PLC variable incidence relation analysis method and device based on weight calculation and electronic equipment

Abstract

The invention discloses a PLC variable association relationship analysis method and device based on weight calculation and electronic equipment. The method comprises the following steps: constructing a program dependency graph representing a PLC variable dependency relationship; according to the program dependency graph, quantifying association strength between PLC variables, and calculating to obtain a dependency edge weight; according to the dependency edge weight, calculating an association relationship score between the PLC variables, and identifying to obtain the association relationship score between the PLC variables; and determining potential attack point risk information of the industrial control system according to the identified association score, and guiding a defense system to discover an intrusion point or a fault source. According to the embodiment of the invention, the strong association relationship before the variable can be comprehensively and reliably identified; in addition, direct dependence between variables can be accurately recognized, indirect influence relations are captured, and the method can be widely applied to the technical field of computers.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and electronic equipment for analyzing PLC variable association relationships based on weight calculation. Background Art

[0002] A programmable logic controller (PLC) is a computing device designed for industrial automation, used to monitor and control manufacturing processes and machinery. The core functionality of a PLC is implemented using a control logic language, which defines the rules that run within the PLC. Although several PLC manufacturers, such as Siemens and Schneider, define control logic codes with varying syntax, these types of control logic code must conform to the IEC 61131-3 standard. PLC control logic code formats include Ladder Diagram (LD), Structured Text (ST), Function Block Diagram (FBD), Instruction List (IL), and Sequential Function Chart (SFC). Despite their differing presentation formats, these control logic code types all achieve the same control logic intent. Compared to the other four control logic languages, ST code offers advantages in readability and flexibility, making it suitable for programming complex control algorithms.

[0003] PLC code execution follows a cyclical operation pattern, commonly referred to as a cyclic scan. This cyclic scan process consists of three main phases: updating the input image, executing control logic code, and writing to the output image. Specifically, the PLC first reads the status of sensor variables, such as temperature, pressure, or switch position, from the input image. By mapping external input signals to the input image, the PLC obtains the latest environmental data at the beginning of each cycle. Next, the PLC executes pre-programmed control logic code, performing complex calculations and decision-making based on the input sensor data and program logic. This includes logical operations on variable states, conditional branching, and the generation of actuator instructions. Finally, the PLC writes the results of these operations to the output image. The signals stored in the output image are then transmitted to actuators, such as motors and valves, to drive equipment or update system status. Furthermore, executing other tasks refers to the PLC's operating system (runtime, etc.), such as downloading and deleting blocks and receiving and sending data. Finally, the cyclic scan restarts, repeating the above steps.

[0004] PLC variables are responsible for receiving sensor data, sending actuator data, and storing intermediate variables in industrial control systems (ICS). Attackers can exploit these interconnected relationships and PLC security vulnerabilities to hijack variables and launch ICS attacks. Therefore, uncovering the relationships between PLC variables is extremely valuable. It not only helps attackers identify potential attack points but also guides ICS defense systems in identifying intrusion points or fault sources.

[0005] Currently, a large number of studies have been devoted to exploring the correlations between PLC variables. These works can be mainly divided into two categories: causal analysis based on SCADA (Supervisory Control and Data Acquisition) logs and analysis methods based on PLC code. SCADA log-based causal analysis methods mainly use machine learning or deep learning techniques to perform causal relationship mining on log data collected by the SCADA system to reveal the correlations between PLC variables. These methods generally rely on the statistical properties of historical data and can automatically extract potential relationships between variables from massive time series data, with a high degree of automation and adaptability. For example, Abreu et al. proposed a method for identifying causal relationships between industrial alarm variables using the K2 algorithm of transfer entropy and Bayesian networks. This method simplifies the modeling of correlations between alarm variables and improves the efficiency and accuracy of causal analysis.

[0006] Another line of research focuses on PLC code analysis, identifying the interactions between PLC variables by constructing code dependency graphs and combining them with static analysis methods. Zhang et al. proposed using static program analysis of PLC and robot code to extract event causal relationships and generate a timed event causal graph (TECG) to describe the causal dependencies between PLC variables. This method considers factors such as control flow, constants, and event durations, effectively reducing the event sequence search space.

[0007] The existing PLC variable association analysis methods have the following shortcomings:

[0008] (1) Lack of consideration of the dynamic characteristics of the code

[0009] PLC code analysis methods only utilize the static characteristics of the code and fail to consider the dynamic behavior of the code at runtime, resulting in analysis results that may lack completeness and dynamic adaptability. For example, in the PLC code, variables A and B form a dependency relationship, but during actual ICS operation, the conditions that constitute the dependency relationship between variables A and B are never executed. For example, variable A reads sensor data, but this sensor never reads external signals during ICS operation. Current PLC variable association methods will still consider this as a valid relationship, but this fails to identify more comprehensive and in-depth influence relationships between variables. In addition, static analysis struggles to reflect the impact of external inputs or environmental changes on variable relationships during runtime, such as dynamic behavior changes caused by sensor data fluctuations or network latency.

