# Anomaly Detection Collaborating Adaptive CEEMDAN Feature Exploitation with Intelligent Optimizing Classification for IIoT Sparse Data

Authors: Jianming Zhao; Peng Zeng; Ming Wan; Xinlu Xu; Jinfang Li; Qimei Jiang
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

IIoT (Industrial Internet of Things) has gained considerable attention and has been increasingly applied due to its ubiquitous sensing and communication. However, the sparse characteristic of sensing data in distributed IIoT networks may bring out tremendous challenges to implement the security protection measures. Based on the design of centralized data gathering and forwarding, this paper proposes a novel anomaly detection approach for IIoT sparse data, which can successfully collaborate the adaptive CEEMDAN (Complete Ensemble Empirical Mode Decomposition with Adaptive Noise) feature exploitation with one intelligent optimizing classification. Furthermore, in the adaptive CEEMDAN feature exploitation, the CEEMDAN energy entropy based on adaptive IMF (Intrinsic Mode Function) selection is designed to extract the sensing features from IIoT sparse data; in the intelligent optimizing classification, one effective OCSVM (One-Class Support Vector Machine) classifier optimized by the IABC (Improved Artificial Bee Colony) swarm intelligence algorithm is introduced to detect various abnormal sensing features. The experimental results show that, not only does the CEEMDAN energy entropy based on adaptive IMF selection accurately describe the change of industrial production by analyzing the probability distribution and energy distribution of sparse sensing data, but also the proposed IABC-OCSVM classifier has higher detection efficiency compared with the OCSVM classifiers optimized by other swarm intelligence algorithms.


---

## Body

## 1. Introduction

IIoT (Industrial Internet of Things), which can effectively implement real-time simulation and remote control during the whole production or manufacturing cycle, has been regarded as an important driving force in the industrial intelligent revolution [1]. Furthermore, IIoT can successfully establish one seamless connection between OT (Operational Technology) and IT (Information Technology), and the application of various IIoT devices (such as sensors, collectors, or controllers) can cover most aspects of industrial production by using some advanced technologies [2, 3], including sensing technology, wireless interconnection and communication technology, and intelligent analysis technology. Under the integration of distributed monitoring and centralized management, IIoT can accomplish the data processing of various industrial activities in a more efficient way. Consequently, it can not only improve the production quality and efficiency enormously, but it can also reduce the product cost and resource consumption significantly.Actually, the original definition of IIoT is characterized by the high interconnectivity and large-scale distributed network, and various IIoT devices can be directly or indirectly exposed to the public Internet. However, information security problems in no matter what type of cyberphysical systems or social networks emerge rapidly and extensively, and the corresponding security incidents also occur repeatedly [4, 5]. As a consequence, IIoT is facing more and more severe challenges of information security [6–9], and it may suffer from greater risks than traditional IoT. In particular, one integrated IIoT system always consists of thousands of sensor nodes, which ensure interconnection and interoperability by using some specific wireless communication protocols. Once one or several sensor nodes have been maliciously infiltrated and controlled by some sophisticated adversaries, the corresponding disruptive activities may spread at a rapid rate due to the through-hull connection of all sensor nodes and have tremendous implications on the whole system [10]. According to the basic flow and interaction of sensing data, IIoT network architecture can be briefly divided into three layers: data acquisition layer, data transmission layer, and data processing layer, and each layer can experience various degrees of security threats due to distinct technology solutions. For instance, in the data acquisition layer, some intrinsic system flaws of IIoT devices may be considered as the most direct invasion targets to inject malicious codes [11]; in the data transmission layer, the public wireless communication protocols and distributed network structure may become some of the weak points, which can be stealthily exploited to perform data-stealing or data-tampering attacks, such as Sybil attacks or arbitrage attacks [12, 13]; in the data processing layer, various local or remote servers are always exposed to the public network without some extra protection measures, and these servers can be potentially targeted by malicious adversaries who can easily excavate more attack entries and paths [14, 15].In order to guarantee the stability and reliability of IIoT systems, both academia and industry have carried out many theoretical researches and practical applications on IIoT security protection measures: for the data privacy challenge, the work in [16] discusses and summarizes the main issues in the traditional IIoT architecture and designs the detailed data interaction process based on the blockchain architecture to enhance security and privacy in smart factories; for the data authenticity challenge, the work in [17] proposes a robust certificateless signature scheme for data crowdsensing in the cloud-assisted IIoT, which can be proven to effectively deal with four types of signature forgery attacks; for the data confidentiality challenge, the work in [18] presents a secure industrial data access control scheme for cloud-assisted IIoT, and it uses the ciphertext policy-attribute-based encryption scheme to provide fine-grained data protection; for the malicious data transmission challenge, the work in [12] introduces a secured and intelligent communication scheme for PES (Pervasive Edge Computing) in an IIoT-enabled infrastructure, and it proposes a lightweight Sybil attack detection protocol to protect low-powered IIoT devices; for the data congestion challenge, by using an average consensus-based algorithm, the work in [19] puts forward an optimal scheduling framework to resist a DoS attack for IIoT-based smart microgrids. In the above protection measures, some additional security functions or schemes are designed to improve the security of original IIoT systems. Although they can reflect an enhanced level of security capability due to the fine theoretical and experimental analysis, their applicability and feasibility in real-world IIoT systems await verification by future explorations. The main causes involve the following two aspects: on the one hand, most IIoT devices only have low power and limited system resources, and the security add-ons may decrease their work performance by performing the higher or lower computational costs of security operations [20]; on the other hand, IIoT is usually designed to serve industrial control systems, whose requirements on high availability and reliability may be not completely satisfied because of the inefficient adaption between the original system design and some added security services. Differently, anomaly detection in IIoT systems can be widely regarded as a feasible and effective measure to identify unexpected industrial activities [8, 21–23], because it can scarcely affect industrial availabilities and real-time requirements by using the bypass monitoring. However, the sensing data in distributed IIoT networks has some special characteristics of sparsity, statefulness, and correlation. In practice, the sparsity of sensing data may bring out tremendous challenges to implement the global anomaly detection, because the extracted spatial features seem to be unfavourable for a full-scale anomaly detection model without establishing the intrinsic relationship between different sparse sensing data. In order to solve the above problem, one ideal method is to collect and analyze all sparse sensing data in a local wireless sensor network, which is mainly applied to complete one technological process in the whole industrial production or manufacturing. Additionally, based on the relatively short-range communication characteristic, most IIoT systems always utilize the data collector to gather and forward the sensing data from distributed IIoT sensors, and this design can contribute to developing an experienced machine-learning anomaly detection model, which can thoroughly explore the statefulness and correlation characteristics of sparse sensing data. From this point of view, this paper proposes a novel anomaly detection approach for IIoT sparse data, and this approach successfully collaborates the adaptive CEEMDAN (Complete Ensemble Empirical Mode Decomposition with Adaptive Noise) feature exploitation with one intelligent optimizing classification. Moreover, the CEEMDAN energy entropy based on adaptive IMF (Intrinsic Mode Function) selection is designed to extract the sensing features from IIoT sparse data, and one effective OCSVM (One-Class Support Vector Machine) classifier optimized by the IABC (Improved Artificial Bee Colony) swarm intelligence algorithm is introduced to detect various abnormal sensing features. Additionally, we use some real-world data captured from one local oilfield IIoT system in the northeastern part of China to evaluate our approach, and the experimental results show that, for one thing, compared with the traditional CEEMDAN singular spectrum entropy and EEMD singular value decomposition, the CEEMDAN energy entropy based on adaptive IMF selection can accurately describe the change of sparse sensing data and is more sensitive to the size of abnormal data; for another, compared with the OCSVM classifiers optimized by other swarm intelligence algorithms, the proposed IABC-OCSVM classifier has higher detection efficiency.


