Patent ID: 11927949
Assignee: ZHEJIANG UNIVERSITY
Field: Control (Instruments)
Classification: CPC G  H | IPC G

Claim 3:
4. The method for anomaly classification for an industrial control system (ICS) communication network based on statistical learning and deep learning according to claim 3, wherein step 3) comprises:
setting a sequence Tnanom={t1anom,t2anom, . . . , tnanom, n∈} of actual occurrence time of ICS anomalies, wherein n is the total number of anomalies, to obtain a sequence of sample sizes corresponding to short-cycle sequence numbers upon anomalies, Snanom={s1anom,s2anom, . . . , snanom, n∈}, is:

Snanom=(Tnanom−tdebug)/γsamp

wherein tdebug is real-time debugging time before step 3), and γsamp is a sampling frequency of ICS traffic;
calculating the number inanom of short-cycle iterations (element of Inanom) upon ICS anomaly events:, {
  
   
    
     
      
       K
       n
      
      =
      
       
        (
        
         
          S
          n
          anom
         
         -
         
          T
          trai
         
        
        )
       
       ⁢
       
        mod
        ⁡
        (
        
         T
         fore
        
        )
       
      
     
    
   
   
    
     
      
       I
       n
       anom
      
      =
      
       
        
         (
         
          
           S
           n
           anom
          
          -
          
           T
           trai
          
          -
          
           K
           n
          
         
         )
        
        /
        
         (
         
          T
          fore
         
         )
        
       
       +
       1
      
     
    
   
   
    
     
      
       I
       n
       anom
      
      =
      
       {
       
        
         i
         1
         anom
        
        ,
        
         i
         2
         anom
        
        ,
        …
            
        ,
        
         i
         n
         anom
        
        ,
        
         n
         ∈
         ℕ
        
       
       }
      
     
    
   
  
 

wherein Kn is an intermediate variable;
calculating a variance {circumflex over (σ)}k of the online traffic threshold interval generated in the online detection process in step 3):, σ
    ^
   
   k
  
  =
  
   
    
     ∑
     
      i
      =
      1
     
     
      T
      fore
     
    
    
     
      
       (
       
        
         U
         i
         
          (
          
           i
           k
           anom
          
          )
         
        
        -
        
         L
         i
         
          (
          
           i
           k
           anom
          
          )
         
        
       
       )
      
      2
     
     /
     
      T
      fore
     
    
   
  
 

wherein k=1,2, . . . , n∈, and {circumflex over (σ)}k measures an overall deviation of a threshold of the ikanom -th short-cycle iteration;
predicting and analyzing normal traffic data of the ICS communication network based on the trained LSTM deep learning model:

{tilde over (X)}′Nfore,n=ModelLSTM(XTtrai(Inanom), Nfore)

wherein ModelLSTM( ) is the trained LSTM deep learning model obtained from offline training in step 2), {tilde over (X)}′Nfore,n is a forecasted traffic sequence from the trained LSTM deep learning model, XTtrai(Ikanom) is input of the trained LSTM deep learning model, and Nfore is a forecast traffic sequence length;
obtaining an online SARIMA model training set XTtrai(Inanom) in a current short cycle through a sequence (Inanom={i1anom,i2anom, . . . , inanom, n∈}) of short cycles of the online SARIMA model upon anomaly events, wherein the SARIMA training set for each short training cycle is

XTtrai(ikanom), k=1,2, . . . , n, n∈,, and n is the total number of anomaly events;
obtaining an LSTM online forecast sequence {tilde over (X)}′Nfore,n of n output ICS network traffic anomaly events based on the online SARIMA model training set XTtrai(Inanom) in the current short cycle, wherein a length of a sequence corresponding to an anomaly event is Nfore;
based on a time correspondence between the ikanom (k=1,2, . . . , n n∈)-th short cycle in which an anomaly event occurs and the online SARIMA model training set XTtrai(Inanom), classifying the ICS communication network anomaly events by using the trained LSTM deep learning model as posteriori knowledge; wherein
the variance {tilde over (σ)}k of the forecasted traffic sequence of the trained LSTM deep learning model comprises:, σ
    ~
   
   k
  
  =
  
   
    
     ∑
     
      j
      =
      1
     
     
      N
      fore
     
    
    
     
      
       (
       
        
         
          x
          ~
         
         
          j
          ,
          k
         
         ′
        
        -
        
         
          1
          
           N
           fore
          
         
         ⁢
         
          
           ∑
           
            i
            =
            1
           
           
            N
            fore
           
          
          
           
            x
            ~
           
           
            i
            ,
            k
           
           ′
          
         
        
       
       )
      
      2
     
     /
     
      N
      fore
     
    
   
  
 

wherein k=1,2, . . . , n n∈, and {tilde over (σ)}k reflects fluctuation and deviation of online forecasted traffic sequence by the trained LSTM model at the k-th anomaly event, and is used as a key parameter for analyzing the background traffic of the ICS communication network.