1. Introduction

2. Related Work

3. SSGBUL-IKNN Algorithm

3.1. SSGBUL Model

3.1.1. NFPBUL Prediction Model

For a fixed network card of the IIoT gateway, the network flow is sampled according to a specified time cycle according to Equation (1):

(1)

where m is the collection time. The network flow sequence D is divided into a set of flow subsequences $C_d$ with a length of l using sliding window technology, according to Equation (2).

(2)

The label set $C_l$ for the flow subsequence is constructed according to Equation (3).

(3)

The NFPBUL module consists of four parts: (1) the input layer, (2) the CNN layer, (3) the LSTM layer, and (4) the output layer. The input layer contains a set of network flow subsequences and a set of labels. The CNN layer has two parts: double one-dimensional convolutional components (1D-CNN) [15] and one max pooling component. The first convolutional component extracts the features from the input flow subsequence. The second convolutional component performs the extraction again to obtain an enlarged feature. The max pooling component simplifies the feature and uses it as an input to the decoder. These extracted features will be passed on to the LSTM layers to capture the long-term dependencies of the network flow. The LSTM layer consists of a single LSTM [16] component. The periodicity and regularity of the data are extracted through the LSTM [17] layer. The output layer contains two fully connected components. The first fully connected component is used to enhance the nonlinear ability of the LSTM model, and the second fully connected component is used to output the set of predicted values. Figure 2 shows the network structure of the NFPBUL.

The NFPBUL model is trained by the subsequence set $C_d$ and label set $C_l$[18]. The calculation formula for network flow prediction is shown as follows:

(4)

where the function N is the NFPBUL prediction model and $C_p$ is the prediction result set.

3.1.2 Coding Model

According to Equation (2), the input sequence is constructed by using a sliding window on the test dataset according to Equation (5).

(5

The future network flow can be predicted by the NFPBUL network according to Equations (6) and (7).

(6)

(7)

The UCM module encodes the network flow with values of 1, 0, and -1 [19]. When the difference between the prediction value and the actual value is within the threshold ε, the value of the network flow is set to 0. When the difference exceeds the threshold ε, it means that several system faults have occurred, such as illegal access, cyber-attacks, etc., and the value of the network flow is set to 1. When the difference is below the threshold ε, several faults are predicted to occur, such as sensor disconnection, remote I/O module going offline, etc., and of the value of the network flow is set to -1. The calculation function of encoding is expressed in Equation (8):

(8)

where $d_t$ is the actual network flow at time t and $p_t$is the prediction value at time t. The network flow coding sequence can be generated by multiple steps of predicting and encoding according to Equation (9).

(9)

3.1.3. Subsequence Calibration

During the process of predicting and encoding the flow of the sensor network, if there are no abnormal data, the code of the flow of the sensor network flow can be generated correctly. Otherwise, increases in error will occur, resulting in odd coding. To resolve this issue, we propose a subsequence calibration method to adjust anomalous data in a subsequence based on the difference between the actual network flow and the predicted flow based on the threshold ε. The steps of this method are listed as follows:

(1)

Calculate the fixed position flow threshold value in a single data cycle executed on the training dataset using Equation (10). Firstly, calculate the maximum network flow at each selected position. Then, subtract the average network flow to calculate the error value ${\epsilon }_{∆}$

(10)

where $d_{i*l}$ is the flow value at a fixed position within the data cycle.

(2)

Select the maximum threshold value as the whole sequence threshold according to Equation (11):

(11)

where ${\epsilon }_{∆}^l$ is the threshold at a fixed position within the data cycle.

(3)

Calibrate the network flow. Based on the difference between the actual and predicted values with the threshold ε, dynamically adjust the sequence item according to Equation (12). If the absolute difference value is greater than the threshold ε, this indicates that the actual value is abnormal, and the network flow subsequence should be constructed using the predicted value. Otherwise, the network flow subsequence can be built using the real value.

(12)

where $a_t$ is the reconstructed network flow value at time t.

(4)

Obtain the prediction value using the NFPBTSN network model [20] through a newly constructed network flow subsequence [21] based on the calibration function according to Equation (13).

(13)

(5)

Generate the network flow code sequence according to Equation (8).

(6)

Repeat steps 3 to 5 to generate the final code sequence after multiple rounds of prediction and encoding.