## 2. Adaptive CEEMDAN Feature Exploitation

### 2.1. Preparation

Collect all IIoT sensing data in time intervalT (T=∑i=1mti, ∀i∈1,m), and extract the corresponding data sequence Di=d1id2id3i⋯dni,∀i∈1,m from the IIoT sensing data in each time interval ti (i∈1,m), where dni represents the nth data value in the data sequence Di. After that, all data sequences Di (i∈1,m) form a data sequence set D=D1,D2,D3,⋯,Dm, where m is the number of data sequences in the set D.Due to the different number of IIoT sensing data in each time intervalti, the dimensions of all data sequences Di (i∈1,m) are distinct from one another. In order to reconstruct new data samples with the same dimension, an adaptive CEEMDAN feature exploitation method is properly proposed. Furthermore, this method first uses the CEEMDAN decomposition to perform the multiscale analysis on each data sequence, and then adaptively selects the effective IMF components as the feature factors [24]. After that, the corresponding energy entropies are calculated as the final feature values to reconstruct all data samples Yi=y1i,y2i,y3i,⋯,yfi (i∈1,m), which have the same dimension. Here, yji represents the jth feature variable in the ith data sample Yi, and f is the dimension number of Yi.


### 2.2. Adaptive IMF Selection

As mentioned above, in order to construct the data samplesYi (i∈1,m) with the same dimension, it is necessary to determine the feature factors and calculate the corresponding feature values which can be further utilized to obtain the feature variable yji. In terms of feature factor selection, although the IMF components can be used as the feature factors for some traditional anomaly detection models, there is still a considerable issue that the fixed parameter values cannot accurately describe the intrinsic characteristics of original data. To address this issue, the proposed feature exploitation method can sufficiently analyze the contribution of a single IMF component and the global reconstruction error, and adaptively adjust the number of effective IMF components according to the intrinsic characteristics. The specific selection process is listed as follows:Step 1.
We calculate the root mean square error (RMSE), correlation coefficient, and energy difference between the original data and the reconstructed data, and design the adjustment coefficientβ to appropriately adjust the number of IMF components for the adaptive selection of effective IMF components.
Supposex and x′ represent the original data and the reconstructed data, respectively. The numerical difference between x and x′ can be measured by the RMSE, which is defined as
(1)RMSE=1n∑k=1nxk−xk′2.
The correlation betweenx and x′ can be measured by the correlation coefficient, which is defined as
(2)r=∑k=1nxk−x¯xk′−x′¯∑k=1nxk−x¯2∑k=1nxk′−x′¯.
Additionally, the energy difference betweenx and x′ can be calculated by
(3)DiffEx,Ex′=1Ex−Ex′.
Here,E represents the energy value calculation of the original data or the reconstructed data.
Based on the above parameters, we can define the final adjustment coefficientβ as follows:
(4)β=1−RMSEr+diffEx,Ex′.Step 2.
We calculate the cumulative variance contribution and cumulative energy proportion of each IMF component and dynamically adjust their threshold parameters. After that, we further select the effective IMF components which are less than two threshold parameters. Two threshold parameters of IMF components can be calculated by(5)Tλ=1−∑j=1mλj∑j=1Jλj,TE=1−∑j=1mEj∑j=1JEj,m∈1,J,
Here,λj is the variance of the jth IMF component, and Ej is the energy of the jth IMF component.In terms of feature value calculation, the following two points need to be emphasized: the first is the probability distribution of data sequence, and the second is the energy distribution of data sequence. In practice, the technological processes in industrial production can be mapped to industrial communication behaviours by analyzing industrial communications data [25]. That is, when industrial communication behaviours show different states or stages, the corresponding probability distribution and energy distribution of data sequences dynamically change. As a result, the probability distribution and energy distribution of each IMF component obtained by the CEEMDAN decomposition can also change when performing the multiscale analysis on the data sequences. In order to successfully track this change, this paper introduces the information entropy based on the energy distribution of IMF components, and takes the energy entropies of effective IMF components as the final feature values.


### 2.3. Feature Calculation Based on CEEMDAN Energy Entropy

As shown in Figure1, the specific steps of feature calculation based on CEEMDAN energy entropy are listed as follows:Step 1 (data preprocessing).
As mentioned earlier, we obtain each data sequenceDi=d1id2id3i⋯dni,∀i∈1,m from the original IIoT sensing data, and we form the data sequence set D=D1,D2,D3,⋯,Dm.Step 2 (IMF component calculation).
Each data sequenceDi (∀i∈1,m) is decomposed by the CEEMDAN decomposition to obtain J IMF components.
First of all, we suppose the original datax=Di, and we carry out I different experiments on x+ε0wv by using the CEEMDAN decomposition. Additionally, the EMD decomposition in each experiment continues running until the first EMD modal component is obtained. From these I experiments, the first average IMF component can be further calculated by
(6)imf1′=1I∑v=1Iimfv1.
Here,imfv1 represents the first IMF component of the vth experiment.
Also, the first unique remainder can be obtained by(7)r1=x−imf1′.
Secondly, according to the above method, we further decomposerj+εjEjwv,v=1,2,⋯,I for each j (j=1,2,⋯,J), and we calculate the j+1-th IMF component by
(8)imfj+1′=1I∑v=1IE1rj+εjEjwv.
Also, thejth unique remainder can be obtained by
(9)rj=rj−1−imfj′,j∈2,J.
Here,imfj′ is the jth IMF component obtained by the CEEMDAN decomposition, Ej· is the jth EMD modal component obtained by the EMD decomposition, εj−1 is the SNR adjustment coefficient when adding the noise to solve imfj′, and wv is an added zero mean white noise source for v experiments.
Finally, we repeat the above calculation process until no remainder can be decomposed, and we obtain allJ IMF components IMF=imf1′,imf2′,⋯,imfj′. Also, the final remainder can be calculated by
(10)R=x−∑j=1Jimfj′.
To sum up, the original datax can be finally decomposed into
(11)x=∑j=1Jimfj′+R.Step 3.
According to the adaptive IMF selection process, we need to calculate the RMSE, correlation coefficient, and energy difference between the original datax and the reconstructed data x′ which is reconstructed by the IMF components, and we also calculate the cumulative variance contribution and cumulative energy proportion of each IMF component. Through the adaptive IMF selection, we can obtain f effective IMF components.Step 4.
By further calculating the energyEj (∀j∈1,f) of each effective IMF component, we can construct the corresponding energy vector VE=E1,E2,⋯,Ef.Step 5.
For the energy vectorVE, the calculated energy entropy HEj (∀j∈1,f) of each effective IMF component can be regarded as one feature value. Also, we can get the energy entropy vector VH=H1,H2,⋯,Hf. The energy entropy of each effective IMF component can be calculated by
(12)HEj=−PEjlogPEj.Figure 1
Feature exploitation process of CEEMDAN energy entropy based on adaptive IMF selection.Here,Ej represents the energy value of the jth IMF component; PEj=Ej/∑j=1JEj is the energy proportion of the jth IMF component in the total energy.Step 6.
We set the data sampleYi=VH=H1,H2,⋯,Hf (∀i∈1,m), and we form the final data sample set Y=Y1,Y2,⋯,Ym.


