To solve the problem that attacks had similar characteristics like faults in physical data,this paper proposed a dis-crimination method,with cross-domain causal diagram,between attacks and faults for FCC fractionation system.Firstly,the process of cross-domain causal graph construction integrated data-driven method and topological knowledge method,covering the physical layer and information layer.Secondly,combined with the multi-source anomaly evidence,this paper presented a causal path search method based on Floyd algorithm to obtain the causal paths between abnormal nodes.Finally it obtained the minimum fork tree of the anomaly propagation path according to the dominators constraint,the single point anomaly constraint,the maximum number constraint of dominators,along with the occurrence time of abnormal nodes.This method determined the root cause of anomaly according to the position of the root node.The test on a simulated FCC fractionation system validated the effectiveness of the proposed method.The results show that the identification accuracy of this method is 94.84％,and the recall rates of normal,fault and attack conditions are 97.11％,93.25％and 95.30％.Compared with similar schemes,this method not only solves the identification problems caused by similar features,but also provides the abnormal propagation path and pro-vides alarm information for security protection while ensuring high identification accuracy.
维普
万方数据