[0010] (2) The mined variable dependencies are not comprehensive

[0011] Causal analysis of SCADA logs utilizes machine learning or deep learning techniques to mine causal relationships in log data collected by SCADA systems, revealing the correlations between PLC variables. However, this analysis method relies solely on the statistical characteristics of log data and fails to fully reflect the true dependencies between variables. Furthermore, these studies primarily focus on analyzing correlations between sensor variables.

[0012] (3) Lack of quantitative analysis of the relationship between variables

[0013] Existing PLC variable relationship analysis methods lack quantitative analysis of inter-variable relationships, making it impossible to accurately reflect the relative importance and impact of variables through correlation scores. For example, causal analysis methods based on SCADA logs typically only output causal relationships between variables without providing a quantitative correlation score to indicate the strength or priority of the relationship. Similarly, static analysis methods based on PLC code only identify dependencies between variables and fail to assign numerical scores to the strength of the correlation between each pair of variables. Summary of the Invention

[0014] The main purpose of the embodiments of the present invention is to provide an accurate and effective PLC variable association relationship analysis method, device and electronic device based on weight calculation.

[0015] To achieve the above objectives, an embodiment of the present invention provides a method for analyzing PLC variable association relationships based on weight calculation, comprising the following steps:

[0016] Construct a program dependency graph that represents the dependency relationship of PLC variables;

[0017] According to the program dependency graph, the association strength between PLC variables is quantified, and the dependency edge weight is calculated;

[0018] Calculating the correlation scores between the PLC variables according to the dependency edge weights, and identifying the correlation scores between the various PLC variables;

[0019] Based on the identified correlation scores, risk information of potential attack points of the industrial control system is determined to guide the defense system to discover intrusion points or fault sources.

[0020] In some embodiments, constructing a program dependency graph representing PLC variable dependencies comprises the following steps:

[0021] Parse the intermediate representation information of the PLC code and construct the abstract syntax tree AST;

[0022] According to the abstract syntax tree AST, a program dependency graph representing the dependency relationship of PLC variables is constructed.

[0023] In some embodiments, constructing a program dependency graph representing PLC variable dependencies based on the abstract syntax tree AST includes the following steps:

[0024] S1. Initialize an empty data dependency graph DFG and control dependency graph CFG, and proceed to step S2;

[0025] S2. Input the abstract syntax tree AST obtained by parsing the PLC code and proceed to step S3.

[0026] S3. Dequeue the first token of the abstract syntax tree AST and assign it to first_node, and proceed to step S4.

[0027] S4, determine whether the current abstract syntax tree AST is an empty queue, if so, go to step S14; otherwise, go to step S5;

[0028] S5, set the value of count to 0, and go to step S6;

[0029] S6. Assign the value of the count-th token in the abstract syntax tree AST to sec_node, and proceed to step S7.

[0030] S7. Set (first_node, sec_node) to a variable pair, and proceed to step S8.

[0031] S8. Determine whether the variable pair forms a data dependency relationship. If so, proceed to step S9; otherwise, proceed to step S10. When the value of sec_node is determined by first_node, a data dependency relationship is formed.

[0032] S9, put the variable pair into the data dependency graph DFG, and go to step S12;

[0033] S10. Determine whether the variable pair forms a control dependency relationship. If so, proceed to step S11; otherwise, proceed to step S12. Wherein, when the parent node of first_node and sec_node is a node of the control flow statement type, a control dependency relationship is formed.

[0034] S11, put the variable pair into the control dependency graph CFG, and go to step S12;

[0035] S12, the value of count is automatically increased by 1, and the process goes to step S13;

[0036] S13. Determine whether the value of count is equal to the number of tokens in the abstract syntax tree AST. If so, proceed to step S3; otherwise, proceed to step S6.

[0037] S14. Combine the data dependency graph DFG and the control dependency graph CFG to obtain PDG=(CFG, DFG), and construct a program dependency graph that represents the dependency relationship of PLC variables.

[0038] In some embodiments, quantifying the association strength between PLC variables according to the program dependency graph and calculating the dependency edge weights includes the following steps:

[0039] The time series changes of variables are obtained through SCADA logs, and then the correlation and uncertainty between variables are calculated to assign weights to the dependency edges in the program dependency graph. The dependency weights in the program dependency graph PDG are expressed as To represent the dependency edge The defined dependencies.

[0040] In some embodiments, obtaining the temporal changes of variables through SCADA logs, and then calculating the correlation and uncertainty between the variables to assign weights to dependency edges in the program dependency graph, includes the following steps:

[0041] Calculating dependency edges The conditional entropy H(V TARGET |V SOURCE ):

[0042]

[0043] Among them, the conditional entropy H(V TARGET |V SOURCE ) indicates that when the source variable V is known SOURCE Under the condition of TARGET The entropy of the conditional probability distribution of V SOURCE The mathematical expectation of p i=P(V SOURCE =v source_i ), which means that in the SCADA log, the sensor variable or actuator variable is used as the source variable v source_i The probability distribution when ;

[0044] Using mutual information to identify dependency edges Weight Define it as:

[0045]

[0046] Among them, V TARGET is the target variable v in the SCADA log target_k The probability distribution of V SOURCE Is the source variable v in the SCADA log source_j The probability distribution of

[0047] Using cross mutual information to calculate dependencies at different time delays for:

[0048]

[0049] In the formula, τ represents the value of delay, Indicates that after the delay, the target variable v target_k distribution.

