understand the running state of the key equipment, simultaneously improve the running, maintenance and optimization levels of the equipment, obviously improve the labor efficiency, automation, informatization and intellectualization levels of the chemical industry, and realize unmanned or less-man operation in partial process stages.
Drawings
FIG. 1 is a schematic diagram of the present invention employing a self-encoder to compress petrochemical process data;
FIG. 2 is a schematic diagram of a process of calculating a data clustering center by using a K-means clustering algorithm in the present invention;
FIG. 3 is a schematic diagram of an algorithm flow for understanding the safety situation of the industrial control system in the petrochemical industry.
Detailed Description
1. The method can determine the dimensionality after data transformation by setting the number of neurons of a hidden layer, thereby ensuring that the data is recovered with minimum loss when the data needs to be restored.
2. Classifying the compressed process data according to the similarity between the data by using a K-means-based clustering method, setting the number of initial clustering centers by depending on a specific application scene and an input object type format, and finishing data clustering classification after performing multiple rounds of iteration. The algorithm comprises the following steps:
2a) determining a value of the number k of clustering centers;
2b) randomly selecting k data points from an input data set D to form an initial clustering center set C ═ { X _ j ^ n | j ^ 1,2,3 … k };
2c) sequentially calculating the Euclidean distance between each data point in the data set D and each cluster center in the set C, and allocating the data point to the cluster center with the minimum distance; this step assigns a cluster center to all data points;
2d) updating the clustering center, and calculating the centers of all data points distributed to the clustering center, such as the arithmetic mean, to obtain the new clustering center;
2e) calculating an update iteration minimization cost of a cluster center
Figure BDA0002255312640000051
Wherein c isjAs a cluster center point, xiAre data points;
2f) repeat 2c, 2d, and 2e until the data reaches Loss (minimize convergence).
The K-means algorithm is very sensitive to an initial clustering center set and a K value, the data points really belonging to the same class need to be gathered together, the gathering is greatly dependent on the selection of the initial clustering center and the size of the K value, the prevention of the local convergence of the K-means needs to be considered, the algorithm is operated by adopting multiple random extraction of the clustering center and the K value, and finally the best result is selected.
3. K clustering centers and corresponding K types of data sets corresponding to K normal working conditions are obtained through K-means clustering. Calculating the distance from each data point in each category of data set to the corresponding cluster center, taking out the maximum value, and recording dismaxObtaining set Dis ═ Dismaxj|j＝1，2，3...k}。
4. Performing the same dimensionality reduction processing on each piece of real-time detected data, and calculating the distance between the data and each cluster center to obtain Dis _ t ═ Dis _ tjJ equals 1,2, 3.. k }, and d equals Dis _ t-Dis is calculated to obtain d equals { dj＝(dis_tj-dismaxj) 1,2, 3.. k }; if it is not
Figure BDA0002255312640000052
And (d) recording the degree of the system state deviating from the normal working condition of the system at the moment as min (d), otherwise recording the degree as 0, and here, recording the situation element to be extracted.
5. Fusing in time dimension with sliding window of length L, and counting to obtain average value in the time intervalavgSum variances(ii) a The mean value reflects the degree of the system deviating from the normal working condition in the current time period, the variance reflects the stability of the system state, and finally the binary group S ═(S) representing the system situation is obtainedavg，s)。
6. Taking the calculated degree of the deviation of the current state of the representation system from the normal working condition as a safety situation element, segmenting according to the specified number of time units, and calculating the mean value in the time period according to fusionavgSum variancesPlotting a time-varying situation curve if at a certain moment the doublet (avg，s) Every item in the above-mentioned list reaches the highest point, and said list shows that the current system is in dangerous state, and must produce alarm, on the contrary, if all items are small in a certain time period, said current system is relatively safe
The present invention will be described in further detail with reference to the accompanying drawings and examples.
1. Self-encoder data dimension reduction
Taking the process of processing the process data of the rectifying tower in the petrochemical industry as an example, firstly, the process data of the rectifying tower has the characteristic of high dimensionality and is not suitable for direct data analysis, and the self-encoder has better nonlinear generalization and can represent linear transformation and nonlinear transformation. Therefore, the self-encoder is adopted to reduce the dimension of the data. An auto-encoder (AE) is a neural network, also an unsupervised learning algorithm, which can encode itself using its high-order features. The self-encoder can compress process data with pressure, flow and the like of different nodes, the original n-dimension is compressed into the m-dimension, and then the data is recovered with minimum loss when the data needs to be restored. The stacked self-coding neural network is a nonlinear method of the neural network in data feature extraction. The output state x' of the self-coding neural network is ignored, the hidden layer h is used as original information, a new self-coder is trained, parameters of the middle hidden layer only completely memorize the input, the memorized content is completely output when the parameters are output, and the neural network performs identity mapping to generate data overfitting. Therefore, through layer-by-layer stacking, the characteristic dimension of the data is reduced, and the key information of the data can be reserved.
The data dimensionality reduction processing process is shown in fig. 1, the hidden layer is a parameter matrix of the hidden layer, and the probability corresponding to the x-dimensional vector is finally obtained through layer-by-layer iteration. The whole process of the self-encoder can be represented by the following formula: h isW，b(x) X' ≈ x. If h represents the whole encoding and decoding process, W and b are parameters needing to be trained through data, the output of the hidden layer is the result of dimension reduction of the data through the self-encoder, and then the output of the hidden layer is reconstructed, so that the output x' of the whole self-encoder is maximally close to the input x.