3.2. Classification Algorithm

3.2.1. Integrated Module

For different types of sensor flow, their digital characteristics often make it difficult to accurately describe their trends, while encoded features can effectively express their characteristics based on their contextual features, especially whether anomalies occur. We formed multiple network card flow to one-dimensional encoding features can more effectively describe the operation of IIoT. The code sequences of the flow for sensor network [22] can be integrated into one code sequence, indicating the faults covering the entire gateway [23] according to Equations (14) and (15).

(14)

(15)

In Equation (14), S1, S2, S3, S4, S5, S6, S7, and S8 represent the coding sets of the received and sent sequences of each network card. Equation (15) is the state code of a certain point, $s_l$ is the state code of a certain point, l is the sliding window length, and Con is a connection function. Figure 3 shows the integrated diagram [24] of the received and sent code sequences for each network card, such as Eth0, Eth1, PPP0, and VPN0.

3.2.2. Subsequence Type Table

Due to the varying quantity of sensors and remote I/O units connected to the IIoT gateway, it is difficult to define fault sequences according to the network flow for each gateway. Thus, we propose a new way to determine fault sequences using the network flow code to adapt to different gateways [25] in Table 1.

According to the subsequence trend, the integrated code sequence is divided into two types: linear subsequences and nonlinear subsequences. A linear subsequence means that the state values of each part remain relatively stable without any fluctuations. Nonlinear subsequences refer to sequences in which the state values of various parts in an integrated code sequence undergo trend changes, such as when anomalies begin or end. Table 1 shows the subsequence definition for faults based on the integrated code sequence.

3.2.3. IKNN Classification Algorithm

There are two steps for the KNN algorithm to classify unknown samples: (1) Select the k known classification samples closest to the unknown samples to use as neighbors. (2) Classify the unknown samples based on their class labels or numerical outputs. Based on the indicator function, we propose an improved IKNN algorithm to calculate the distance between sequences [26]. The training set based on Table 1 for the KNN algorithm is constructed according to Equation (16):

(16)

where $S_n$is the coding sequence defined in Table 1 and $c_n$ is the category number. Traditional distance calculation methods, such as Euclidean distance and DTW, always face a poor time performance problem when dealing with large classification samples and high-dimensional data. So, a new distance calculation method is proposed in this article based on an indicator function according to Equation (17).

(17)

The distance between the target sequence (TS) and the source sequence (S) in Table 1 is calculated according to Equation (18):

(18)

where ${TS}_{m*l}$is the code value of the sample code sequence, $S_{m*l}$is the code value of the network flow sequence in Table 1, and m is the dimension of the network flow sequence. Based on the given distance metric, the k network flow subsequences closest to the nearest neighbor are identified according to Equation (19):

(19)

where $y_{k}r$epresents the category of traffic subsequences. Based on the majority decision, the final category of the code sequence is determined by the most common category in the neighborhood set according to Equation (20):

(20)

where $y_i$denotes the category of k nearest subsequences and $c_j$denotes the category defined in Table 1.

4. Data Acquisition

4.2. Network Flow Collection Model

Four network cards serving different purposes exist in the IIoT gateway: Eth0, Eth1, PPP0, and VPN0. Eth0 is used to collect sensor information from the remote I/O unit. Before collecting sensor data, other industrial control protocols are converted to the Modbus TCP [33], providing a unified interface for data sampling service. After data collection is complete, the sensor data are transformed to the MQTT[34] protocol format and sent to the cloud server through the PPP0 network card. System administrators can view system data through the VPN0 and Eth1 network cards. Figure 4 shows a diagram of the network cards’ functions in the IIoT gateway.

Figure 4. Function diagram for IIoT gateway network card.

Figure 4. Function diagram for IIoT gateway network card.

5. Experiments and Results

5.1. Experimental Metric

In this paper, we estimate the algorithm’s accuracy by comparing the annotate and predicted sensor network flow sequences according to Equation (21). The annotate flow sequence is obtained by annotating the original subsequence of the sensor network, and the predicted flow sequence is obtained using the SSGBUL-IKNN algorithm.