[0050] In some embodiments, calculating the association scores between PLC variables based on the dependency edge weights and identifying the association scores between the respective PLC variables comprises the following steps:

[0051] Define the calculation of the association score score(v i ,v j ) formula:

[0052]

[0053] in, It represents the score of calculating the association relationship of PLC variables, and k represents the variable v i v j The kth reachable path, n represents the sum of the reachable paths; It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays;

[0054] A weighted adjacency matrix W is constructed using the dependency edges and their weights in the program dependency graph, where W[v i ][v j ] indicates that the variable node v i To variable node v jThe weight of the edge; if the variable node v i To variable node v j Does not constitute a dependency relationship, then W[v i ][v j ]=0; construct the variable weighted adjacency matrix as:

[0055]

[0056] in, It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays;

[0057] Calculate the total weight M of the dependency path:

[0058] M=(IW) -1

[0059] Where I is the identity matrix, M[v i ][v j ] indicates that the variable node v i To variable node v j The sum of the weights of all paths reflects the variable node v i To variable node v j Total related relationships;

[0060] Set an association threshold, and determine the strength of the association relationship of the PLC variables based on the association threshold. The specific formula is:

[0061]

[0062] Among them, relationship represents the association relationship between PLC variables.

[0063] Another aspect of the present invention provides a PLC variable association relationship analysis device based on weight calculation, comprising:

[0064] The first module is used to construct a program dependency graph that represents the dependency relationship of PLC variables;

[0065] The second module is used to quantify the association strength between PLC variables according to the program dependency graph and calculate the dependency edge weight;

[0066] The third module is used to calculate the correlation scores between the PLC variables according to the dependency edge weights, and identify the correlation scores between the various PLC variables;

[0067] The fourth module is used to determine the risk information of potential attack points of the industrial control system based on the identified association relationship scores, and guide the defense system to discover intrusion points or fault sources.

[0068] To achieve the above object, another aspect of an embodiment of the present invention provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above method when executing the computer program.

[0069] To achieve the above object, another aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0070] The present invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the above method.

[0071] The embodiments of the present invention include at least the following beneficial effects: The present invention provides a method, device, and electronic device for analyzing PLC variable association relationships based on weight calculation. The solution constructs a program dependency graph that characterizes the dependencies of PLC variables; based on the program dependency graph, quantifies the association strength between PLC variables and calculates dependency edge weights; based on the dependency edge weights, calculates the association scores between PLC variables and identifies the association scores between each PLC variable; based on the identified association scores, determines the risk information of potential attack points of the industrial control system and guides the defense system to discover intrusion points or fault sources. The embodiments of the present invention integrate the static characteristics of PLC code and the dynamic characteristics of code runtime in SCADA logs. By calculating the association scores between variables, the association relationships between variables are quantified, and the strong association relationships between variables can be comprehensively and reliably identified; in addition, the embodiments of the present invention construct a program dependency graph with dependency edge weight information, generates an abstract syntax tree by parsing the PLC code, and assigns weight information to the dependency edges in combination with the time series data of the SCADA log, accurately identifying direct dependencies between variables and capturing indirect influence relationships. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0073] Figure 2 It is a flowchart of the overall steps provided by an embodiment of the present invention;

[0074] Figure 3 This is a diagram of specific implementation steps provided by an embodiment of the present invention;

[0075] Figure 4This is a schematic diagram of the process of constructing a dependency graph provided by an embodiment of the present invention;

[0076] Figure 5 It is a schematic diagram of the hardware structure of the electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0077] In order to make the objects, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present invention. They are merely examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the appended claims.

[0078] It will be understood that the terms "first," "second," "third," "fourth," and the like (if any) in the description of the present invention and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It will be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in orders other than those illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0079] It should be understood that in the present invention, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can represent: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0080] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention pertains. The terms used herein are for the purpose of describing embodiments of the present invention only and are not intended to limit the present invention.

[0081] The PLC variable association relationship analysis method, device and electronic device provided by the embodiment of the present invention based on weight calculation relate to the field of computer technology. The PLC variable association relationship analysis method based on weight calculation provided by the embodiment of the present invention can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or as a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the PLC variable association relationship analysis method based on weight calculation, etc., but is not limited to the above forms.

[0082] The present invention can be used in a wide variety of general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0083] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 , the implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to the network in a wireless or wired manner to complete data transmission and exchange.

[0084] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0085] In addition, server 101 can also be a node server in a blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0086] Terminal 102 may be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, etc. Terminal 102 may also be a vehicle-mounted terminal of the various device types described above, but is not limited thereto. Terminal 102 and server 101 may be connected directly or indirectly via wired or wireless communication, which is not limited in this embodiment of the present invention.

