In the context of Industrial Internet,security condition is becoming worse and worse for manufacturing.The closed-loop control in the production process has the consequence that external attacks as well as internal faults will eventually reflect anomalies in the process data.Therefore,research on process data anomaly detection has gain popularity because of its ability to address multiple types of threats.Additionally,due to the fact that an entire industrial process may be impacted by a single anomaly through ICS,engineers indeed require process data anomaly diagnosis to provide sufficient information to investigate the cause of the anomaly.Expert-knowledge based methods in existing process data anomaly detection research lack generality and expert knowledge is difficult to obtain.By contrast,the data-driven methods can be generally used by different types of industrial processes while facing the risk of missed anomaly detection because it ignores the general process knowledge.Existing studies in the field of process data anomaly diagnosis are unable to diagnose compound anomalies without abnormal samples.Based on the deficiencies above,this thesis introduces some general process knowledge in industrial processes to improve the performance of anomaly detection and to achieve compound anomaly diagnosis.The main points of this article are as follows:1.Propose a method for constructing a node relationship graph based on entity spatial relationships.In the thesis,the node relationship graph is divided into graphs for sensors and graphs for actuators based on the modeling approach for distinguishing sensors and actuators.Then,construction algorithms based on entity spatial relationships are proposed for each node relationship graph.The node relationship graphs provide an industrial process conforming to node relationships for the following works.2.Propose a double-model fusion anomaly detection method based on operation laws and control rules.To build the prediction models based on graph neural networks,the method separates sensors and actuators.Based on operation laws and control principles,this thesis designs aggregate functions for the models and then uses the node relationship graphs that was created to provide node adjacency for the models.Finally,a fusion anomaly detection method is designed based on the detection results of the two models.Evaluations reveal that the proposed method not only outperforms the baseline method under classical indicators but also improves the problem of missed detection in existing methods.3.Propose a method for compound anomaly diagnosis based on node relationship graphs.Firstly,the uncertainties in the anomaly detection results are analyzed,and the goal of anomaly diagnosis without abnormal samples is clarified.Then,through the node relationship graph,single-slot compound anomalies can be diagnosed by judging the connectivity of the abnormal nodes.Finally,the compound anomaly diagnosis method for persistent anomalies is proposed.The study cases denote the effectiveness of the proposed method in diagnosing compound anomalies.This research improves the performance of anomaly detection,improves the problem of missed detection,and provides more anomaly information for engineers through compound anomaly diagnosis.All of which are of great significance for manufacturing safety protection in the Industrial Internet scenario. |