(21)

where $D_t$is the original data subsequence, function I is the indicator function, Raw is the function that obtains the annotation of the subsequence, and $\mathrm{D}\mathrm{e}\mathrm{t}\mathrm{a}\mathrm{i}\mathrm{l}\_\mathrm{C}\mathrm{l}\mathrm{a}\mathrm{s}\mathrm{s}\mathrm{i}\mathrm{f}\mathrm{i}\mathrm{c}\mathrm{a}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n}$is a function specific to the subsequence classification method.

6. Conclusion

References

1. Huo, R.; Zeng, S.; Wang, Z.; et al. A comprehensive survey on blockchain in industrial internet of things: Motivations, research progresses, and future challenges. IEEE Communications Surveys & Tutorials 2022, 24, 88–122. [Google Scholar]
2. Burke, T. Industrial Ethernet's value for communications. Control Engineering 2022, 69. [Google Scholar]
3. Kannamma, R.; Umadevi, K.S. Neuro-Fuzzy-Based Frame Pre-Emption Using Time-Sensitive Networking for Industrial Ethernet. Journal of Information & Knowledge Management 2021, 20 (supp01). [Google Scholar] [CrossRef]
4. Juma, M.; Monem, A.A.; Shaalan, K. Hybrid End-to-End VPN Security Approach for Smart IoT Objects. Journal of Network and Computer Applications 2020, 158. [Google Scholar] [CrossRef]
5. Bagnall, A.; Lines, J.; Bostrom, A.; et al. The great time series classification bake off: A review and experimental evaluation of recent algorithmic advances. Data Mining and Knowledge Discovery 2017, 31, 606–660. [Google Scholar] [CrossRef] [PubMed]
6. Deng, H.; Runger, G.; Tuv, E.; et al. A time series forest for classification and feature extraction. Information Sciences 2013, 239, 142–153. [Google Scholar] [CrossRef]
7. Lines, J.; Taylor, S.; Bagnall, A. Time series classification with HIVE-COTE: The hierarchical vote collective of transformation-based ensembles. ACM Transactions on Knowledge Discovery from Data 2018, 12. [Google Scholar] [CrossRef]
8. Middlehurst, M.; Large, J.; Bagnall, A. The canonical interval forest (CIF) classifier for time series classification. In Proceedings of the 2020 IEEE International Conference on Big Data. IEEE; 2020. [Google Scholar]
9. Lin, J.; Khade, R.; Li, Y. Rotation-invariant similarity in time series using bag-of-patterns representation. Journal of Intelligent Information Systems 2012, 39, 287–315. [Google Scholar] [CrossRef]
10. Radford, A.T.; Narasimhan, K.; Salimans, T.; et al. Improving language understanding by generative pre-training. 2018. [Google Scholar]
11. He, K.; Fan, H.; Wu, Y.; et al. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition; 2020; pp. 9729–9738. [Google Scholar]
12. Wang, Z.; Yan, W.; Oates, T. Time series classification from scratch with deep neural networks: A strong baseline. In In Proceedings of the 2017 International Joint Conference on Neural Networks; IEEE, 2017; pp. 1578–1585. [Google Scholar]
13. Fawaz, H.I.; Forestier, G.; Weber, J.; et al. Deep learning for time series classification: A review. Data Mining and Knowledge Discovery 2019, 33, 917–963. [Google Scholar] [CrossRef]
14. Zhi, C.; Yuyu, S.; Xing, S.; et al. A traffic data interpolation method for IoT sensors based on spatio-temporal dependence. Internet of Things 2023, 21. [Google Scholar] [CrossRef]
15. DA, B.; Yannis, S.; Barbara, V.; et al. Intraclass Clustering-Based CNN Approach for Detection of Malignant Melanoma. Sensors 2023, 23. [Google Scholar] [CrossRef]
16. Shahzad, Z.; Nadeem, A.; Saddam, H.; et al. A Multi Parameter Forecasting for Stock Time Series Data Using LSTM and Deep Learning Model. Mathematics 2023, 11, 590. [Google Scholar] [CrossRef]
17. Saharkhizan, M.; Azmoodeh, A.; Dehghantanha, A.; et al. An ensemble of deep recurrent neural networks for detecting IoT cyber attacks using network traffic. IEEE Internet of Things Journal 2020, 7, 8852–8859. [Google Scholar] [CrossRef]