[0087] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a PLC variable association relationship analysis method based on weight calculation. The following is explained using the example of applying the PLC variable association relationship analysis method based on weight calculation in the server 101. It can be understood that the method can also be applied to the terminal 102.

[0088] Reference Figure 2 , Figure 2 The flowchart of the method for analyzing the association relationship of PLC variables based on weight calculation applied to the server provided by the embodiment of the present invention, the execution subject of the method can be any of the aforementioned computer devices (including servers or terminals). Figure 2 , the method may include the following steps:

[0089] Construct a program dependency graph that represents the dependency relationship of PLC variables;

[0090] According to the program dependency graph, the association strength between PLC variables is quantified, and the dependency edge weight is calculated;

[0091] Calculating the correlation scores between the PLC variables according to the dependency edge weights, and identifying the correlation scores between the various PLC variables;

[0092] Based on the identified correlation scores, risk information of potential attack points of the industrial control system is determined to guide the defense system to discover intrusion points or fault sources.

[0093] In some embodiments, constructing a program dependency graph representing PLC variable dependencies comprises the following steps:

[0094] Parse the intermediate representation information of the PLC code and construct the abstract syntax tree AST;

[0095] According to the abstract syntax tree AST, a program dependency graph representing the dependency relationship of PLC variables is constructed.

[0096] In some embodiments, constructing a program dependency graph representing PLC variable dependencies based on the abstract syntax tree AST includes the following steps:

[0097] S1. Initialize an empty data dependency graph DFG and control dependency graph CFG, and proceed to step S2;

[0098] S2. Input the abstract syntax tree AST obtained by parsing the PLC code and proceed to step S3.

[0099] S3. Dequeue the first token of the abstract syntax tree AST and assign it to first_node, and proceed to step S4.

[0100] S4, determine whether the current abstract syntax tree AST is an empty queue, if so, go to step S14; otherwise, go to step S5;

[0101] S5, set the value of count to 0, and go to step S6;

[0102] S6. Assign the value of the count-th token in the abstract syntax tree AST to sec_node, and proceed to step S7.

[0103] S7. Set (first_node, sec_node) to a variable pair, and proceed to step S8.

[0104] S8. Determine whether the variable pair forms a data dependency relationship. If so, proceed to step S9; otherwise, proceed to step S10. When the value of sec_node is determined by first_node, a data dependency relationship is formed.

[0105] S9, put the variable pair into the data dependency graph DFG, and go to step S12;

[0106] S10. Determine whether the variable pair forms a control dependency relationship. If so, proceed to step S11; otherwise, proceed to step S12. Wherein, when the parent node of first_node and sec_node is a node of the control flow statement type, a control dependency relationship is formed.

[0107] S11, put the variable pair into the control dependency graph CFG, and go to step S12;

[0108] S12, the value of count is automatically increased by 1, and the process goes to step S13;

[0109] S13. Determine whether the value of count is equal to the number of tokens in the abstract syntax tree AST. If so, proceed to step S3; otherwise, proceed to step S6.

[0110] S14. Combine the data dependency graph DFG and the control dependency graph CFG to obtain PDG=(CFG, DFG), and construct a program dependency graph that represents the dependency relationship of PLC variables.

[0111] In some embodiments, quantifying the association strength between PLC variables according to the program dependency graph and calculating the dependency edge weights includes the following steps:

[0112] The time series changes of variables are obtained through SCADA logs, and then the correlation and uncertainty between variables are calculated to assign weights to the dependency edges in the program dependency graph. The dependency weights in the program dependency graph PDG are expressed as To represent the dependency edge The defined dependencies.

[0113] In some embodiments, obtaining the temporal changes of variables through SCADA logs, and then calculating the correlation and uncertainty between the variables to assign weights to dependency edges in the program dependency graph, includes the following steps:

[0114] Calculating dependency edges The conditional entropy H(V TARGET |V SOURCE ):

[0115]

[0116] Among them, the conditional entropy H(V TARGET |V SOURCE ) indicates that when the source variable V is known SOURCE Under the condition of TARGET The entropy of the conditional probability distribution of V SOURCE The mathematical expectation of p i =P(V SOURCE =v source_i ), which means that in the SCADA log, the sensor variable or actuator variable is used as the source variable v source_i The probability distribution when ;

[0117] Using mutual information to identify dependency edges Weight Define it as:

[0118]

[0119] Among them, V TARGET is the target variable v in the SCADA log target_k The probability distribution of V SOURCE Is the source variable v in the SCADA log source_j The probability distribution of

[0120] Using cross mutual information to calculate dependencies at different time delays for:

[0121]

[0122] In the formula, τ represents the value of delay, Indicates that after the delay, the target variable v target_k distribution.

[0123] In some embodiments, calculating the association scores between PLC variables based on the dependency edge weights and identifying the association scores between the respective PLC variables comprises the following steps:

[0124] Define the calculation of the association score score(v i ,v j ) formula:

[0125]

[0126] in, It represents the score of calculating the association relationship of PLC variables, and k represents the variable v i v j The kth reachable path, n represents the sum of the reachable paths; It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays;

[0127] A weighted adjacency matrix W is constructed using the dependency edges and their weights in the program dependency graph, where W[v i ][v j ] indicates that the variable node v i To variable node v j The weight of the edge; if the variable node v i To variable node v j Does not constitute a dependency relationship, then W[v i ][v j ]=0; construct the variable weighted adjacency matrix as:

[0128]

[0129] in, It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays;

[0130] Calculate the total weight M of the dependency path:

[0131] M=(IW) -1

[0132] Where I is the identity matrix, M[v i ][v j ] indicates that the variable node v i To variable node v j The sum of the weights of all paths reflects the variable node v i To variable node v j Total related relationships;

[0133] Set an association threshold, and determine the strength of the association relationship of the PLC variables based on the association threshold. The specific formula is:

[0134]

[0135] Among them, relationship represents the association relationship between PLC variables.

[0136] The specific implementation process of the method provided by the embodiment of the present invention is described in detail below with reference to the accompanying drawings:

[0137] In related technologies, the main reasons for the current technical defects include: (1) The PLC variable association relationship includes the static and dynamic characteristics of the code. Existing methods only focus on the static structural characteristics of the code or the statistical characteristics of the log, and lack a comprehensive analysis combining static dependencies and dynamic behaviors, resulting in the inability to accurately capture the true association relationship between variables. (2) The dependencies between PLC variables include not only direct dependencies but also indirect dependencies. Existing methods usually only identify direct dependencies and ignore indirect dependencies formed through intermediate variables. In addition, there is a lack of a scoring mechanism to quantify the strength of indirect dependencies, which limits the comprehensiveness and accuracy of variable relationship analysis.

[0138] The association relationship of PLC variables can not only help attackers find potential attack points, but also guide ICS defense systems to find intrusion points or fault sources. In addition, by integrating these association relationships into the PLC honeypot design, a real ICS environment can be simulated to induce attackers to expose their intentions and methods. Therefore, the present invention not only utilizes the static characteristics of PLC code, but also combines SCADA logs to capture the dynamic characteristics of the code during runtime, thereby more accurately and comprehensively identifying the association relationships between PLC variables. The specific process of the present invention is to first parse the PLC into an abstract syntax tree (AST), and add dependency edges that constitute dependency relationships on the AST to construct a program dependency graph (PDG); then, through the time series data in the SCADA log, use mutual information to calculate the weights of the data dependency edges and control dependency edges in the PDG; finally, construct a weighted adjacency matrix of variable weights, calculate the total weight of the dependency path, and use the association score formula to identify the association relationships between variables. The present invention accurately and comprehensively identifies the association relationships between PLC variables, accurately identifies the direct dependencies between variables, and captures indirect influence relationships, which has obvious advantages over existing research.

[0139] Therefore, the present invention is directed to solving the following problems:

[0140] (1) Constructing a program dependency graph. A program dependency graph reflects the data dependencies and control dependencies between various code snippets in a program. To construct the program dependency graph, the PLC code needs to be parsed into an AST. Then, the AST is traversed to construct variable pairs. Data dependency edges or control dependency edges are added to the variable pairs that form the dependency relationship.

[0141] (2) Calculate dependency edge weights. Dependency edges in the program dependency graph have weight information. In addition, SCADA logs record the time series changes of variables. This time series data can be analyzed to calculate the correlation and uncertainty between variables, thereby assigning weights to the dependency edges in the PDG.

[0142] (3) Calculate the correlation scores between variables. By constructing a weighted adjacency matrix of variable weights, calculating the total weight of the dependency path, and using the correlation score formula to determine the correlation strength between variables, the correlation between all variables can be effectively identified.

[0143] Specifically, the present invention integrates the static characteristics of the code and the dynamic characteristics of the runtime. By combining the program dependency graph and SCADA log data, the mutual information is used to assign weight information to the dependency edge, and the weighted adjacency matrix of the variable weights is used to calculate the total weight of the dependency path. Finally, the correlation score formula is used to judge the correlation strength between variables, thereby identifying the correlation relationship between variables. Figure 3 As shown in the figure, it specifically includes three main processes: (1) constructing a program dependency graph to construct a program dependency graph that represents the variable dependency relationship; (2) calculating the dependency edge weight to quantify the association strength between variables; (3) calculating the association relationship score between variables to identify the association relationship between variables.

[0144] The following is a detailed description of each step:

[0145] 1. Constructing a program dependency graph

[0146] Constructing a program dependency graph requires parsing the PLC code into an AST, then traversing the AST to construct variable pairs, and adding data dependency edges or control dependency edges to the variable pairs that constitute the dependency relationship.

[0147] (1) Parsing AST

[0148] AST is an intermediate representation of programming code during the compilation process, usually composed of some tokens. These tokens are combined in a tree structure according to a certain connection method. This tree is called an abstract syntax tree (AST). In this structure, each node represents a construct in the program, such as an expression, statement, or declaration. In this invention, a tool called Parsing Expression Grammar (PEG) is used to parse PLC code into AST. On these ASTs, each token is a two-tuple.<type,value> .

[0149] (2) Dependency graph construction process

[0150] Before constructing the program dependency graph, it is represented here as G(V,E), where:

[0151] aV=(VV SOURCE ,V TARGET ) consists of a source variable node set and a target variable node set, representing all source variables and target variables in the PLC code.

[0152] b. Is a connection source variable node v source To the target variable node v target The directed edge set represents the dependency relationship from the target variable to the source variable in the PLC code, that is, the target variable depends on the source variable.

[0153] The dependency edges here include control dependency edges and data dependency edges. Figure 4 The process of constructing a dependency graph.

[0154] The specific process of constructing a program dependency graph is as follows:

[0155] 1. Initialize an empty data dependency graph DFG and control dependency graph CFG and proceed to step 2;

[0156] 2. Input the AST obtained by parsing the PLC code and go to step 3;

[0157] 3. Dequeue the first token of AST and assign it to first_node, and go to step 4;

[0158] 4. Determine whether the current AST is an empty queue. If so, proceed to step 14; otherwise, proceed to step 5;

[0159] 5. Set the value of count to 0 and go to step 6;

[0160] 6. Assign the value of the countth token in the AST to sec_node and go to step 7;

[0161] 7. Set (first_node, sec_node) to the variable pair pair, that is, pair = (first_node, sec_node), and go to step 8;

[0162] 8. Determine whether the variable pair forms a data dependency relationship. Here, when the value of sec_node is determined by first_node, for example, when their parent node is the Assign node, then a data dependency relationship is formed. If so, proceed to step 9; otherwise, proceed to step 10.

[0163] 9. Place the variable pair into the data dependency graph DFG and proceed to step 12;

[0164] 10. Determine whether the variable pair forms a control dependency relationship. Here, if the parent node of first_node and sec_node is a control flow statement type node, such as if, for, while, etc., then a control dependency relationship exists. If so, proceed to step 11; otherwise, proceed to step 12.

[0165] 11. Place the variable pair into the control dependency graph CFG and proceed to step 12;

[0166] 12. The value of count automatically increases by 1, and the process goes to step 13;

[0167] 13. Determine whether the value of count is equal to the number of tokens in AST. If so, go to step 3; otherwise, go to step 6;

[0168] 14. Combine CFG and DFG to obtain PDG = (CFG, DFG), and go to step 15;

[0169] 15. Return PDG and go to step 16;

[0170] 16. End.

[0171] 2. Calculate the weight of dependent edges

[0172] SCADA logs record the time series changes of variables. The changes of these time series data can be analyzed to calculate the correlation and uncertainty between variables, thereby assigning weights to the dependency edges in PDG. It reflects the dependency edge The defined dependencies.

[0173] For dependency edges The conditional entropy H(V TARGET |V SOURCE ) indicates that when the source variable V is known SOURCE Under the condition of TARGET The entropy of the conditional probability distribution of V SOURCE The mathematical expectation of:

[0174]

[0175] Where p i =P(V SOURCE =v source_i ), i=1,2,…,n. It means that in the SCADA log, the sensor variable or actuator variable is used as the source variable v source_i The probability distribution when .

[0176] Mutual Information (MI) is further used to identify the dependency edges. Weight Therefore, the weight of the dependent edge Defined as:

[0177]

[0178] Where V TARGET is the target variable v in the SCADA log target_k The probability distribution of V SOURCE Is the source variable v in the SCADA log Source_j The probability distribution of .

[0179] At the same time, the timing effect needs to be taken into account because there may be time delays between SCADA variables. Therefore, the method of calculating dependency weights can be further improved, that is, using cross mutual information to calculate the dependency relationship under different time delays:

[0180]

[0181] In the formula, τ represents the value of delay, Indicates that after the delay, the target variable v target_k distribution.

[0182] Using time series data from SCADA logs, we use mutual information to define and calculate weights for data dependency edges and control dependency edges in the PDG. These weights quantify the strength of variable dependencies.

[0183] 3. Calculate the correlation score between variables

[0184] The method of calculating the sum of dependency weights can be used to calculate the correlation scores between variables, and ultimately effectively mine the correlations between all variables. Before calculating the correlation scores, define the formula for calculating the correlation scores:

[0185]

[0186] Where, It represents the score of calculating the association relationship of PLC variables, and k represents the variable v i v j The kth reachable path of n is represented by n, and n represents the sum of the reachable paths.

[0187] (1) Constructing a weighted adjacency matrix of variable weights

[0188] A weighted adjacency matrix W is constructed using the dependency edges and their weights in the program dependency graph, where W[v i ][v j ] indicates that the variable node v i To variable node v j If the variable node v i To variable node v j Does not constitute a dependency relationship, then W[v i ][v j ]=0. Therefore, the variable weighted adjacency matrix is ​​constructed as:

[0189]

[0190] Where, It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays.

[0191] (2) Calculate the total weight of the dependent path

[0192] variable node v i To variable node v j There may be one or more dependency paths. If there are multiple dependency paths, the total weight of all dependency paths needs to be calculated. The dependency weight of the variable and M are calculated as follows:

[0193] M=(IW) -1

[0194] Where I is the identity matrix, M[v i ][v j ] indicates that the variable node v i To variable node v j The sum of the weights of all paths reflects the variable node v i To variable node v j The total correlation relationship.

[0195] (3) Set the association threshold

[0196] A certain correlation threshold coefficient is set to further illustrate the strength of the correlation between PLC variables. The correlation score formula for judging the correlation between PLC variables is:

[0197]

[0198] In the formula, if the total path weight is greater than the association threshold coefficient threshold, the present invention sets this association as a strong association; otherwise, it is set as a weak association.

[0199] In summary, existing variable correlation analysis schemes only utilize the static characteristics of code or the statistical characteristics of log data, resulting in limitations such as a lack of consideration of the dynamic characteristics of code, incomplete mining of variable dependencies, and a lack of quantitative analysis of the correlation between variables. This invention constructs a program dependency graph with weight information for dependency edges, uses a weighted adjacency matrix of variable weights to calculate the total weight of dependency paths, and uses a correlation score formula to identify the correlation between variables, accurately and comprehensively identifying the correlation between PLC variables.

[0200] The present invention can produce the following benefits:

[0201] 1. This method combines the static characteristics of PLC code with the dynamic characteristics of code runtime in SCADA logs. By calculating the correlation scores between variables, it quantifies the correlation between variables and can comprehensively and reliably identify strong correlations between variables, which has significant advantages over existing solutions.

[0202] 2. A program dependency graph with weighted dependency edges was constructed. By parsing the PLC code to generate an abstract syntax tree, the dependency edges were assigned weights based on the time series data of the SCADA log. This accurately identified the direct dependencies between variables and captured the indirect influence relationships.

[0203] Another aspect of the present invention provides a PLC variable association relationship analysis device based on weight calculation, comprising:

[0204] The first module is used to construct a program dependency graph that represents the dependency relationship of PLC variables;

[0205] The second module is used to quantify the association strength between PLC variables according to the program dependency graph and calculate the dependency edge weight;

[0206] The third module is used to calculate the correlation scores between the PLC variables according to the dependency edge weights, and identify the correlation scores between the various PLC variables;

[0207] The fourth module is used to determine the risk information of potential attack points of the industrial control system based on the identified association relationship scores, and guide the defense system to discover intrusion points or fault sources.

[0208] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0209] An embodiment of the present invention further provides an electronic device comprising a memory and a processor. The memory stores a computer program, and the processor, when executing the computer program, implements the aforementioned method for analyzing PLC variable associations based on weight calculation. The electronic device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0210] It can be understood that the contents of the above method embodiments are applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0211] See also Figure 5 , Figure 5 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0212] The processor 501 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided by the embodiments of the present invention.

[0213] The memory 502 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 502 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 502 and is called by the processor 501 to execute the PLC variable association relationship analysis method based on weight calculation in the embodiment of the present invention.

[0214] Input / output interface 503, used to implement information input and output;

[0215] Communication interface 504, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0216] Bus 505 , which transmits information between various components of the device (e.g., processor 501 , memory 502 , input / output interface 503 , and communication interface 504 );

[0217] The processor 501 , the memory 502 , the input / output interface 503 and the communication interface 504 are connected to each other in communication within the device via a bus 505 .

[0218] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the above-mentioned PLC variable association relationship analysis method based on weight calculation.

[0219] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiment, the functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0220] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0221] It should be noted that in various specific embodiments of the present invention, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present invention needs to obtain the user's sensitive personal information, it will obtain the user's separate permission or consent through a pop-up window or jump to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present invention will be obtained.

[0222] The embodiments described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0223] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0224] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0225] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0226] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0227] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0228] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0229] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store programs.

[0230] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the invention is not limited thereby. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the invention should be within the scope of the invention.

Claims

1. A PLC variable association relationship analysis method based on weight calculation, characterized in that: The following steps are involved: Construct a program dependency graph that represents the dependency relationship of PLC variables; According to the program dependency graph, the association strength between PLC variables is quantified, and the dependency edge weight is calculated; Calculating the correlation scores between the PLC variables according to the dependency edge weights, and identifying the correlation scores between the various PLC variables; Based on the identified correlation scores, risk information of potential attack points of the industrial control system is determined to guide the defense system to discover intrusion points or fault sources.

2. A PLC variable association analysis method based on weight calculation according to claim 1, characterized in that: The process of constructing a program dependency graph representing the dependency relationship of PLC variables comprises the following steps: Parse the intermediate representation information of the PLC code and construct the abstract syntax tree AST; According to the abstract syntax tree AST, a program dependency graph representing the dependency relationship of PLC variables is constructed.

