Research on Anomaly Detection of Power Industrial Control System Based on Gaussian Mixture Clustering

doi:10.3969/j.issn.1671-1122.2021.03.007

Abstract

Abstract:

The data of power industrial control system has periodicity in the time dimension, but its time series shows the characteristic of multiple Gaussian distribution and the period length is not fixed, which makes it difficult to carry out similarity measurement to find anomalies. According to the above problem, this paper proposes a power control system based on multivariate gaussian clustering anomaly temporal detection method, this method first obtains power system flow control in the data, adopts the multivariate Gaussian hybrid algorithm to realize the symbolization of time series, and then uses the Markov chain from the length of time series to extract transition probability matrix of the same size as the data characteristics. At last, anomaly detection is realized by using hierarchical clustering method to calculate the sample rate of abnormal. The experimental results show that this method can effectively realize the abnormal automatic detection of power industrial control system with different timing data cycle lengths.

Key words: power industrial control system, anomaly detection, multivariate Gaussian distribution, Markov chain, hierarchical clustering

CLC Number:

TP309

LI Jiawei, WU Kehe, ZHANG Bo. Research on Anomaly Detection of Power Industrial Control System Based on Gaussian Mixture Clustering[J]. Netinfo Security, 2021, 21(3): 53-63.

Figures/Tables 9

References 20

[1]	KEOGH E, CHAKRABARTI K, PAZZANI M, et al. Dimensionality Reduction for Fast Similarity Search in Large Time Series Databases[J]. Knowledge and Information Systems, 2001,3(3):263-286. doi: 10.1007/PL00011669 URL
[2]	LIN J, KEOGH E, LONARDI S, et al. A Symbolic Representation of Time Series with Implications for Streaming Algorithms [C]//ACM. Proceedings of the 8th ACM SIGMOD Workshop on Research Issues in Data Mining and Knowledge Discovery, June 13, 2003, San Diego, CA, USA. New York: ACM, 2003: 2-11.
[3]	DING Xiaoou, YU Shengjian, WANG Muxian, et al. Anomaly Detection on Industrial Time Series Based on Correlation Analysis[J]. Journal of Software, 2020,31(3):726-747.
	丁小欧, 于晟健, 王沐贤, 等. 基于相关性分析的工业时序数据异常检测[J]. 软件学报, 2020,31(3):726-747.
[4]	LI Qianmu, WANG Yinhai, PU Ziyuan, et al. Time Series Association State Analysis Method for Attacks on The Smart Internet of Electric Vehicle Charging Network[J]. Transportation Research Record, 2019,2673(4):217-228.
[5]	FUAD M M, MARTEAU P F. Enhancing the Symbolic Aggregate Approximation Method Using Updated Lookup Tables [C]//Springer. International Conference on Knowledge-based and Intelligent Information and Engineering Systems, September 8-10, 2010, Cardiff, UK. Berlin: Springer, 2010: 420-431.
[6]	BAI Xue, XIONG Yun, ZHU Yangyong, et al. Time Series Representation: A Random Shifting Perspective [C]//Springer. International Conference on Web-Age Information Management, June 14-16, Beidaihe, China. Berlin: Springer, 2013: 37-50.
[7]	MALINOWSKI S, GUYET T, QUINIOU R, et al. 1d-sax: A Novel Symbolic Representation for Time Series [C]//Springer. International Symposium on Intelligent Data Analysis, October 17-19, 2013, London, UK. Berlin: Springer, 2013: 273-284.