K-means data clustering
The data dimension after the data dimension reduction treatment is reduced, and the original process data behavior characteristics are kept to the greatest extent. But since the correlation between data is difficult to obtain by direct observation, the data needs to be pre-classified. As the petrochemical industry rectifying tower process data have no class labels, the data cannot be processed by adopting a label-based supervised learning classification algorithm. The K-means algorithm is a classic algorithm for solving the unsupervised learning clustering problem, is simple and fast, and is relatively scalable and efficient especially when facing processing large data sets.
The core idea of clustering algorithms is to classify data based on their similarity, so different clustering algorithms have different similarity definitions. Although there are many clustering algorithms, the 'best' clustering algorithm depends on the specific application scenario and the type format of the input object, etc.
The K-means algorithm is a relatively simple iterative clustering algorithm in a clustering algorithm, is simple to implement, is high in speed, is convenient to understand and modify, and is the most widely used clustering algorithm in reality. These cluster centers may be represented by one set, C ═ Xj nj＝1，2，3…k}。
The algorithm comprises the following steps:
2a) determining a k value;
2b) randomly selecting k data points from an input data set D to form an initial clustering center set C;
2c) sequentially calculating the Euclidean distance between each data point in the data set D and each cluster center in the set C, and allocating the data point to the cluster center with the minimum distance; this step assigns a cluster center to all data points;
2d) updating the clustering center, and calculating the centers of all data points distributed to the clustering center, such as the arithmetic mean, to obtain the new clustering center;
2e) calculating an update iteration minimization cost of a cluster center
Figure BDA0002255312640000081
Wherein c isjAs a cluster center point, xiAs data points, argminjTo express an objective function (i.e. to
Figure BDA0002255312640000082
) Taking the variable value at the minimum value;
2f) repeat 2c, 2d, and 2e until the data reaches Loss (minimize convergence).
The flow chart for classifying the process data of the rectifying tower by adopting the K-means clustering algorithm is shown in figure 2.
The K-means algorithm is very sensitive to an initial clustering center set and a K value, the data points really belonging to the same class need to be gathered together, the gathering is greatly dependent on the selection of the initial clustering center and the size of the K value, the prevention of the local convergence of the K-means needs to be considered, the algorithm is operated by adopting multiple random extraction of the clustering center and the K value, and finally the best result is selected.
3. Petrochemical distillation tower process field data abnormal behavior detection modeling
The method comprises the following specific steps:
3a) taking out data collected by a field control layer in the normal operation period of the system from a historical database;
3b) compressing and dimensionality reducing data by using a self-encoder to obtain data with filtered redundant information and main information reserved;
3c) performing K-means clustering on the data after 2b transformation to obtain K clustering centers and corresponding K types of data sets corresponding to K normal operating conditions;
3d) calculating the distance from each data point in each category of data set to the corresponding cluster center, taking out the maximum value, and recording dismaxObtaining set Dis ═ diSmaxj|j＝1，2，3...k}；
3e) Performing the same dimensionality reduction processing on each piece of real-time detected data, and calculating the distance between the data and each cluster center to obtain Dis _ t ═ Dis _ tjJ equals 1,2, 3.. k }, and d equals Dis _ t-Dis is calculated to obtain d equals { dj＝(dis_tj-dismaxj)|j＝1，2，3...k}；
3f) If it is not
Figure BDA0002255312640000091
And recording the degree of the deviation of the system state from the normal working condition of the system at the moment as min (d), otherwise recording the deviation as 0, wherein the situation element is extracted from the text.
Fusing in time dimension with sliding window of length L, and counting to obtain average value in the time intervalavgSum variances(ii) a The mean value reflects the degree of deviation of the system from the normal working condition in the current time period of the petrochemical rectifying tower system, and the variance reflects the petrochemical rectifying tower systemThe stability of the state finally obtains the binary system S ═ S (and:) representing the system situationavg，s)。
The situation understanding algorithm flow of the industrial control system is shown in FIG. 3.
The data set has 52 dimensions, belongs to high-dimensional data, has the phenomenon of information redundancy among a plurality of dimensions, and is not beneficial to subsequent clustering analysis, so constant dimension deletion is firstly carried out on the data, numerical normalization processing is carried out on the data, then a self-encoder is used for carrying out data dimension reduction, and the transformed data is selected to be 42 dimensions on the premise of ensuring minimum loss. And when the K-means algorithm clustering is carried out, the value of the clustering number K is continuously adjusted, and when K is 5, the clustering effect is best. In the operation of the actual industrial control system, the number of almost normal working conditions has a determined value, so the value of k can be determined according to the knowledge of different systems and related professionals, and the best clustering effect is achieved.
According to the algorithm provided by the invention, the data of the abnormal working conditions are successfully detected, the degree of deviation of the states from the normal working conditions is calculated as a safety situation element, 20 time units are taken as a time period, and the mean value and the variance in the time period are calculated in a fusion manner. During periods when the system is in a safe state, such as periods 125, 50, etc., S ═ S (avg，s) (0, 0) indicating that the system is in a safe situation during the time period, and some time periods, such as time period 81, during which the system calculates S ═ S (S ═ S { (S) } Savg，s) At (0.66, 0.0038), each term in the doublet is peaked, so the system is in a dangerous situation at this time. Generally, when the values of the two terms are both small in a certain period of time, the system is in a safe state, and when the values of the two terms are both large, the system is in a dangerous state.