3. A PLC variable association relationship analysis method based on weight calculation according to claim 2, characterized in that: The process of constructing a program dependency graph representing the PLC variable dependency relationship according to the abstract syntax tree AST comprises the following steps: S1. Initialize an empty data dependency graph DFG and control dependency graph CFG, and proceed to step S2; S2. Input the abstract syntax tree AST obtained by parsing the PLC code and proceed to step S3. S3. Dequeue the first token of the abstract syntax tree AST and assign it to first_node, and proceed to step S4. S4, determine whether the current abstract syntax tree AST is an empty queue, if so, go to step S14; otherwise, go to step S5; S5, set the value of count to 0, and go to step S6; S6. Assign the value of the count-th token in the abstract syntax tree AST to sec_node, and proceed to step S7. S7. Set (first_node, sec_node) to a variable pair, and proceed to step S8. S8. Determine whether the variable pair forms a data dependency relationship. If so, proceed to step S9; otherwise, proceed to step S10. When the value of sec_node is determined by first_node, a data dependency relationship is formed. S9, put the variable pair into the data dependency graph DFG, and go to step S12; S10. Determine whether the variable pair forms a control dependency relationship. If so, proceed to step S11; otherwise, proceed to step S12. Wherein, when the parent node of first_node and sec_node is a node of the control flow statement type, a control dependency relationship is formed. S11, put the variable pair into the control dependency graph CFG, and go to step S12; S12, the value of count is automatically increased by 1, and the process goes to step S13; S13. Determine whether the value of count is equal to the number of tokens in the abstract syntax tree AST. If so, proceed to step S3; otherwise, proceed to step S6. S14. Combine the data dependency graph DFG and the control dependency graph CFG to obtain PDG=(CFG, DFG), and construct a program dependency graph that represents the dependency relationship of PLC variables.

4. A PLC variable association analysis method based on weight calculation according to claim 3, characterized in that: The method of quantifying the association strength between PLC variables according to the program dependency graph and calculating the dependency edge weights includes the following steps: The time series changes of variables are obtained through SCADA logs, and then the correlation and uncertainty between variables are calculated to assign weights to the dependency edges in the program dependency graph. The dependency weights in the program dependency graph PDG are expressed as To represent the dependency edge The defined dependencies.

5. A PLC variable association analysis method based on weight calculation according to claim 4, characterized in that: The method of obtaining the temporal changes of variables through SCADA logs, and then calculating the correlation and uncertainty between the variables, and assigning weights to the dependency edges in the program dependency graph, includes the following steps: Calculating dependency edges The conditional entropy H(V TARGET |V SOURCE ): Among them, the conditional entropy H(V TARGET |V SOURCE ) indicates that when the source variable V is known SOURCE Under the condition of TARGET The entropy of the conditional probability distribution of V SOURCE The mathematical expectation of p i =P(V SOURCE =v source_i ), which means that in the SCADA log, the sensor variable or actuator variable is used as the source variable v source_i The probability distribution when ; Using mutual information to identify dependency edges Weight Define it as: Among them, V TARGET is the target variable v in the SCADA log target_k The probability distribution of V SOURCE Is the source variable v in the SCADA log source_j The probability distribution of Using cross mutual information to calculate dependencies at different time delays for: In the formula, τ represents the value of delay, Indicates that after the delay, the target variable v target_k distribution.

6. A PLC variable association analysis method based on weight calculation according to claim 5, characterized in that: Calculating the association scores between the PLC variables based on the dependency edge weights and identifying the association scores between the respective PLC variables comprises the following steps: Define the calculation of the association score score(v i ,v j ) formula: in, It represents the score of calculating the association relationship of PLC variables, and k represents the variable v i v j The kth reachable path, n represents the sum of the reachable paths; It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays; A weighted adjacency matrix W is constructed using the dependency edges and their weights in the program dependency graph, where W[v i ][v j ] indicates that the variable node v i To variable node v j The weight of the edge; if the variable node v i To variable node v j Does not constitute a dependency relationship, then W[v i ][v j ]=0; construct the variable weighted adjacency matrix as: in, It represents the use of the cross mutual information formula to calculate the dependency relationship under different delays; Calculate the total weight M of the dependency path: M=(I-W) -1 Where I is the identity matrix, M[v i ][v j ] indicates that the variable node v i To variable node v j The sum of the weights of all paths reflects the variable node v i To variable node v j Total related relationships; Set an association threshold, and determine the strength of the association relationship of the PLC variables based on the association threshold. The specific formula is: Among them, relationship represents the association relationship between PLC variables.

7. A PLC variable correlation analysis device based on weight calculation, characterized in that: include: The first module is used to construct a program dependency graph that represents the dependency relationship of PLC variables; The second module is used to quantify the association strength between PLC variables according to the program dependency graph and calculate the dependency edge weight; The third module is used to calculate the correlation scores between the PLC variables according to the dependency edge weights, and identify the correlation scores between the various PLC variables; The fourth module is used to determine the risk information of potential attack points of the industrial control system based on the identified association relationship scores, and guide the defense system to discover intrusion points or fault sources.

8. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The storage medium stores a program, and the program is executed by a processor to implement the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images