18. Xiangwei, C.; Wenwen, Z.; Adrian, W.; et al. Stacked ResNet-LSTM and CORAL model for multi-site air quality prediction. Neural Computing and Applications 2022, 34. [Google Scholar]
19. Alaghbari, A.K.; Lim, S.H.; Saad, M.H.M.; et al. Deep Autoencoder-Based Integrated Model for Anomaly Detection and Efficient Feature Extraction in IoT Networks. IoT 2023, 4. [Google Scholar] [CrossRef]
20. Kumar, B.P.; Hariharan, K.; Shanmugam, R.; Shriram, S.; Sridhar, J. Enabling internet of things in road traffic forecasting with deep learning models. Journal of Intelligent & Fuzzy Systems 2022, 43. [Google Scholar]
21. Zhao, N.; Sun, H.; Li, Q.; et al. Time series prediction model mWDLNet based on wavelet decomposition and its application research. Small scale microcomputer system 2022, 43, 561–567. [Google Scholar] [CrossRef]
22. Zhao, J.; Li, J.; Long, C. Unsupervised detection method for RoQ covert attacks based on multi-level features. Journal of Communications 2022, 43, 224–239. Duan, X.; Fu, Y.; Wang, K. Multidimensional time series anomaly detection method based on VAE-WGAN. Journal of Communications 2022, 43, 1–13. [Google Scholar]
23. Jingyi, R.; Huijuan, H.; Wenyue, X. Big data intelligent tourism management platform design based on abnormal behavior identification. Intelligent Systems with Applications 2024, 21200312. [Google Scholar]
24. Huang, J.; Xu, X.; Cui, X.; et al. A Time Series Symbolic Aggregation Approximation Method for Fusion of Trend Information. Computer Application Research 2023, 40, 86–90. [Google Scholar] [CrossRef]
25. Lu, Y.; Wang, P.; Wang, W. Time series semantic mining algorithm based on subsequence similarity. Computer Engineering 2022, 48, 88–94. [Google Scholar]
26. Mahsa, H.; Abbas, M.; Reza, G. Stacking: A novel data-driven ensemble machine learning strategy for prediction and mapping of Pb-Zn prospectivity in Varcheh district, west Iran. Expert Systems with Applications 2024, 237(PC).
27. Pino, S.F.A.; Ruiz, H.P.; Mon, A.; et al. Systematic literature review on mechanisms to measure the technological maturity of the Internet of Things in enterprises. Internet of Things 2024, 25101082. [Google Scholar] [CrossRef]
28. Anonymous. I/O Module Enables Remote Data Capture. NASA Tech Briefs 2021, 45, 49–49. [Google Scholar]
29. Banner Engineering Corp; Patent Issued for Modbus System Having Actual And Virtual Slave Addresses And Slave Sensors (USPTO 10,805,262). Computers Networks Communications 2020, 4905.
30. Jacek, S.; AnneLena, K.; Rafał, C.; et al. Industrial Shared Wireless Communication Systems—Use Case of Autonomous Guided Vehicles with Collaborative Robot. Sensors 2022, 23, 158–158. [Google Scholar] [CrossRef] [PubMed]
31. Gateway for IoT integration in PROFIBUS HART systems with extended functionalities. M2 Presswire, 2023.
32. Yun-Hai, C.; Dong-Ying, Z.; Jun, J. Design of PROFINET I/O Real-time Communication System between PLC Based on S7-1200. Journal of Physics: Conference Series 2023, 2569. [Google Scholar]
33. Tiago, M.; Garcia, V.S.O. Enhanced Modbus/TCP Security Protocol: Authentication and Authorization Functions Supported. Sensors 2022, 22, 8024–8024. [Google Scholar] [CrossRef] [PubMed]
34. Hojjati, H.; Ho, T.K.K.; Armanfard, N. Self-supervised anomaly detection in computer vision and beyond: A survey and outlook. Neural Networks 2024, 172106106. [Google Scholar] [CrossRef] [PubMed]
35. Anna, C.; TaeYoung, K.; Kyung, C.K.; et al. IoT data dissemination scheme for reducing delay in multi-broker environments. Internet of Things 2024, 25101025. [Google Scholar]
36. Aurore, C.; Théo, T.; Eric, T. PhylteR: efficient identification of outlier sequences in phylogenomic datasets. Molecular biology and evolution 2023. [Google Scholar]