## 2.1. Preparation

Collect all IIoT sensing data in time intervalT (T=∑i=1mti, ∀i∈1,m), and extract the corresponding data sequence Di=d1id2id3i⋯dni,∀i∈1,m from the IIoT sensing data in each time interval ti (i∈1,m), where dni represents the nth data value in the data sequence Di. After that, all data sequences Di (i∈1,m) form a data sequence set D=D1,D2,D3,⋯,Dm, where m is the number of data sequences in the set D.Due to the different number of IIoT sensing data in each time intervalti, the dimensions of all data sequences Di (i∈1,m) are distinct from one another. In order to reconstruct new data samples with the same dimension, an adaptive CEEMDAN feature exploitation method is properly proposed. Furthermore, this method first uses the CEEMDAN decomposition to perform the multiscale analysis on each data sequence, and then adaptively selects the effective IMF components as the feature factors [24]. After that, the corresponding energy entropies are calculated as the final feature values to reconstruct all data samples Yi=y1i,y2i,y3i,⋯,yfi (i∈1,m), which have the same dimension. Here, yji represents the jth feature variable in the ith data sample Yi, and f is the dimension number of Yi.


## 2.2. Adaptive IMF Selection

As mentioned above, in order to construct the data samplesYi (i∈1,m) with the same dimension, it is necessary to determine the feature factors and calculate the corresponding feature values which can be further utilized to obtain the feature variable yji. In terms of feature factor selection, although the IMF components can be used as the feature factors for some traditional anomaly detection models, there is still a considerable issue that the fixed parameter values cannot accurately describe the intrinsic characteristics of original data. To address this issue, the proposed feature exploitation method can sufficiently analyze the contribution of a single IMF component and the global reconstruction error, and adaptively adjust the number of effective IMF components according to the intrinsic characteristics. The specific selection process is listed as follows:Step 1.
We calculate the root mean square error (RMSE), correlation coefficient, and energy difference between the original data and the reconstructed data, and design the adjustment coefficientβ to appropriately adjust the number of IMF components for the adaptive selection of effective IMF components.
Supposex and x′ represent the original data and the reconstructed data, respectively. The numerical difference between x and x′ can be measured by the RMSE, which is defined as
(1)RMSE=1n∑k=1nxk−xk′2.
The correlation betweenx and x′ can be measured by the correlation coefficient, which is defined as
(2)r=∑k=1nxk−x¯xk′−x′¯∑k=1nxk−x¯2∑k=1nxk′−x′¯.
Additionally, the energy difference betweenx and x′ can be calculated by
(3)DiffEx,Ex′=1Ex−Ex′.
Here,E represents the energy value calculation of the original data or the reconstructed data.
Based on the above parameters, we can define the final adjustment coefficientβ as follows:
(4)β=1−RMSEr+diffEx,Ex′.Step 2.
We calculate the cumulative variance contribution and cumulative energy proportion of each IMF component and dynamically adjust their threshold parameters. After that, we further select the effective IMF components which are less than two threshold parameters. Two threshold parameters of IMF components can be calculated by(5)Tλ=1−∑j=1mλj∑j=1Jλj,TE=1−∑j=1mEj∑j=1JEj,m∈1,J,
Here,λj is the variance of the jth IMF component, and Ej is the energy of the jth IMF component.In terms of feature value calculation, the following two points need to be emphasized: the first is the probability distribution of data sequence, and the second is the energy distribution of data sequence. In practice, the technological processes in industrial production can be mapped to industrial communication behaviours by analyzing industrial communications data [25]. That is, when industrial communication behaviours show different states or stages, the corresponding probability distribution and energy distribution of data sequences dynamically change. As a result, the probability distribution and energy distribution of each IMF component obtained by the CEEMDAN decomposition can also change when performing the multiscale analysis on the data sequences. In order to successfully track this change, this paper introduces the information entropy based on the energy distribution of IMF components, and takes the energy entropies of effective IMF components as the final feature values.