[8]	YIN Ning, WANG Shanshan, HONG Shenda, et al. A Segment-Wise Method for Pseudo Periodic Time Series Prediction [C]//Springer. 2014 Advanced Data Mining and Applications - 10th International Conference, December 19-21, 2014, Guilin China. Berlin, Springer, 2014: 461-474.
[9]	ZHAN Peng, CHEN Lin, CAO Luhui, et al. Network Traffic Anomaly Detection Based on Feature-based Symbolic Representation[J]. Journal of ZheJiang University (Engineering Science), 2020,54(7):1281-1288.
	展鹏, 陈琳, 曹鲁慧, 等. 基于特征符号表示的网络异常流量检测算法[J]. 浙江大学学报(工学版), 2020,54(7):1281-1288.
[10]	ZHANG Chuxu, SONG Dongjin, CHEN Yuncong, et al. A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data [C]//IEEE. Proceedings of the AAAI Conference on Artificial Intelligence, February 1, 2019, Honolulu, Hawaii, USA. New York: IEEE, 2019: 1409-1416.
[11]	PHAM N D, LE Q L, DANG T K. Two Novel Adaptive Symbolic Representations for Similarity Search in Time Series Databases [C]//IEEE. 2010 12th International Asia-pacific Web Conference, April 6-8, 2010, Busan, Korea (South). New York: IEEE, 2010: 181-187.
[12]	BARNAGHI P M, BAKAR A A, OTHMAN Z A. Enhanced Symbolic Aggregate Approximation Method for Financial Time Series Data Representation [C]//IEEE. 2012 6th International Conference on New Trends in Information Science, Service Science and Data Mining (NISS2012), October 23-25, 2012, Taipei Taiwan China. New York: IEEE, 2012: 790-795.
[13]	PASSOS H, TEODORO F G S, DURU B M, et al. Symbolic Representations of Time Series Applied to Biometric Recognition Based on ECG Signals [C]//IEEE. 2017 International Joint Conference on Neural Networks (IJCNN), May 14, 2017, Anchorage Alaska USA. New York: IEEE, 2017: 3199-3207.
[14]	QI Qi, SHEN Runye, WANG Jingyu. GAD: Topology-aware Time Series Anomaly Detection[J]. Journal on Communications, 2020,41(6):152-160.
	戚琦, 申润业, 王敬宇. GAD:基于拓扑感知的时间序列异常检测[J]. 通信学报, 2020,41(6):152-160.
[15]	TANG Hewei, ZHANG Shang, ZHANG Feifei, et al. Time Series Data Analysis for Automatic Flow Influx Detection During Drilling[J]. Journal of Petroleum Science and Engineering, 2019,172(4):1103-1111. doi: 10.1016/j.petrol.2018.09.018 URL
[16]	PHAM V, NGUYEN N, LI J, et al. Mtsad: Multivariate Time Series Abnormality Detection and Visualization [C]//IEEE. 2019 IEEE International Conference on Big Data, December 9-12, 2019, Los Angeles, CA, USA. New York: IEEE, 2019: 3267-3276.
[17]	LIPPONEN J A, TARVAINEN M P. A Robust Algorithm for Heart Rate Variability Time Series Artefact Correction Using Novel Beat Classification[J]. Journal of Medical Engineering & Technology, 2019,43(3):173-181. doi: 10.1080/03091902.2019.1640306 URL pmid: 31314618
[18]	LI Dan, CHEN Dacheng, JIN Baihong, et al. MAD-GAN: Multivariate Anomaly Detection for Time Series Data With Generative Adversarial Networks [C]//Springer. International Conference on Artificial Neural Networks, September 17-19, 2019, Munich, Germany. Berlin: Springer, 2019: 703-716.
[19]	SU Ya, ZHAO Youjian, NIU Chenhao, et al. Robust Anomaly Detection for Multivariate Time Series Through Stochastic Recurrent Neural Network [C]//ACM. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, August 4-8, 2019, Anchorage AK USA. New York: ACM, 2019: 2828-2837.
[20]	PALPANAS T, BECKMANN V. Report on The First and Second Interdisciplinary Time Series Analysis Workshop (Itisa)[J]. ACM SIGMOD Record, 2019,48(3):36-40.

平均距离	0.004144323
最大距离	1.652184941
最小距离	0