Claims (4)

1. An abnormal behavior detection method for the field process behavior of the petrochemical industry is characterized by comprising the following steps:
1) preprocessing historical process data;
2) performing K-means clustering on the preprocessed data to obtain a clustering center and a data set of a corresponding category;
3) calculating the distance from each data point in each category of data set to its corresponding cluster center, and taking out the maximum value dismaxjObtaining a maximum value set Dis of the distance from the data point corresponding to the maximum value to the clustering center;
4) preprocessing the real-time detected process data, obtaining the distance between the preprocessed data and each clustering center, obtaining a distance set Dis _ t from the preprocessed data to the clustering center, calculating the difference between Dis _ t and Dis, and obtaining d ═ d { d }j＝(dis_tj-dismaxj) 1,2,3 … k }; k denotes the number of classes, dis _ tjRepresenting the distance of the data point itself from the center of each cluster, djDenotes dis _ tjTo dismaxjD represents djCollecting;
5) if it is not
Figure FDA0002255312630000011
Recording the degree of the system state deviating from the normal working condition of the system at the moment as min (d), otherwise recording the degree as 0, and taking the state as a situation element;
6) fusing in time dimension with a sliding window of length L to obtain a mean value in the time intervalavgSum variancesFinally, obtaining the binary system S representing the system situationavg,s)。
2. The petrochemical industry field process behavior-oriented abnormal behavior detection method as claimed in claim 1, wherein the preprocessing comprises performing self-encoder data dimension reduction on the process data and filtering out redundant information.
3. The petrochemical industry field process behavior-oriented abnormal behavior detection method as claimed in claim 1, wherein the K-means clustering algorithm comprises the following steps:
1) determining the value of the category number k, wherein k is 5 in the patent;
2) randomly selecting k data points from an input data set D to form an initial clustering center set C;
3) sequentially calculating the Euclidean distance between each data point in the data set D and each cluster center in the set C, and allocating the data point to the cluster center with the minimum distance; assigning a cluster center to all data points;
4) updating the clustering center, and calculating the centers of all data points distributed to the clustering center to obtain a new clustering center;
5) calculating an update iteration minimization cost of a cluster center
Figure FDA0002255312630000021
Wherein c isjAs a cluster center point, xiAs data points, argminjIs a variable value representing the time when the objective function is minimized;
6) repeating steps 3), 4) and 5) until the data converges to a minimum.
4. The petrochemical industry field process behavior-oriented abnormal behavior detection method as claimed in claim 1, wherein the mean value in step 6) is used for reflecting the degree of deviation of the system from a normal working condition in the current period, and the variance is used for reflecting the stability of the system state.
CN201911050917.1A 2019-10-31 2019-10-31 Abnormal behavior detection method oriented to field process behavior of petrochemical industry Active CN111709437B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201911050917.1A CN111709437B (en) 2019-10-31 2019-10-31 Abnormal behavior detection method oriented to field process behavior of petrochemical industry