## 2.3. Feature Calculation Based on CEEMDAN Energy Entropy

As shown in Figure1, the specific steps of feature calculation based on CEEMDAN energy entropy are listed as follows:Step 1 (data preprocessing).
As mentioned earlier, we obtain each data sequenceDi=d1id2id3i⋯dni,∀i∈1,m from the original IIoT sensing data, and we form the data sequence set D=D1,D2,D3,⋯,Dm.Step 2 (IMF component calculation).
Each data sequenceDi (∀i∈1,m) is decomposed by the CEEMDAN decomposition to obtain J IMF components.
First of all, we suppose the original datax=Di, and we carry out I different experiments on x+ε0wv by using the CEEMDAN decomposition. Additionally, the EMD decomposition in each experiment continues running until the first EMD modal component is obtained. From these I experiments, the first average IMF component can be further calculated by
(6)imf1′=1I∑v=1Iimfv1.
Here,imfv1 represents the first IMF component of the vth experiment.
Also, the first unique remainder can be obtained by(7)r1=x−imf1′.
Secondly, according to the above method, we further decomposerj+εjEjwv,v=1,2,⋯,I for each j (j=1,2,⋯,J), and we calculate the j+1-th IMF component by
(8)imfj+1′=1I∑v=1IE1rj+εjEjwv.
Also, thejth unique remainder can be obtained by
(9)rj=rj−1−imfj′,j∈2,J.
Here,imfj′ is the jth IMF component obtained by the CEEMDAN decomposition, Ej· is the jth EMD modal component obtained by the EMD decomposition, εj−1 is the SNR adjustment coefficient when adding the noise to solve imfj′, and wv is an added zero mean white noise source for v experiments.
Finally, we repeat the above calculation process until no remainder can be decomposed, and we obtain allJ IMF components IMF=imf1′,imf2′,⋯,imfj′. Also, the final remainder can be calculated by
(10)R=x−∑j=1Jimfj′.
To sum up, the original datax can be finally decomposed into
(11)x=∑j=1Jimfj′+R.Step 3.
According to the adaptive IMF selection process, we need to calculate the RMSE, correlation coefficient, and energy difference between the original datax and the reconstructed data x′ which is reconstructed by the IMF components, and we also calculate the cumulative variance contribution and cumulative energy proportion of each IMF component. Through the adaptive IMF selection, we can obtain f effective IMF components.Step 4.
By further calculating the energyEj (∀j∈1,f) of each effective IMF component, we can construct the corresponding energy vector VE=E1,E2,⋯,Ef.Step 5.
For the energy vectorVE, the calculated energy entropy HEj (∀j∈1,f) of each effective IMF component can be regarded as one feature value. Also, we can get the energy entropy vector VH=H1,H2,⋯,Hf. The energy entropy of each effective IMF component can be calculated by
(12)HEj=−PEjlogPEj.Figure 1
Feature exploitation process of CEEMDAN energy entropy based on adaptive IMF selection.Here,Ej represents the energy value of the jth IMF component; PEj=Ej/∑j=1JEj is the energy proportion of the jth IMF component in the total energy.Step 6.
We set the data sampleYi=VH=H1,H2,⋯,Hf (∀i∈1,m), and we form the final data sample set Y=Y1,Y2,⋯,Ym.


## 3. IABC-OCSVM Anomaly Detection Classifier

### 3.1. OCSVM Classifier

OCSVM [26, 27], which has a relatively fine classification effect and a generalization capability for small sample data, belongs to one improved version of traditional SVM (Support Vector Machine). Differently, OCSVM exploits the aggregation of original data in the high-dimensional feature space to find one optimal separating hyperplane, which keeps the maximum distance from the coordinate origin. In one sense, OCSVM only needs one class of samples to train a suitable classifier.Actually, OCSVM is briefly designed to solve the following quadratic programming problem:(13)min12ω2+1vl∑i=1lξi−ρs.t.Φxiω≥ρ−ξi,ξi≥0,i=1⋯l.Here,xi (∀i∈1,l) represents one training sample in the training sample set X, and l is the number of training samples; Φ:X⟶H represents the mapping function from the original data space to the high-dimensional feature space; ω and ρ represent the normal vector and compensation of the hyperplane in the high-dimensional feature space, respectively; v∈0,1 represents the trade-off parameter, which is used to control the proportion of support vectors in the training samples; ξi represents the relaxation variable, which indicates the misclassified degree of some training samples.By introducing the Lagrange function to solve the quadratic programming problem, we can further construct the dual model by using the kernel function and obtain the following decision function:(14)fx=sgn∑i=1lαikxi,xj−ρ.Here,ρ=∑i=1lαikxi,xj, and RBF (Radial Basis Function) is selected as the kernel function:
(15)kxi,xj=Φxi,Φxj=exp−xi−xj22σ2.From the above functions, we can see that the OCSVM’s trade-off parameterv and the RBF’s parameter σ are two critical factors affecting the classification performance, and the optimization of these parameters is an important phase to obtain an excellent OCSVM classifier [28].


### 3.2. IABC Parameter Optimization Based on Multivariate Gaussian Mutation

In order to strengthen OCSVM’s classification performance, this paper proposes a novel IABC-OCSVM anomaly detection model, which uses one improved ABC swarm intelligence algorithm to optimize the above parameters. More specifically, the ABC swarm intelligence algorithm is a typical multiobjective optimization method which imitates the searching behaviours of different bees, and its minimum searching model includes two basic elements: bee colony and honey source [29, 30]. Through the local optimization behaviour of individual bees in the searching process, the division and cooperation of three different bee colonies (the leader, the follower, and the scouter) can highlight the global optimization in the colonies. In order to homogenize the distribution of the honey source and improve the searching efficiency, this paper introduces the multivariate Gaussian mutation into the traditional ABC algorithm to dynamically guide the searching processes of different bee colonies, mainly including the following: (1) in the searching process of scouter bees, which is also the initial process of the honey source, since the initial honey source is mutated by the multivariate Gaussian mutation; (2) in the searching process of leader bees, wherein the OCSVM’s classification accuracy of current global optimization is used to dynamically guide the searching process; and (3) in the searching process of follower bees, where the local optimum of leader searching is applied to carry out the variant search of the neighbouring honey source. Figure 2 describes the parameter optimization and anomaly detection process of the IABC-OCSVM model.Figure 2
Parameter optimization and anomaly detection of IABC-OCSVM model.In the initialization process of the honey source, the initial honey source is mutated by the multivariate Gaussian mutation:(16)xi,j=xjmin+rand0,1xjmax−xjmin,p=1∑2πdexp−12x−μT∑−1x−μ.Here, the expression ofxi,j (∀i∈1,N, ∀j∈1,D) is the initialization formula of the ith honey source, and N and D are the number and dimension of honey sources, respectively; in our algorithm, D is set to 2 due to the OCSVM’s parameter v and RBF’s parameter σ; xjmax and xjmin are the maximum and minimum in each dimension of the honey source; the expression of p is the multivariate Gaussian mutation formula, and x=x1,j,x2,j,⋯xN,j and p=p1,j,p2,j,⋯pN,j represent all honey sources before and after Gaussian mutation, respectively; μ and ∑ are the mean and covariance matrix of x, and ∑−1 and d are the inverse and dimension of ∑.In the searching process of leader bees, based on the Gbest searching strategy, the dynamic searching process is carried out through the guide of global optimization, and the OCSVM’s classification accuracy in the current searching process is introduced to realize the adaptive search. The search of a neighbouring honey source can be expressed by(17)vi,j=fpipi,j+ϕi,jfpipi,j−fpkpk,j1iter+ψi,jfpgpg,j−fpipi,j1iter.Here,vi,j represents a new honey source; pi,j is the honey source generated after the multivariate Gaussian mutation, and pi=pi,j (∀j∈1,D); pk,j (k≠i, ∀k∈1,N) is a neighbouring honey source randomly selected from all honey sources, and is different from the current honey source pi,j; pg,j represents the global optimal solution; fp∗ represents the OCSVM’s classification accuracy corresponding to the honey source p∗; ϕi,j is one random number in the range −1,1; ψi,j is one random number in the range 0,1; iter is the goal-setting number of iterations.In the searching process of follower bees, according to the local optimum in the searching process of leader bees, the mutation operation can be performed on the neighbouring honey source, and the OCSVM’s classification accuracy in the current searching process is introduced to realize the variant search. The search of a neighbouring honey source can be expressed by(18)vi,j=fplpl,j+ϕi,jfpipi,j−fpkpk,j1iter.Here,pl,j represents the optimal solution in the searching process of leader bees.In the whole searching process, each honey source represents a feasible solution, and the yield of a honey source is consistent with the fitness of a feasible solution, which is calculated by(19)Fiti=11+fpi,fpi≥0,1+absfpi,fpi<0.Here,fpi represents the OCSVM’s classification accuracy corresponding to the honey source pi.


## 3.1. OCSVM Classifier

OCSVM [26, 27], which has a relatively fine classification effect and a generalization capability for small sample data, belongs to one improved version of traditional SVM (Support Vector Machine). Differently, OCSVM exploits the aggregation of original data in the high-dimensional feature space to find one optimal separating hyperplane, which keeps the maximum distance from the coordinate origin. In one sense, OCSVM only needs one class of samples to train a suitable classifier.Actually, OCSVM is briefly designed to solve the following quadratic programming problem:(13)min12ω2+1vl∑i=1lξi−ρs.t.Φxiω≥ρ−ξi,ξi≥0,i=1⋯l.Here,xi (∀i∈1,l) represents one training sample in the training sample set X, and l is the number of training samples; Φ:X⟶H represents the mapping function from the original data space to the high-dimensional feature space; ω and ρ represent the normal vector and compensation of the hyperplane in the high-dimensional feature space, respectively; v∈0,1 represents the trade-off parameter, which is used to control the proportion of support vectors in the training samples; ξi represents the relaxation variable, which indicates the misclassified degree of some training samples.By introducing the Lagrange function to solve the quadratic programming problem, we can further construct the dual model by using the kernel function and obtain the following decision function:(14)fx=sgn∑i=1lαikxi,xj−ρ.Here,ρ=∑i=1lαikxi,xj, and RBF (Radial Basis Function) is selected as the kernel function:
(15)kxi,xj=Φxi,Φxj=exp−xi−xj22σ2.From the above functions, we can see that the OCSVM’s trade-off parameterv and the RBF’s parameter σ are two critical factors affecting the classification performance, and the optimization of these parameters is an important phase to obtain an excellent OCSVM classifier [28].


## 3.2. IABC Parameter Optimization Based on Multivariate Gaussian Mutation

In order to strengthen OCSVM’s classification performance, this paper proposes a novel IABC-OCSVM anomaly detection model, which uses one improved ABC swarm intelligence algorithm to optimize the above parameters. More specifically, the ABC swarm intelligence algorithm is a typical multiobjective optimization method which imitates the searching behaviours of different bees, and its minimum searching model includes two basic elements: bee colony and honey source [29, 30]. Through the local optimization behaviour of individual bees in the searching process, the division and cooperation of three different bee colonies (the leader, the follower, and the scouter) can highlight the global optimization in the colonies. In order to homogenize the distribution of the honey source and improve the searching efficiency, this paper introduces the multivariate Gaussian mutation into the traditional ABC algorithm to dynamically guide the searching processes of different bee colonies, mainly including the following: (1) in the searching process of scouter bees, which is also the initial process of the honey source, since the initial honey source is mutated by the multivariate Gaussian mutation; (2) in the searching process of leader bees, wherein the OCSVM’s classification accuracy of current global optimization is used to dynamically guide the searching process; and (3) in the searching process of follower bees, where the local optimum of leader searching is applied to carry out the variant search of the neighbouring honey source. Figure 2 describes the parameter optimization and anomaly detection process of the IABC-OCSVM model.Figure 2
Parameter optimization and anomaly detection of IABC-OCSVM model.In the initialization process of the honey source, the initial honey source is mutated by the multivariate Gaussian mutation:(16)xi,j=xjmin+rand0,1xjmax−xjmin,p=1∑2πdexp−12x−μT∑−1x−μ.Here, the expression ofxi,j (∀i∈1,N, ∀j∈1,D) is the initialization formula of the ith honey source, and N and D are the number and dimension of honey sources, respectively; in our algorithm, D is set to 2 due to the OCSVM’s parameter v and RBF’s parameter σ; xjmax and xjmin are the maximum and minimum in each dimension of the honey source; the expression of p is the multivariate Gaussian mutation formula, and x=x1,j,x2,j,⋯xN,j and p=p1,j,p2,j,⋯pN,j represent all honey sources before and after Gaussian mutation, respectively; μ and ∑ are the mean and covariance matrix of x, and ∑−1 and d are the inverse and dimension of ∑.In the searching process of leader bees, based on the Gbest searching strategy, the dynamic searching process is carried out through the guide of global optimization, and the OCSVM’s classification accuracy in the current searching process is introduced to realize the adaptive search. The search of a neighbouring honey source can be expressed by(17)vi,j=fpipi,j+ϕi,jfpipi,j−fpkpk,j1iter+ψi,jfpgpg,j−fpipi,j1iter.Here,vi,j represents a new honey source; pi,j is the honey source generated after the multivariate Gaussian mutation, and pi=pi,j (∀j∈1,D); pk,j (k≠i, ∀k∈1,N) is a neighbouring honey source randomly selected from all honey sources, and is different from the current honey source pi,j; pg,j represents the global optimal solution; fp∗ represents the OCSVM’s classification accuracy corresponding to the honey source p∗; ϕi,j is one random number in the range −1,1; ψi,j is one random number in the range 0,1; iter is the goal-setting number of iterations.In the searching process of follower bees, according to the local optimum in the searching process of leader bees, the mutation operation can be performed on the neighbouring honey source, and the OCSVM’s classification accuracy in the current searching process is introduced to realize the variant search. The search of a neighbouring honey source can be expressed by(18)vi,j=fplpl,j+ϕi,jfpipi,j−fpkpk,j1iter.Here,pl,j represents the optimal solution in the searching process of leader bees.In the whole searching process, each honey source represents a feasible solution, and the yield of a honey source is consistent with the fitness of a feasible solution, which is calculated by(19)Fiti=11+fpi,fpi≥0,1+absfpi,fpi<0.Here,fpi represents the OCSVM’s classification accuracy corresponding to the honey source pi.


## 4. Experimental Evaluation and Discussion

### 4.1. Experimental Data and Preparation

In order to verify the effectiveness and advantage of the proposed approach, we use some real-world data captured from one local oilfield IIoT system in the northeastern part of China to perform some experimental evaluations, and the basic system architecture can be briefly stated as follows: all IIoT sensors are physically deployed in the wellheads and perform the real-time data acquisition of the pumping well working status, mainly including the pressure, the motor speed, the flow, and some electrical parameters. By using the WIA-PA protocol [31], the IIoT sensors in one wellhead send these sensing data to one RTU (Remote Terminal Unit) which can be regarded as the data collector in our approach, and the RTU forwards these sensing data to the upper monitoring center by using the Modbus/TCP protocol. After capturing the Modbus/TCP packets in one RTU for 9 hours, we totally obtain 109,672 IIoT sensing data, and form 225 data sequences by the initial preparation.


### 4.2. Experimental Comparison and Analysis on Different Feature Exploitations

For the obtained data sequence set, in each experiment, we randomly select 200 data sequences as the normal data sequences and construct 100 abnormal data sequences by injecting or falsifying some malicious data which cannot conform to the regular production pattern. After the proposed adaptive CEEMDAN feature exploitation, we record all normal and abnormal data samples as “+1” and “-1” data samples, respectively. Moreover, all normal data samples are used to train the IABC-OCSVM anomaly detection classifier, and the test sample set consists of randomly selected 100 “+1” data samples and 100 “-1” data samples. Additionally, because the number of malicious data in each data sequence can directly reflect different attack powers, we design 5 incremental attack powers when constructing 100 abnormal data sequences. From attack power 1 to 5, the number of malicious data in each data sequence is set from 6 to 10. In order to verify the main advantage of adaptive CEEMDAN feature exploitation in the multiscale analysis of data sequences, we introduce the classification accuracy as one significant evaluation indicator to perform two distinct groups of experiments: the first group of experiments compare the CEEMDAN decomposition with the EEMD decomposition whose IMF components are depicted in Figure3, and the training and test classification accuracies of their extracted features are shown in Table 1; the second group of experiments compare different test classification accuracies of CEEMDAN energy entropy, CEEMDAN singular spectrum entropy, and EEMD singular value decomposition, and the experimental results are shown in Table 2.Figure 3
Compared results of CEEMDAN and EEMD decompositions.Table 1
Training and test classification accuracies of CEEMDAN and EEMD decompositions under different attack powers.
Attack powerCEEMDANEEMDTraining accuracyTest accuracyTraining accuracyTest accuracy196.0%86.5%92.5%81.5%293.5%88.0%91.0%87.5%391.0%90.0%92.0%88.5%496.5%87.0%94.5%87.0%598.5%93.5%91.5%88.0%Average95.10%89.00%92.30%86.50%Table 2
Test classification accuracies of three different feature exploitation methods.
Attack powerCEEMDAN energy entropyCEEMDAN singular spectrum entropyEEMD singular value decomposition186.5%82.0%80.5%288.0%85.0%82.5%390.0%83.5%83.5%487.0%85.5%81.0%593.5%88.5%83.5%Average89.00%84.90%82.20%As seen in Table1, when the average training classification accuracies of EEMD and CEEMDAN decompositions reach 92.30% and 95.10%, their average test classification accuracies are 86.50% and 89.00%, respectively. From the above compared results, it can be concluded that both the training classification accuracy and the test classification accuracy of CEEMDAN decomposition are larger than the ones of EEMD decomposition. That is to say, the CEEMDAN decomposition can effectively discover more intrinsic characteristics of original data, and the corresponding extracted features can contribute to improving the classification accuracy of the OCSVM classifier.From Table2, we can see that, for the feature exploitation methods based on CEEMDAN singular spectrum entropy and EEMD singular value decomposition, their average classification accuracies are 84.90% and 82.20%, respectively. Obviously, these accuracies are less than that of the proposed feature exploitation method, which can reach 89.00%. Through the comprehensive comparison of these two tables, we can conclude that, on the one hand, the proposed feature exploitation method has distinct advantages in the improvement of classification accuracy, on the other hand, these results indirectly show that the proposed method can more accurately describe the change of industrial communication behaviour. Additionally, as the attack power increases, that is, the number of malicious data in each data sequence increases, the classification accuracy generally shows an upward trend. In other words, the proposed feature exploitation method is more sensitive to the number of malicious data, which can help to improve the anomaly detection performance.Figure4 compares the CEEMDAN decomposition results of normal and abnormal data samples. When some abnormal communication behaviours occur in industrial production, not only the energy information and probability information in all data sequences change accordingly, but also the implicit information in each data sequence differs from others under different scales. Figure 5 depicts the energy proportion and variance contribution rate of different IMF components after the CEEMDAN decomposition. Totally, the energy and variance of each IMF component can appear surprisingly distinct from each other. Based on this result, when selecting the appropriate feature parameters, we can focus on the IMF components which have larger contribution rates and remove the IMF components with insufficient information.Figure 4
CEEMDAN decomposition results of normal and abnormal data samples.Figure 5
Energy proportion and variance contribution rate of different IMF components.


### 4.3. Experimental Comparison and Analysis on Different Parameter Optimizations

In order to further illustrate the influence of parameter optimization on the OCSVM’s classification performance, we, respectively, use the traditional ABC algorithm and PSO (Particle Swarm Optimization) algorithm to optimize the OCSVM classifier and compare their classification accuracies by performing some experiments under 5 attack powers. Moreover, the fitness curves in two parameter optimization processes are shown in Figure6, and the training and test classification accuracies of two classifiers are compared in Table 3. Obviously, the above experimental results can directly reflect that two parameter optimization algorithms have different effects on the OCSVM’s classification performance. In terms of classification accuracy, the average training and test classification accuracies of the ABC-OCSVM classifier are 95.10% and 89.00%, respectively. Differently, the average training and test classification accuracies of the PSO-OCSVM classifier are 98.00% and 83.20%, respectively. Although the average training classification accuracy of the ABC-OCSVM classifier is slightly lower than that of the PSO-OCSVM classifier, the average test classification accuracy of the ABC-OCSVM classifier can present a trend of higher resolution. That is, the ABC-OCSVM classifier can have a smaller span change from training accuracy to test accuracy, and obtain a relatively higher classification accuracy in practice. Also, the above compared results have proven that different combinations of OCSVM’s trade-off parameter v and RBF’s parameter σ can have a pronounced impact on the OCSVM’s classification accuracy, and one fine parameter optimization algorithm can help to improve the detection performance of OCSVM’s classifier.Figure 6
Fitness curves in the traditional ABC and PSO parameter optimization processes.
(a)(b)Table 3
Training and test classification accuracies of traditional ABC-OCSVM and PSO-OCSVM anomaly detection classifiers.
Attack powerABC-OCSVMPSO-OCSVMTraining accuracyTest accuracyTraining accuracyTest accuracy196.0%86.5%98.0%80.5%293.5%88.0%96.5%83.0%391.0%90.0%98.0%85.0%496.5%87.0%100.0%84.0%598.5%93.5%98.0%83.5%Average95.10%89.00%98.00%83.20%In order to obtain better parameters and further improve the anomaly detection efficiency, we propose an IABC-OCSVM anomaly detection classifier optimized by the improved ABC algorithm. To evaluate this classifier, we perform some compared experiments to analyze the training classification accuracy, test classification accuracy, and test time between the traditional ABC-OCSVM classifier and the IABC-OCSVM classifier, and Table4 shows the experimental results under 5 attack powers. As shown in Table 4, under a similar average test time, the average training and test classification accuracies of the IABC-OCSVM classifier can reach 94.50% and 89.80%, respectively. Although the average training classification accuracy of the IABC-OCSVM classifier is slightly lower than that of the ABC-OCSVM classifier, its average test classification accuracy is higher than the one of the ABC-OCSVM classifier. Especially, for the test samples with a stronger attack power, the test classification accuracy of the IABC-OCSVM classifier is significantly higher than the one of the ABC-OCSVM classifier. For example, under attack power 5, the test classification accuracy of the IABC-OCSVM classifier can reach 95.50%, which grows by two percentage points. More narrowly, Figure 7 gives the classification results of training samples and test samples under attack power 5. Furthermore, Figure 7(a) shows 3 training samples that are wrongly classified in all 200 training samples, and Figure 7(b) shows 9 test samples that are wrongly classified in all 200 test samples. Additionally, the average test time of the IABC-OCSVM classifier is only 0.0081 s, which still reaches the millisecond level and has a strong real-time classification capability. From the comprehensive evaluation of classification accuracy and detection time, the proposed IABC-OCSVM classifier has a higher detection efficiency.Table 4
Detection efficiency comparisons between traditional ABC-OCSVM and PSO-OCSVM anomaly detection classifiers.
Attack powerABC-OCSVMIABC-OCSVMTraining accuracyTest accuracyTest timeTraining accuracyTest accuracyTest time196.0%86.5%0.0079 s96.0%86.5%0.0076 s293.5%88.0%0.0079 s92.0%88.5%0.0080 s391.0%90.0%0.0090 s91.0%90.5%0.0081 s496.5%87.0%0.0076 s95.0%88.0%0.0079 s598.5%93.5%0.0086 s98.5%95.5%0.0089 sAverage95.10%89.00%0.0082 s94.50%89.80%0.0081 sFigure 7
Classification results of training samples and test samples under attack power 5.
(a)(b)


## 4.1. Experimental Data and Preparation

In order to verify the effectiveness and advantage of the proposed approach, we use some real-world data captured from one local oilfield IIoT system in the northeastern part of China to perform some experimental evaluations, and the basic system architecture can be briefly stated as follows: all IIoT sensors are physically deployed in the wellheads and perform the real-time data acquisition of the pumping well working status, mainly including the pressure, the motor speed, the flow, and some electrical parameters. By using the WIA-PA protocol [31], the IIoT sensors in one wellhead send these sensing data to one RTU (Remote Terminal Unit) which can be regarded as the data collector in our approach, and the RTU forwards these sensing data to the upper monitoring center by using the Modbus/TCP protocol. After capturing the Modbus/TCP packets in one RTU for 9 hours, we totally obtain 109,672 IIoT sensing data, and form 225 data sequences by the initial preparation.


## 4.2. Experimental Comparison and Analysis on Different Feature Exploitations

For the obtained data sequence set, in each experiment, we randomly select 200 data sequences as the normal data sequences and construct 100 abnormal data sequences by injecting or falsifying some malicious data which cannot conform to the regular production pattern. After the proposed adaptive CEEMDAN feature exploitation, we record all normal and abnormal data samples as “+1” and “-1” data samples, respectively. Moreover, all normal data samples are used to train the IABC-OCSVM anomaly detection classifier, and the test sample set consists of randomly selected 100 “+1” data samples and 100 “-1” data samples. Additionally, because the number of malicious data in each data sequence can directly reflect different attack powers, we design 5 incremental attack powers when constructing 100 abnormal data sequences. From attack power 1 to 5, the number of malicious data in each data sequence is set from 6 to 10. In order to verify the main advantage of adaptive CEEMDAN feature exploitation in the multiscale analysis of data sequences, we introduce the classification accuracy as one significant evaluation indicator to perform two distinct groups of experiments: the first group of experiments compare the CEEMDAN decomposition with the EEMD decomposition whose IMF components are depicted in Figure3, and the training and test classification accuracies of their extracted features are shown in Table 1; the second group of experiments compare different test classification accuracies of CEEMDAN energy entropy, CEEMDAN singular spectrum entropy, and EEMD singular value decomposition, and the experimental results are shown in Table 2.Figure 3
Compared results of CEEMDAN and EEMD decompositions.Table 1
Training and test classification accuracies of CEEMDAN and EEMD decompositions under different attack powers.
Attack powerCEEMDANEEMDTraining accuracyTest accuracyTraining accuracyTest accuracy196.0%86.5%92.5%81.5%293.5%88.0%91.0%87.5%391.0%90.0%92.0%88.5%496.5%87.0%94.5%87.0%598.5%93.5%91.5%88.0%Average95.10%89.00%92.30%86.50%Table 2
Test classification accuracies of three different feature exploitation methods.
Attack powerCEEMDAN energy entropyCEEMDAN singular spectrum entropyEEMD singular value decomposition186.5%82.0%80.5%288.0%85.0%82.5%390.0%83.5%83.5%487.0%85.5%81.0%593.5%88.5%83.5%Average89.00%84.90%82.20%As seen in Table1, when the average training classification accuracies of EEMD and CEEMDAN decompositions reach 92.30% and 95.10%, their average test classification accuracies are 86.50% and 89.00%, respectively. From the above compared results, it can be concluded that both the training classification accuracy and the test classification accuracy of CEEMDAN decomposition are larger than the ones of EEMD decomposition. That is to say, the CEEMDAN decomposition can effectively discover more intrinsic characteristics of original data, and the corresponding extracted features can contribute to improving the classification accuracy of the OCSVM classifier.From Table2, we can see that, for the feature exploitation methods based on CEEMDAN singular spectrum entropy and EEMD singular value decomposition, their average classification accuracies are 84.90% and 82.20%, respectively. Obviously, these accuracies are less than that of the proposed feature exploitation method, which can reach 89.00%. Through the comprehensive comparison of these two tables, we can conclude that, on the one hand, the proposed feature exploitation method has distinct advantages in the improvement of classification accuracy, on the other hand, these results indirectly show that the proposed method can more accurately describe the change of industrial communication behaviour. Additionally, as the attack power increases, that is, the number of malicious data in each data sequence increases, the classification accuracy generally shows an upward trend. In other words, the proposed feature exploitation method is more sensitive to the number of malicious data, which can help to improve the anomaly detection performance.Figure4 compares the CEEMDAN decomposition results of normal and abnormal data samples. When some abnormal communication behaviours occur in industrial production, not only the energy information and probability information in all data sequences change accordingly, but also the implicit information in each data sequence differs from others under different scales. Figure 5 depicts the energy proportion and variance contribution rate of different IMF components after the CEEMDAN decomposition. Totally, the energy and variance of each IMF component can appear surprisingly distinct from each other. Based on this result, when selecting the appropriate feature parameters, we can focus on the IMF components which have larger contribution rates and remove the IMF components with insufficient information.Figure 4
CEEMDAN decomposition results of normal and abnormal data samples.Figure 5
Energy proportion and variance contribution rate of different IMF components.


## 4.3. Experimental Comparison and Analysis on Different Parameter Optimizations

In order to further illustrate the influence of parameter optimization on the OCSVM’s classification performance, we, respectively, use the traditional ABC algorithm and PSO (Particle Swarm Optimization) algorithm to optimize the OCSVM classifier and compare their classification accuracies by performing some experiments under 5 attack powers. Moreover, the fitness curves in two parameter optimization processes are shown in Figure6, and the training and test classification accuracies of two classifiers are compared in Table 3. Obviously, the above experimental results can directly reflect that two parameter optimization algorithms have different effects on the OCSVM’s classification performance. In terms of classification accuracy, the average training and test classification accuracies of the ABC-OCSVM classifier are 95.10% and 89.00%, respectively. Differently, the average training and test classification accuracies of the PSO-OCSVM classifier are 98.00% and 83.20%, respectively. Although the average training classification accuracy of the ABC-OCSVM classifier is slightly lower than that of the PSO-OCSVM classifier, the average test classification accuracy of the ABC-OCSVM classifier can present a trend of higher resolution. That is, the ABC-OCSVM classifier can have a smaller span change from training accuracy to test accuracy, and obtain a relatively higher classification accuracy in practice. Also, the above compared results have proven that different combinations of OCSVM’s trade-off parameter v and RBF’s parameter σ can have a pronounced impact on the OCSVM’s classification accuracy, and one fine parameter optimization algorithm can help to improve the detection performance of OCSVM’s classifier.Figure 6
Fitness curves in the traditional ABC and PSO parameter optimization processes.
(a)(b)Table 3
Training and test classification accuracies of traditional ABC-OCSVM and PSO-OCSVM anomaly detection classifiers.
Attack powerABC-OCSVMPSO-OCSVMTraining accuracyTest accuracyTraining accuracyTest accuracy196.0%86.5%98.0%80.5%293.5%88.0%96.5%83.0%391.0%90.0%98.0%85.0%496.5%87.0%100.0%84.0%598.5%93.5%98.0%83.5%Average95.10%89.00%98.00%83.20%In order to obtain better parameters and further improve the anomaly detection efficiency, we propose an IABC-OCSVM anomaly detection classifier optimized by the improved ABC algorithm. To evaluate this classifier, we perform some compared experiments to analyze the training classification accuracy, test classification accuracy, and test time between the traditional ABC-OCSVM classifier and the IABC-OCSVM classifier, and Table4 shows the experimental results under 5 attack powers. As shown in Table 4, under a similar average test time, the average training and test classification accuracies of the IABC-OCSVM classifier can reach 94.50% and 89.80%, respectively. Although the average training classification accuracy of the IABC-OCSVM classifier is slightly lower than that of the ABC-OCSVM classifier, its average test classification accuracy is higher than the one of the ABC-OCSVM classifier. Especially, for the test samples with a stronger attack power, the test classification accuracy of the IABC-OCSVM classifier is significantly higher than the one of the ABC-OCSVM classifier. For example, under attack power 5, the test classification accuracy of the IABC-OCSVM classifier can reach 95.50%, which grows by two percentage points. More narrowly, Figure 7 gives the classification results of training samples and test samples under attack power 5. Furthermore, Figure 7(a) shows 3 training samples that are wrongly classified in all 200 training samples, and Figure 7(b) shows 9 test samples that are wrongly classified in all 200 test samples. Additionally, the average test time of the IABC-OCSVM classifier is only 0.0081 s, which still reaches the millisecond level and has a strong real-time classification capability. From the comprehensive evaluation of classification accuracy and detection time, the proposed IABC-OCSVM classifier has a higher detection efficiency.Table 4
Detection efficiency comparisons between traditional ABC-OCSVM and PSO-OCSVM anomaly detection classifiers.
Attack powerABC-OCSVMIABC-OCSVMTraining accuracyTest accuracyTest timeTraining accuracyTest accuracyTest time196.0%86.5%0.0079 s96.0%86.5%0.0076 s293.5%88.0%0.0079 s92.0%88.5%0.0080 s391.0%90.0%0.0090 s91.0%90.5%0.0081 s496.5%87.0%0.0076 s95.0%88.0%0.0079 s598.5%93.5%0.0086 s98.5%95.5%0.0089 sAverage95.10%89.00%0.0082 s94.50%89.80%0.0081 sFigure 7
Classification results of training samples and test samples under attack power 5.
(a)(b)


## 5. Conclusions

The sparsity of IIoT sensing data may bring out tremendous challenges to implement the global anomaly detection, and the collection and analysis of all sparse sensing data in a local wireless sensor network can provide a feasible opportunity to develop an experienced machine-learning anomaly detection model by exploring their statefulness and correlation characteristics. From this point of view, this paper proposes a novel IABC-OCSVM anomaly detection approach for IIoT sparse data, which can successfully collaborate the adaptive CEEMDAN feature exploitation with the intelligent optimizing OCSVM classifier. Firstly, the multiscale analysis of IIoT data sequences is carried out through the CEEMDAN decomposition, and the effective IMF components can be adaptively selected to calculate the corresponding energy entropies and construct the final data samples. Secondly, this approach designs one improved ABC algorithm based on a multivariate Gaussian mutation to optimize the important parameters of a traditional OCSVM classifier, which can unambiguously match with the adaptive CEEMDAN feature exploitation method. Finally, many experiments are performed to evaluate the proposed approach: on the one hand, by comparing different feature exploitation methods, we prove that the proposed feature exploitation method can more accurately describe the change of industrial communication behaviour, and have distinct advantages to improve the classification accuracy; on the other hand, by comparing different parameter optimization algorithms, we prove that the proposed IABC-OCSVM classifier can have higher detection efficiency.



---

*Source: 4329219-2021-10-07.xml*