Patent ID: 11927949
Assignee: ZHEJIANG UNIVERSITY
Field: Control (Instruments)
Classification: CPC G  H | IPC G

Claim 1:
2. The method for anomaly classification of an ICS communication network according to claim 1, wherein in step 3), a LSTM deep leaning model is designed and trained based on normal traffic training data of the ICS communication network, to obtain the trained LSTM deep leaning model and store it on the industrial server, which comprises:
2.1) obtaining a network structure of the LSTM deep learning model based on memory cells, an input gate, an output gate, and a forget gate, wherein a forward calculation method for the network structure of the LSTM deep learning model is expressed as follows:

gt(l)=ψ(Wgx(l)ht(l−1)+Wgh(l)ht−1(l)+bg(l))

it(l)=δ(Wix(l)ht(l−1)+Wih(l)ht−1(l)+bi(l))

ft(l)=δ(Wfx(l)ht(l−1)+Wfh(l)ht−1(l)+bf(l))

ot(l)=δ(Wox(l)ht(l−1)+Woh(l)ht−1(l)+bo(l))

st(l)=gt(l)⊙it(l)+st−1(l)⊙ft(l)

ht(l)=ψ(st(l))⊙ot(l)

st(l)=gt(l)⊙it(l)st−1(l)⊙ft(l)

ht(l)=ψ(st(l)*l )⊙ot(l)

wherein W is a weight matrix, and b is a weight vector, used to establish connections at an input layer, a memory layer, and an output layer. st(l) represents a state of a memory cell in the t-th step of the l-th layer, and ht(l) is an output state of the memory cell in the t-th step at the l-th layer; δ is an activation function; ψ is a tanh function; ⊙ is the Hadamard product between sets: i, o, and f represent the input gate, the output gate, and the forget gate, respectively; and g represents an input node of the tanh function;
2.2) constructing the LSTM deep learning model based on normal traffic training data of the ICS communication network:

ModelLSTM←fLSTM(X′Ntrai, Nfore, Para□)

wherein fLSTM( ) is an LSTM deep learning model function, which uses a normal traffic training sequence X′Ntrai from the ICS normal communication for model adaptation and training, Para□ represents a structure parameter set of the LSTM deep learning model, Nfore represents a forecast sequence length of the LSTM deep learning model, and Ntrai represents a predefined training sequence length; and
through the short-cycle SARIMA model training, generating the trained LSTM model reflecting normal traffic of the ICS communication network.