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201911050917.1A CN111709437B (en) 2019-10-31 2019-10-31 Abnormal behavior detection method oriented to field process behavior of petrochemical industry

Publications (2)

Publication Number Publication Date
CN111709437A true CN111709437A (en) 2020-09-25
CN111709437B CN111709437B (en) 2023-08-04

Family

ID=72536328

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201911050917.1A Active CN111709437B (en) 2019-10-31 2019-10-31 Abnormal behavior detection method oriented to field process behavior of petrochemical industry

Country Status (1)

Country Link
CN (1) CN111709437B (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113824682A (en) * 2021-08-12 2021-12-21 浙江木链物联网科技有限公司 Modular SCADA security situation perception system architecture
CN114626426A (en) * 2020-12-11 2022-06-14 中国科学院沈阳自动化研究所 Industrial equipment behavior detection method based on K-means optimization algorithm

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109086805A (en) * 2018-07-12 2018-12-25 华南理工大学 A kind of clustering method constrained based on deep neural network and in pairs
CN109631997A (en) * 2018-12-20 2019-04-16 树根互联技术有限公司 Engineering equipment health detecting method, device and electronic equipment

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109086805A (en) * 2018-07-12 2018-12-25 华南理工大学 A kind of clustering method constrained based on deep neural network and in pairs
CN109631997A (en) * 2018-12-20 2019-04-16 树根互联技术有限公司 Engineering equipment health detecting method, device and electronic equipment

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
严英杰等: "基于滑动窗口和聚类算法的变压器状态异常检测" *
武丽芬等: "高维大数据流连续异常点检测方法仿真" *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114626426A (en) * 2020-12-11 2022-06-14 中国科学院沈阳自动化研究所 Industrial equipment behavior detection method based on K-means optimization algorithm
CN113824682A (en) * 2021-08-12 2021-12-21 浙江木链物联网科技有限公司 Modular SCADA security situation perception system architecture
CN113824682B (en) * 2021-08-12 2024-05-31 浙江木链物联网科技有限公司 Modularized SCADA security situation sensing system architecture

Also Published As

Publication number Publication date
CN111709437B (en) 2023-08-04

Similar Documents

Publication Publication Date Title
CN111708343B (en) Method for detecting abnormal behavior of field process behavior in manufacturing industry
CN109829236B (en) XGboost feature extraction-based compressor fault diagnosis method
CN110084151B (en) Video abnormal behavior discrimination method based on non-local network deep learning
Prajwala A comparative study on decision tree and random forest using R tool
CN105550426B (en) A kind of multiple dimensioned binary tree blast furnace method for diagnosing faults based on sample decomposition
CN113242207B (en) Iterative clustering network flow abnormity detection method
US20220012422A1 (en) Lexical analyzer for a neuro-linguistic behavior recognition system
CN114816909A (en) Real-time log detection early warning method and system based on machine learning
CN111259985A (en) Classification model training method and device based on business safety and storage medium
CN112231306B (en) Big data based energy data analysis system and method
CN111709437B (en) Abnormal behavior detection method oriented to field process behavior of petrochemical industry
CN110851422A (en) Data anomaly monitoring model construction method based on machine learning
CN112367303B (en) Distributed self-learning abnormal flow collaborative detection method and system
CN110708318A (en) Network abnormal flow prediction method based on improved radial basis function neural network algorithm
CN114553475A (en) Network attack detection method based on network flow attribute directed topology
CN111861756A (en) Group partner detection method based on financial transaction network and implementation device thereof
CN116929815A (en) Equipment working state monitoring system and method based on Internet of things
Cuentas et al. An SVM-GA based monitoring system for pattern recognition of autocorrelated processes
CN114615010B (en) Edge server-side intrusion prevention system design method based on deep learning
Liao et al. Traffic anomaly detection model using k-means and active learning method
Inacio et al. Fault diagnosis with evolving fuzzy classifier based on clustering algorithm and drift detection
CN116996355B (en) Industrial control network asset discovery method based on neural network
KR102366787B1 (en) Real-time sliding window based anomaly detection system for multivariate data generated by manufacturing equipment
Othman et al. Abnormal patterns detection in control charts using classification techniques
CN109635008B (en) Equipment fault detection method based on machine learning

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant