Industrial control network risk monitoring method and device based on immune recognition

Abstract

The invention discloses an industrial control network risk monitoring method based on immune recognition, and relates to the technical field of network security risk monitoring, and the method comprises the steps: obtaining multi-source heterogeneous industrial control protocol flow data and a known data set which are collected in real time; preprocessing the data to obtain a standardized antigen vector; according to the standardized antigen vector, carrying out mixed training on a preset depth auto-encoder and a graph neural network model based on an immune algorithm to obtain a trained depth auto-encoder-graph neural network model and an initial detector population; inputting the standardized antigen vector into a lightweight model to obtain a compressed antigen vector; and detecting the compressed antigen vector based on the initial detector population to obtain an antigen vector for triggering an alarm. According to the method, the definition and expandability of original protocol semantics are improved, continuous coverage of unknown attacks is ensured, and the deployment and updating process of the model is optimized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security risk monitoring, and in particular to an industrial control network risk monitoring method and device based on immune identification. BACKGROUND

[0002] At present, the most commonly used method in the field of industrial control network security risk monitoring is the "static signature + whitelist" type intrusion detection / prevention method, supplemented by a small number of machine learning-based anomaly detection models.

[0003] The existing method has made certain progress in industrial control network security monitoring, but still has some technical limitations: first, the generalization ability has certain limitations, many models lack adaptation to environmental changes and new attacks, and once the training set in the actual industrial control scene appears, the detection performance often decreases sharply, for example, CPS-GUARD is only verified on a specific physical test platform and dataset, and PCGAT only evaluates the performance on two public ICS datasets. Second, model updating is difficult. Traditional intrusion detection is mainly based on static signature and fixed whitelist strategy, which needs to be manually maintained and updated, such as the industrial control system application whitelist guide issued by CISA, which protects by "allowing only predefined programs to run and blocking all other programs", but it must be manually maintained frequently, and it is completely powerless against unknown or zero-day attacks, while machine learning models lack online self-evolution mechanism once deployed, such as GSIN model and most GNN solutions rely on offline training, and need to be manually retrained to adapt to new processes, in addition, AIm-ADS must be re-generated once the system behavior or self-set changes. In the case of dynamic changes in topology or evolution of traffic patterns, these static models are difficult to adjust in time, resulting in a decrease in true positive rate and an increase in false positive rate, and they cannot respond to unknown threats in real time. Finally, real-time performance is limited. The calculation overhead of some deep learning or graph neural network models is large, and it is difficult to run in real time on resource-constrained industrial site devices; when traffic surges, the inference delay and false positives of traditional models will also be amplified.

[0004] Therefore, a kind of industrial control network risk monitoring method and device based on immune identification are developed to solve the above problems. SUMMARY

[0005] The present application proposes an industrial control network risk monitoring method and device based on immune identification to solve the problems of existing methods, such as limited generalization ability, difficult model updating, and limited real-time performance.

[0006] The present application achieves the above-mentioned purposes through the following technical solutions:

[0007] The present application provides an industrial control network risk monitoring method based on immune identification, comprising:

[0008] acquiring data, the data including real-time collected multi-source heterogeneous industrial control protocol flow data and a known data set, the known data set including a normal sample set and an attack sample set;

[0009] preprocessing the data to obtain a standardized antigen vector;

[0010] based on the standardized antigen vector, hybrid training of a preset deep autoencoder and a graph neural network model is performed based on an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population, and the deep autoencoder-graph neural network model is compressed and encoded during the training to obtain a lightweight model;

[0011] the standardized antigen vector is input into the lightweight model to obtain a compressed antigen vector;

[0012] the compressed antigen vector is detected based on the initial detector population to obtain an antigen vector triggering an alarm.

[0013] Further, the multi-source heterogeneous industrial control protocol flow data includes continuous access data from a deployed lightweight collection probe, and the lightweight collection probe includes a log server, a cloud platform / edge node interface, and an industrial firewall / intrusion detection device mirror port.

[0014] Further, preprocessing the data includes:

[0015] stripping redundant information in the data and retaining only core operation semantics;

[0016] uniformly encoding the data.

[0017] Further, the training process of the deep autoencoder includes:

[0018] through the encoder encoding the time sequence features of the standardized antigen vector , wherein the standardized antigen vector includes normal samples and attack samples:

[0019] wherein is a multi-layer perceptron, and a long short-term memory network is used, is an encoder parameter, X is a time sequence feature vector in a processed time window, and the output is a d-dimensional time sequence feature vector, then the decoder reconstructs the original input into a d-dimensional time sequence feature vector :

[0020] through the decoder function The decoder parameters are Reconstruct the original input X as Reconstruction loss function Defined as:

[0021]

[0022] in, It is the reconstruction loss function of the autoencoder, used to quantify the difference between the original input data and the decoder's reconstructed output. T is the number of semantic tuples contained in the time window, i.e., the total number of time steps. The square of the Euclidean distance. This is the original input feature vector at time step t. The reconstructed output feature vector is given at time step t.

[0023] Furthermore, the training of the graph neural network model includes:

[0024] A dynamic topology graph is constructed based on the association relationships of standardized antigen vector samples within the same time window. Nodes in the dynamic topology graph represent devices, and node features include device type and status. Edges represent communication relationships between devices, and edge weights are communication frequency or traffic volume. The graph convolutional layer propagation formula is as follows:

[0025]

[0026] in, This represents the adjacency matrix plus self-loop connections. Z is the identity matrix, and Z represents the adjacency matrix of real-time communication relationships between devices. Z is reconstructed based on real-time communication data for each time window, which is used to dynamically encode real-time connections between devices. The degree matrix is ​​used for weighted aggregation of the adjacency matrix features; For the first Layer node features; These are learnable weights; This is an activation function in a neural network that updates node features by aggregating information from the adjacency matrix, ultimately outputting a node feature matrix. The embedding matrix H has a dimension of . ,in K is the number of nodes, and K is the feature dimension. Initial features of ∈V It consists of two parts: the first part is a dense vector transformed from the discrete attributes of the device or hardware through the embedding layer; the second part is the device runtime state after normalization and direct concatenation.

[0027]

[0028] in, ) represents the discrete device type of the node, which is mapped as a 3-dimensional dense vector by embedding layer ; ) represents the node running state vector, which is normalized by Min-Max normalization function to obtain a 3-dimensional normalized vector, which is concatenated by () function to obtain a 6-dimensional vector =[0.8,−0.2,1.1,0.85,0.60,1.0];

[0029] For any traffic or event within the time window, the topological features of the source node and the target node and the corresponding time sequence vector are concatenated in the form of ∥ ∥ , and the input vector is compressed to 128 dimensions by random projection hashing algorithm. The specific implementation method is as follows: let the concatenated input vector be v=[ ∥ ∥ ]∈ , d is the original dimension, which is compressed to 128 dimensions by random projection matrix , and the compressed sample is obtained, where is a normal vector (i=1,…,n), is an attack vector (j=1,…,m):

[0030]

[0031] where, is a standardization function, is a scaling factor to control the variance, and finally the normal sample set and the attack sample set are generated.

[0032] Further, the generation process of the initial detector includes:

[0033] A self-detector cluster is constructed by a large number of normal traffic vectors , then a non-self-detector cluster is derived in the gap of the self-cluster , and finally through cross variation evolution, in the generation of self-detector stage, first, the normal sample vector is merged into multiple intermediate clusters C, and the Euclidean distance between clusters is calculated ( ):

[0034] ​

[0035] wherein, represents the centroid vector of the intermediate cluster , = the total number of clusters in the current cycle, decreasing from normal vector n to the final cluster number), if the inter-cluster distance exceeds the preset splitting threshold, stop merging, and generate the self-detector cluster S from the current merged cluster:

[0036]

[0037] wherein, is the tolerance radius of the cluster;

[0038] Subsequently, in the non-self-detector generation stage, the system inputs the typical attack vector into the training process, assuming that the input of the current round is the attack sample set , the attack vector randomly places attack samples in the self-body boundary gap according to the negative selection algorithm, and removes attack samples with high similarity to the self-detector to screen out attack features significantly different from the normal mode. Attack samples are screened through cosine similarity, and if the cosine similarity satisfies the following conditions, the attack sample is considered as a non-self-detector, denoted as :

[0039]

[0040] wherein, is the attack sample vector, is the initial cosine similarity threshold.

[0041] Further, based on the initial detector population, the compressed antigen vector is detected to obtain the antigen vector triggering the alarm, including:

[0042] When the deep autoencoder-graph neural network model outputs a new compressed antigen vector , the antigen vector is discriminated in the order of "self-body first, non-self-body second";

[0043] First, traverse the self-detector set S, and calculate their Euclidean distances in the vector space; if the distance does not exceed the radius scaling factor of the corresponding detector, it is considered that the vector falls within the normal boundary, and the process is immediately terminated;

[0044] If all self-detectors are not "matched successfully", it is determined as a "surviving antigen" and enters the second-level verification, and then retrieves the nearest non-self-detector subset of according to the index, and calculates the comprehensive anomaly score :

[0045]

[0046] wherein is the new antigen vector is the cosine similarity with candidate detectors, is the attention weight of the graph neural network (reflecting the topological anomaly degree), and T is the time window parameter, is the original input vector, is the reconstructed input, is the reconstruction error, is the betweenness centrality in the topological graph, The calculation formula of is:

[0047]

[0048] wherein, is the antigen vector is the probability distribution function of the antigen vector, and the values include the cosine similarity value, the reconstruction error value and the betweenness centrality value; is the logarithmic probability of the antigen vector is the entropy value for quantifying the randomness of the feature distribution; the denominator is the sum of the entropy values of the three feature dimensions, which is used for normalizing the weight, and the input is the feature distribution in the real-time statistical window, is the i-th weight coefficient (i = 1, 2, 3), is the weight of the similarity with the detector, is the weight of the time series reconstruction error, is the weight of the topological anomaly degree;

[0049] If exceeds the dynamic detection threshold , an alarm is triggered immediately, and the detector database is updated synchronously; otherwise, it is classified as “to be observed”, and the compressed 128-dimensional antigen vector is recorded in the short-term buffer.

[0050] Further, it also includes optimizing the non-self detector, including:

[0051] First, dynamic population evolution: let the initial antibody detector population of the t-th generation (t is iterated every 24 hours) is:

[0052]

[0053] wherein, m is the sum of the “to be observed” antigen vectors in the short-term buffer and the original number of non-self detectors, n is the number of the current self detector, and the population ​Non-self detector containing With self detector , ), the input population is generated by negative selection algorithm, satisfying the following conditions:

[0054]

[0055] Where is the input set of self detectors, is the initial self detector individual in the initial population;

[0056] Next is the antibody fitness evaluation in the initial antibody detector population screening, the results of the evaluation are retained 2 detectors with the highest fitness Enter the mating pool, repeat uniform crossover until the mating pool size reaches is the crossover probability), uniform crossover is performed on the parent detectors , randomly select genes from the source, generate offspring :

[0057]

[0058] Where, is a function that generates a random number [0, 1), is the data at position, then the offspring is subjected to Gaussian perturbation to enhance diversity, and the mutated offspring :

[0059]

[0060] Where, is dynamically adjusted according to population diversity, is a random perturbation vector subject to normal distribution, is a multi-dimensional Gaussian distribution with mean 0 and covariance ( is the identity matrix); The formula for dynamic adjustment is:

[0061]

[0062] Where, is the basic mutation amplitude, is the decay coefficient, is the diversity index of the t-th generation population, k is the number of non-self detectors in the population, is any two different non-self detectors in the population ,​ );

[0063] Next, parameter adjustments will be performed, among which... For state space, The action space is responsible for adjusting the detection threshold and fitness weights. For the reward function:

[0064]

[0065]

[0066] in, For dynamic detection threshold, As a weight for recall rate, As a weight for false alarm rate, To improve coverage against new types of attacks, To maintain population diversity, the parameters are then updated based on real-time feedback. During operation, the parameters are automatically corrected based on real-time alarms and false alarm statistics.

[0067] Furthermore, it also includes screening the initial antibody detector population, including:

[0068] The first step is to assess the fitness of the initial antibody detector population using the fitness function. Overall performance of the dynamic balance detector:

[0069]

[0070] in:

[0071]

[0072]

[0073]

[0074] Calculated from real-time alarm verification results, FPR is obtained through false alarm statistics. A coefficient used to measure coverage against new types of attacks. Dynamically adjusted by crossover mutation, TP represents the true positive rate, FN represents the false negative rate, FP represents the false positive rate, and TN represents the true negative rate. For a new set of attack samples (i.e., attack types that did not appear during the training phase), Non-self detector With attack samples cosine similarity, For dynamic detection thresholds;

[0075] Next, selection and crossover are performed: adopt tournament selection algorithm, randomly select 5 detectors from the initial antibody detector population of the t th generation , retain the 2 detectors with the highest fitness into the mating pool, and repeat uniform crossover until the size of the mating pool reaches , is the crossover probability;

[0076] After the new generation of detectors are deployed to the test environment, 24 hours of data are collected, and if the actual recall rate deviates from the simulation value by more than a threshold value, the population reinitialization mechanism is triggered.

[0077] The application also provides a device for the industrial control network risk monitoring method based on immune recognition.

[0078] The acquisition module is configured to acquire data, wherein the data includes multi-source heterogeneous industrial control protocol flow data collected in real time and a known data set, and the known data set includes a normal sample set and an attack sample set.

[0079] The preprocessing module is configured to preprocess the data to obtain a standardized antigen vector.

[0080] The training module is configured to perform hybrid training on a preset deep autoencoder and a graph neural network model based on an immune algorithm according to the standardized antigen vector, to obtain a trained deep autoencoder-graph neural network model and an initial detector population, and to perform compression coding on the deep autoencoder-graph neural network model during training to obtain a lightweight model.

[0081] The compression module is configured to input the standardized antigen vector into the lightweight model to obtain a compressed antigen vector.

[0082] The detection module is configured to detect the compressed antigen vector based on the initial detector population to obtain an antigen vector that triggers an alarm.

[0083] The application has the following beneficial effects:

[0084] The industrial control network risk monitoring method and device based on immune recognition improve the clarity and scalability of the original protocol semantics through unified abstraction and early coding. The antibody detector population evolution mechanism designed by the application ensures continuous coverage of unknown attacks by updating a generation every 24 hours in the cloud, combining crossover and mutation methods, and adopting a cloud-edge collaborative training and reasoning separation framework to optimize the deployment and update process of the model. BRIEF DESCRIPTION OF DRAWINGS

[0085] ​Figure 1 This is a flowchart of the industrial control network risk monitoring method based on immune recognition according to the present invention.

[0086] Figure 2 This is a multi-layer system architecture diagram of network security risk monitoring for industrial control systems based on immune recognition, as described in an embodiment of the present invention.

[0087] Figure 3 This is a flowchart of the detector generation and training process in an embodiment of the present invention;

[0088] Figure 4 This is a flowchart of the dual-view encoding process based on a deep autoencoder-graph neural network model in an embodiment of the present invention;

[0089] Figure 5 This is a flowchart illustrating the screening and identification process based on detector-based antigen vectors in an embodiment of the present invention.

[0090] Figure 6 This is a flowchart of crossover mutation and parameter control in an embodiment of the present invention. Detailed Implementation

[0091] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0092] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0093] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0094] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0095] like Figure 1 As shown, the present invention provides a risk monitoring method for industrial control networks based on immune recognition, comprising:

[0096] S1: Acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets;

[0097] S2: preprocessing the data to obtain a standardized antigen vector;

[0098] S3: based on the standardized antigen vector, hybrid training of a preset deep autoencoder and a graph neural network model is performed based on an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population, and the deep autoencoder-graph neural network model is compressed and encoded during training to obtain a lightweight model;

[0099] S4: inputting the standardized antigen vector into the lightweight model to obtain a compressed antigen vector;

[0100] S5: detecting the compressed antigen vector based on the initial detector population to obtain an antigen vector triggering an alarm.

[0101] The application of the present application in an immune recognition-based industrial control system network security risk monitoring multi-layer system is further described below. The immune recognition-based industrial control system network security risk monitoring multi-layer system mainly includes a data acquisition layer, an edge computing layer and a cloud decision layer.

[0102] As shown in Figure 2 The immune recognition-based industrial control system network security risk monitoring method provided by the present application aims to realize rapid identification and diagnosis of unknown and known industrial control system network threats under a cloud-edge collaborative framework. The core of the method is to use immune technology, introduce "self / non-self" recognition and evolution process, and construct a variable and evolved antibody detector population by "antigenizing" multi-source traffic. The specific steps are as follows:

[0103] 1. Data acquisition layer: data acquisition and preprocessing

[0104] The present scheme proposes a lightweight synthetic probe (LSP) deployed at the edge nodes of the industrial control network (including log servers, cloud platform / edge node interfaces, industrial firewall / intrusion detection device mirror ports) for collecting multi-source heterogeneous industrial control protocol traffic. The multi-source heterogeneous industrial control protocol refers to data from different devices, protocols or transmission methods, such as Modbus, IEC-104, MVB, etc. They usually use different data formats and communication methods, forming a complex data environment in the industrial control system. LSP combines the design of embedded device hardware and data preprocessing software. The hardware part uses an embedded single-board computer with a quad-core 1.5GHz processor, 2GB of memory and 16GB of storage space, and is equipped with two network interfaces (1x mirror traffic input, 1x management / backhaul). The operating system is a lightweight Linux with only the kernel, network stack and drivers.

[0105] (1) Data collection

[0106] The core task of data collection is to capture multi-source heterogeneous industrial control protocol traffic in real time.

[0107] For example, the vehicle-mounted PLC converts MVB bus data into Ethernet frames through the Ethernet gateway and accesses the ETH1 port of LSP. Then, the system slices each type of protocol traffic by time window to generate raw data blocks (each block <1MB). For example, the Modbus traffic within 1 second is 850 packets, and the slice size = 850x128 bytes ≈ 109KB. The raw packets are written to the circular buffer (1MB) in the order of arrival, with timestamps and source interfaces (ETH0 / ETH1) marked. The buffer address is 0x0000-0xFFFF, and the write pointer is reset to zero every 1MB. The timestamp field is attached to the header of each packet (8 bytes).

[0108] There are also scalable collection sites such as wayside devices (such as signals, transponders), station equipment (such as platform door controllers, ticketing terminals) and cloud management platform interfaces, etc.

[0109] Through this method, multi-source heterogeneous industrial control protocol traffic is captured in real time.

[0110] (2) Data preprocessing

[0111] The core task of data preprocessing is to convert multi-source heterogeneous industrial control protocol messages into standardized semantic representations. First, the redundant information in the original message (such as frame header, check code) is stripped off, and only the core operation semantics is retained. For example, the 12-byte MBAP header (including addressing and message control information) of Modbus TCP is completely discarded in the conversion process; for IEC-104 protocol, the type identifier 0x2E (6 bytes) in the remote control command "68 0E 00 00 00 00 00 00 00 00 2E 01 06 00 01 00 00 01" is mapped to the semantic label {single_point}, and finally a dictionary is generated, the structure is as follows {single_point: signal_light_23, ON}. For example, the original byte string of Modbus function code 03 (including device address, register address, etc.) is simplified to {operation: read_holding_registers} format.

[0112] To realize unified coding across protocols, the TLV (Tag-Length-Value) standard of Protocol Buffers is used, which is a data description language. When encoding each field, first generate a composite Tag byte: left shift the field number defined by the Protocol Buffers protocol by 3 bits and bitwise OR with the Wire Type (for example, the Tag value of field number 1 + Wire Type 2 is 0x0A), where Wire Type defines the data type parsing rule (such as 0=Varint integer, 2=length-separated string). Subsequently, the binary data is optimized: numerical fields are compressed using the Varint algorithm (such as register address 0 encoded as 0x00), and strings are converted to ASCII code (such as "L1" encoded as 0x4C31).

[0113] The processed antigen vector is transmitted to the edge server, and after format verification, it is stored in the antigen pool of the edge computing layer. This method can make the semantics of the original data more clear, and the expansion after encoding is stronger; at the same time, by encoding the protocol semantics in advance, the protocol decoding load of the center server is reduced, and the monitoring performance of large-scale industrial control networks is significantly improved, and the field encoding table is shown in Table 1.

[0114] Table 1

[0115] 2. Cloud decision layer: detector generation and model training

[0116] The goal of the model training is to complete the training and compression of the Deep Autoencoder-Graph Neural Network model in the cloud and generate an initial auto / non-auto antibody detector population. Referring to Figure 3 The process adopts a hybrid training strategy, and the cloud server mixes and trains the data in the known data set with the industrial control network operation data actually collected by the LSP, thereby solving the problem that the unique equipment of the industrial control network is not covered in the public data set, and ensuring the adaptability of the model to the unique scene of the industrial control network.

[0117] (1) Deep Autoencoder Training

[0118] The Deep Autoencoder (DA) is used to extract the time series features in a time window. First, the encoder encodes the time series features of the normalized antigen vector , wherein the normalized antigen vector includes normal samples and attack samples

[0119]

[0120] wherein is a multi-layer perceptron, which adopts a Long Short-Term Memory (LSTM), is the encoder parameter, X is the time series feature vector in a processed time window, and the output is a d-dimensional time series feature vector. Then, the decoder reconstructs the original input into a d-dimensional time series feature vector

[0121]

[0122] Through the decoder function , the parameters of the decoder are , the original input X is reconstructed as , ensuring that the features retain key time series information. The reconstruction loss function is defined as:

[0123]

[0124] wherein, is the reconstruction loss function of the autoencoder, which is used to quantify the difference between the original input data and the decoder reconstruction output. T is the number of semantic tuples (i.e., the total number of time steps , refers to the square of the Euclidean distance, is the original input feature vector of time step t, ​is the reconstructed output feature vector for time step t. If the loss function converges, it means that the reconstructed original input correctly preserves the key time-series information.

[0125] (2) Graph neural network encoder training

[0126] Graph Neural Network, GNN is used to construct a dynamic topology graph based on the correlation between standardized antigen vector samples within the same time window. The nodes in the graph represent devices such as PLCs, switches, etc., and the node features include device types, states, etc. The edges represent the communication relationship between devices, and the edge weight is the communication frequency or flow size. The graph convolution layer propagation formula is as follows:

[0127]

[0128] where, represents the adjacency matrix plus self-loop connection, is the identity matrix, and Z represents the adjacency matrix of real-time communication relationship between devices. Each time window will reconstruct Z according to real-time communication data for dynamic encoding of real-time connection between devices; is the degree matrix that aggregates the features of the adjacency matrix by weighting; is the feature of the layer node Take 2-3 layers to prevent over-smoothing using a shallow network); is the learnable weight; is the activation function in the neural network. The node feature is updated by aggregating the information of the adjacency matrix, and the final output is the node feature matrix embedding matrix H (dimension where, is the number of nodes, and K is the feature dimension. The initial feature of node ∈V is composed of two parts: the first part is the device type (such as PLC, switch, ATS), hardware model, etc. discrete attributes are converted into dense vectors through embedding layer, and the second part is the device runtime state (CPU load, memory usage, port state) normalized and directly concatenated:

[0129]

[0130] where, ) represents the discrete device type of the node (e.g. "PLC" / "ATS"), which is mapped to a 3-dimensional dense vector through an embedding layer such as PLC→[0.8,−0.2,1.1]; ​​The node running state vector (such as CPU load, memory usage, port state) is represented by a Min-Max normalization function After normalization, a 3-dimensional normalized vector is obtained, for example [cpu=85%, mem=60%, port=1]→[0.85, 0.60, 1.0]. Through The function concatenates a 6-dimensional vector =[0.8,−0.2,1.1,0.85,0.60,1.0].

[0131] Subsequently, vector fusion and mapping are performed. For any traffic or event within a time window, the topological features of its source node and target node (both are features of the final output layer) and the corresponding time sequence vector are concatenated in the form of [ ∥ ∥ ]. This allows the immune detector to obtain both time sequence anomalies and topological dependence information. Through a random projection (RP) hashing algorithm, the input vector is compressed to 128 dimensions. The specific implementation method is as follows: let the concatenated input vector be =[ ∥ ∥ ]∈ (d is the original dimension), which is compressed to 128 dimensions through a random projection matrix , to obtain the compressed sample , where is a normal vector (i=1,…,n). is an attack vector (j=1,…,m):

[0132]

[0133] where, is a standardization function, is a scaling factor to control the variance. Finally, a normal sample set is generated. The attack sample set .

[0134] (3) Initial detector generation

[0135] Based on the "self / non-self" partitioning idea in biological immunology, the initialization process adopts a hybrid training strategy. The cloud server mixes the existing CIC Modbus dataset 2023 dataset with the actual collected industrial control operation data for initial training. The CIC dataset contains the Modbus TCP protocol and contains 9 typical ICS attacks (scanning, flooding, payload injection, response delay, length modification, false data injection, stacked frames, brute force writing, and replay attack) that can cover both public datasets and actual collected related industrial control protocol datasets.

[0136] First, a large number of normal flow vectors are used to construct self-detector clusters Then, non-self-detector clusters are derived in the gaps of the self-cluster Finally, cross variation is used for continuous evolution to ensure long-term sensitivity to unknown attacks. In the self-detector generation stage, first, the normal sample vectors are merged into multiple intermediate clusters C, and the Euclidean distance between clusters is calculated ( ):

[0137]

[0138] wherein represents the centroid vector of the intermediate cluster , is the total number of clusters in the current cycle, which decreases from the normal vector n to the final cluster number). If the distance between clusters exceeds the preset splitting threshold, stop merging, and generate self-detector clusters S using the current merged clusters:

[0139]

[0140] wherein is the tolerance radius of the cluster. In this way, the "normal boundary" is quickly outlined with a small number of representative centers.

[0141] Subsequently, in the non-self-detector generation stage, the system inputs typical attack vectors into the training process. Let the input of this round be the attack sample set Attack vectors randomly place attack samples in the gap of the self-boundary according to the negative selection algorithm, and remove attack samples with high similarity to self-detectors to filter out attack features that are significantly different from normal patterns. Attack samples are screened by cosine similarity. If the cosine similarity satisfies the following conditions, the attack sample is considered as a non-self-detector, denoted as :

[0142]

[0143] wherein, For attack sample vectors (malicious traffic features), = 0.15 is the initial cosine similarity threshold.

[0144] (4) Model compression

[0145] The core goal of model parameter compression is model lightweight. The method is to use lightweight technology distillation during the training of the deep autoencoder-graph neural network model. The cloud uses a large teacher model to train a small student model (compressed version of the model). The teacher model learns the normal / attack pattern, and the student model imitates its output to achieve high-precision compression. Then layer pruning removes redundant layers (deep decoder of the autoencoder) in the model, and only the encoder and shallow graph neural network are retained to focus on key feature extraction. Then deployment optimization is performed. The compressed model is serialized in Protocol Buffers format and periodically delivered through the cloud-edge collaborative framework to ensure that the edge model is lightweight and up-to-date.

[0146] 3. Edge computing layer: vector antigenization based on deep autoencoder-graph neural network model

[0147] This part is located in the edge computing layer and uses a training and inference separation mechanism. After the cloud completes the training and compression encoding of periodic instructions, register operations, and other behavior features, the edge server only needs to use the compressed lightweight model for inference.

[0148] Referring to Figure 4 , the input is the standardized antigen vector generated by data preprocessing (corresponding to the traffic of one time window). First, the trained deep autoencoder extracts the time series features .

[0149] Then, the graph neural network encoder constructs a dynamic graph based on real-time communication data and calculates the node features H. For each flow / event, the source node topology features , target node topology features , and time series features are concatenated . A random projection matrix W is applied to compress these features, and the final output is the compressed antigen vector .

[0150] 4. Edge computing layer: detection of antigen vectors based on detectors

[0151] As shown in Figure 5 , when the deep autoencoder-graph neural network model outputs a new antigen vector At this time, the platform discriminates in the order of "self first, non-self second". The system first traverses the self-detector set S, and calculates the Euclidean distance in the vector space; if the distance does not exceed the radius scaling coefficient of the corresponding detector , it is considered that the vector falls within the normal boundary, and the process is immediately terminated. In this way, a large amount of regular traffic can be screened out at a lower computational cost, while maintaining a high recall rate for normal behavior patterns. If all self-detectors are not "matched successfully", it is determined to be a "surviving antigen" and enters the second level verification. The system then retrieves the remaining nearest non-self detector subset according to the index, and calculates the comprehensive anomaly score :

[0152]

[0153] wherein is the cosine similarity of the new antigen vector with the candidate detector, is the attention weight of the graph neural network (reflecting the topological anomaly degree), T is the time window parameter, is the original input vector, is the reconstructed input, is the reconstruction error, is the index betweenness centrality in the topological graph. The calculation formula of is as follows:

[0154]

[0155] wherein, is the probability distribution function of the antigen vector , and the values include the cosine similarity value, the reconstruction error value and the betweenness centrality value; is the logarithmic probability of the antigen vector ; is the entropy value, which is used to quantify the randomness of the feature distribution; the denominator is the sum of the entropy values of the three feature dimensions, which is used to normalize the weight. The input is the feature distribution in the real-time statistical window, is the i-th weight coefficient (i=1, 2, 3), is the weight of the similarity to the detector, is the weight of the time series reconstruction error, is the weight of the topological anomaly degree.

[0156] If exceeds the dynamic detection threshold ​If so, the system will immediately trigger an alarm and update the detector database in the cloud decision layer in synchronization; otherwise, it will be classified as "to be observed" and the compressed 128-dimensional antigen vector will be recorded in the short-term buffer, which will be sent to cross variation for subsequent threshold correction without affecting normal business.

[0157] 5. Cloud decision layer: cross variation and parameter regulation

[0158] The core goal of this part is the dynamic optimization of non-self detectors, and the specific process is as follows Figure 6

[0159] (1) Cross variation

[0160] First, dynamic population evolution: let the antibody detector population of the tth generation (t is iterated every 24 hours) be:

[0161]

[0162] Where m is the sum of the "to be observed" antigen vectors in the short-term buffer and the original number of non-self detectors, and n is the current number of self detectors. The population contains non-self detectors and self detectors . The input population is generated by a negative selection algorithm, which satisfies the following conditions:

[0163]

[0164] Where is the input set of self detectors, is the self detector individual in the initial self detector .

[0165] Next is the antibody fitness evaluation located in the antibody detector population screening. The results of the evaluation are retained The two detectors with the highest fitness enter the mating pool, and uniform crossover is repeated until the mating pool size reaches is the crossover probability). Uniform crossover is performed on the parent detectors , the gene source is randomly selected by bit, and the offspring is generated:

[0166]

[0166]

[0167] Where is a function that generates a random number [0, 1), is the data at position. Then the offspring Apply Gaussian perturbation to enhance diversity, get the mutated offspring :

[0168]

[0169] where, Adjust dynamically according to population diversity, is a random perturbation vector subject to normal distribution, is a multi-dimensional Gaussian distribution with mean 0 and covariance is an identity matrix. The formula for dynamic adjustment is:

[0170]

[0171] where, is the basic mutation amplitude, is the decay coefficient, is the diversity index of the tth generation population, is the number of non-self detectors in the population, is the distance between any two different non-self detectors in the population. , .

[0172] (2) Parameter regulation

[0173] Next, parameter regulation is performed, where is the state space, is the action space, responsible for adjusting the detection threshold and fitness weight, is the reward function:

[0174]

[0175]

[0176] where, is the dynamic detection threshold, is the recall rate weight, is the false alarm rate weight. is the coverage rate of new attacks, is the population diversity. The system then updates the above parameters according to real-time feedback. During operation, the system will automatically correct the parameters according to real-time alarm and false alarm statistics to optimize detection performance.

[0177] 6. Cloud decision layer: antibody detector population screening

[0178] First, the fitness evaluation of the antibody detector population, the fitness function Dynamic balance the comprehensive performance of the detector: ​

[0179]

[0180] in:

[0181]

[0182]

[0183]

[0184] Calculated based on real-time alarm verification results, Obtained through false alarm statistics A coefficient used to measure coverage against new types of attacks. Dynamically adjusted by crossover mutation, . The true positive rate, The false negative rate, It was a false positive. It is a true negative. For a new set of attack samples (i.e., attack types that did not appear during the training phase), Non-self detector With attack samples cosine similarity, This is the dynamic detection threshold.

[0185] Next, we proceed with selection and crossover: using a tournament selection method, starting from the [number]th [stage / section / section]... Antibody detector population Five detectors were randomly selected from the pool, and the remaining ones were retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. (This refers to the crossover probability).

[0186] After the new generation detector is deployed to the test environment, it collects data over 24 hours. If the actual recall rate deviates from the simulated value by more than a threshold (i.e., ... If this occurs, the population reinitialization mechanism will be triggered.

[0187] The present invention also provides an apparatus for the aforementioned method for risk monitoring of industrial control networks based on immune recognition, comprising:

[0188] The acquisition module is used to acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets.

[0189] A preprocessing module is configured to preprocess the data to obtain a standardized antigen vector;

[0190] A training module is configured to train a preset deep autoencoder and graph neural network model based on an immune algorithm according to the standardized antigen vector, to obtain a trained deep autoencoder-graph neural network model and an initial detector population, and to perform compression coding on the deep autoencoder-graph neural network model during training to obtain a lightweight model.

[0191] A compression module is configured to input the standardized antigen vector into the lightweight model to obtain a compressed antigen vector.

[0192] A detection module is configured to detect the compressed antigen vector based on the initial detector population to obtain an antigen vector triggering an alarm.

[0193] The present application has the following advantages over the prior art:

[0194] 1. An industrial control protocol flow antigenization method based on "probe collection-semantic abstraction-double perspective coding" is proposed. Existing methods have difficulty in realizing unified modeling when processing multi-source heterogeneous industrial control protocol flows, and the central decoding calculation burden is heavy and real-time performance is poor. The present application designs an edge lightweight collection and coding scheme. First, a lightweight collection probe deployed on the edge side is used to realize real-time capture and protocol abstraction of multi-source flows, and a compact byte compression strategy is used to standardize the expression of fields such as operation type and address, reducing the decoding overhead of the central server. Then, the processing results are sent to a double-perspective coding module to fuse topological relationships and timing characteristics, complete the immune antigen expression of the flow, and provide a unified vector input for subsequent antigen vector detection.

[0195] 2. An unknown attack detector generation method based on "self / non-self" double cluster modeling and evolution mechanism is proposed. Existing detection methods generally rely on known samples for training, and it is difficult to effectively identify unknown threats that deviate from normal characteristics. The present application draws lessons from the biological immune mechanism. First, a self-detector cluster is constructed using normal traffic, and then a non-self detector cluster is derived in the feature gap. Through means such as tournament selection, uniform crossover, and mutation, the non-self antibody detector population is continuously evolved to achieve adaptive detection of unknown threats. This method supports a 24-hour self-updating strategy for detectors, and has long-term detection sensitivity and generalization ability.

[0196] 3. A training-inference separation immune detection method based on cloud-edge collaborative architecture is proposed. Traditional intrusion detection methods are difficult to balance detection accuracy and running efficiency on limited devices, especially when updating detector models or adapting to environmental changes. The invention designs a cloud training and edge inference collaborative architecture, the cloud completes the training, compression and detector optimization of the deep autoencoder-graph neural network model, and the edge side only needs to deploy a lightweight model for fast inference; through random projection compression to generate 128-dimensional antigen vectors, and periodically issue a new generation of detectors and parameters, realize the dynamic self-adaptation and low delay operation of the detection strategy, meet the real-time monitoring needs of large-scale industrial control network.

[0197] The above only describes the preferred embodiments of the present application, and it should be pointed out that for ordinary skilled persons in the art, without departing from the technical principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A risk monitoring method for industrial control networks based on immune recognition, characterized in that, include: Acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets; The data is preprocessed to obtain a standardized antigen vector; Based on the standardized antigen vector, the preset deep autoencoder and graph neural network model are trained in a hybrid manner using an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model. The standardized antigen vector is input into the lightweight model to obtain the compressed antigen vector; The compressed antigen vector is detected based on the initial detector population to obtain the antigen vector that triggers the alarm.

2. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, Multi-source heterogeneous industrial control protocol traffic data includes continuously accessed data from deployed lightweight acquisition probes, which include log servers, cloud platform / edge node interfaces, and industrial firewall / intrusion detection device mirror ports.

3. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, The data is preprocessed, including: Remove redundant information from the data and retain only the core operational semantics; The data is uniformly encoded.

4. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, The training process of a deep autoencoder includes: via encoder Temporal features of encoding standardized antigen vectors The standardized antigen vector includes normal samples and attack samples: ， in It is a multilayer perceptron, employing a long short-term memory network. For encoder parameters, The output is a d-dimensional temporal feature vector within a processed time window. Then, the decoder... Reconstruct the original input into a d-dimensional temporal feature vector : ， Through decoder function The decoder parameters are Reconstruct the original input X as Reconstruction loss function Defined as: ， in, It is the reconstruction loss function of the autoencoder, used to quantify the difference between the original input data and the decoder's reconstructed output. T is the number of semantic tuples contained in the time window, i.e., the total number of time steps. The square of the Euclidean distance. This is the original input feature vector at time step t. The reconstructed output feature vector is given at time step t.

5. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, Training a graph neural network model includes: A dynamic topology graph is constructed based on the association relationships of standardized antigen vector samples within the same time window. Nodes in the dynamic topology graph represent devices, and node features include device type and status. Edges represent communication relationships between devices, and edge weights are communication frequency or traffic volume. The graph convolutional layer propagation formula is as follows: ， in, This represents the adjacency matrix plus self-loop connections. Z is the identity matrix, and Z represents the adjacency matrix of real-time communication relationships between devices. Z is reconstructed based on real-time communication data for each time window, which is used to dynamically encode real-time connections between devices. The degree matrix is ​​used for weighted aggregation of the adjacency matrix features; For the first Layer node features; These are learnable weights; This is an activation function in a neural network that updates node features by aggregating information from the adjacency matrix, ultimately outputting a node feature matrix. The embedding matrix H has a dimension of . ,in K is the number of nodes, and K is the feature dimension. Initial features of ∈V It consists of two parts: the first part is a dense vector formed by transforming the discrete attributes of the device or hardware through the embedding layer; the second part is a direct concatenation of the normalized runtime states of the device. ， in, ( ) represents the discrete device type of a node, through an embedding layer. Mapped to a 3D dense vector; This represents the node's running state vector, standardized by the Min-Max function. After normalization, a 3D standardized vector is obtained, which is then processed. The concatenation function produces a 6-dimensional vector. =[0.8,−0.2,1.1,0.85,0.60,1.0]; For any traffic or event within the time window, extract the topological characteristics of its source and destination nodes. and the corresponding time series vector ,according to[ ∥ ∥ The input vector is compressed to 128 dimensions using a random projection hash algorithm. The specific implementation method is as follows: Let the concatenated input vector be v = [ ∥ ∥ ]∈ d is the original dimension, projected through a random projection matrix. Compress it to 128 dimensions to obtain the compressed sample. ,in For normal vectors (i=1,…,n), For the attack vector (j=1,…,m): ， in, It is a standardized function. It is a scaling factor used to control variance, ultimately generating a normal sample set. , and attack sample set .

6. The industrial control network risk monitoring method based on immune recognition according to claim 5, characterized in that, The initial detector generation process includes: A cluster of self-detectors is constructed using a large number of normal flow vectors. Then, non-self detector clusters are derived from the gaps in the self-clusters. Finally, through continuous evolution via crossover and mutation, in the stage of generating self-detectors, the normal sample vector is first... Merge into multiple intermediate clusters C, and calculate the Euclidean distance between the clusters. ( ): ， in, Indicates intermediate cluster The centroid vector, =The total number of clusters in the current loop, decreasing from the normal vector n to the final number of clusters). If the distance between clusters exceeds a preset splitting threshold, merging stops, and the currently merged clusters are used to generate a self-detector cluster S. ， in, Let be the tolerance radius of the cluster; Subsequently, in the non-self detector generation stage, the system inputs typical attack vectors into the training process, assuming the input for this round is the attack sample set. The attack vector is randomly injected into the self-boundary gap using a negative selection algorithm. Attack samples with high similarity to the self-detector are removed to filter out attack features that are significantly different from the normal pattern. Attack samples are then filtered by cosine similarity. This attack sample meets the following conditions. Considered a non-self detector, denoted as : ， in, This is the attack sample vector. This is the initial cosine similarity threshold.

7. The industrial control network risk monitoring method based on immune recognition according to claim 6, characterized in that, Based on the initial detector population, the compressed antigen vector is detected to obtain the antigen vector that triggers the alarm, including: When the deep autoencoder-graph neural network model outputs a new compressed antigen vector At that time, antigen vectors were processed in the order of "self first, then non-self". To conduct screening; First, iterate through the set S of self-detectors and calculate their Euclidean distance in the vector space; if the distance does not exceed the radius scaling factor of the corresponding detector... Then the vector is considered If the condition falls within the normal boundaries, the process should be terminated immediately. If all self-detectors fail to "match successfully" It was identified as a "survival antigen" and entered the second level of verification, subsequently being searched by index for other related antigens. Recent subset of non-self detectors And calculate the comprehensive anomaly score. : ， in For new antigen vectors Cosine similarity with candidate detectors, Here, T represents the attention weights of the graph neural network (reflecting topological anomalies), and T is the time window parameter. The original input vector, To reconstruct the input, It is a reconstruction error. For the index betweenness centrality of the topological graph, The calculation formula is: ， in, antigen vector The probability distribution function, whose values ​​include cosine similarity value, reconstruction error value, and betweenness centrality value; Antigen vector algebra The logarithmic probability; The entropy value is used to quantify the randomness of the feature distribution; the denominator is the entropy value. It is the sum of the entropy values ​​of the three feature dimensions, used to normalize the weights. The input is the feature distribution within the real-time statistical window. It is the i-th weight coefficient (i=1,2,3). As a weight for similarity with the detector, As the weight of the time series reconstruction error, The weights for topological anomalies; like Exceeding the dynamic detection threshold If the condition is met, an alarm is immediately triggered and the detector database is updated synchronously; otherwise, it is classified as "to be observed" and the compressed 128-dimensional antigen vector is recorded in a short-term buffer.

8. The industrial control network risk monitoring method based on immune recognition according to claim 7, characterized in that, This also includes optimizations for non-self detectors, including: First, let's consider the dynamic population evolution: Suppose the initial antibody detector population is in generation t (t iterates every 24 hours). for: ， in, The population is the sum of the "to be observed" antigen vectors in the short-term buffer and the original number of non-self detectors, where n is the current number of self detectors. Includes non-self detectors With self-detector , The input population is generated using a negative selection algorithm and satisfies the following conditions: ， in The set of self detectors is the input. For the initial self detector The self-detector individual; Next, antibody fitness assessment is performed at the initial antibody detector population screening stage, and the results are retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. (For crossover probability), for the parent detector Perform uniform crossover, randomly select gene sources at each position, and generate offspring. : ， in, It is a function that generates random numbers in the range [0,1). For the data at position num, then for the child generation Applying Gaussian perturbation to enhance diversity yields mutated offspring. : ， in, Adjusted dynamically based on population diversity Let be a random perturbation vector that follows a normal distribution. With a mean of 0 and a covariance of Multidimensional Gaussian distribution ( (It is the identity matrix); The formula for dynamic adjustment is: ， in, Basic variation amplitude, The attenuation coefficient is... Let be the diversity index of the t-th generation population, and k be the number of non-self detectors in the population. For any two distinct non-self detectors in the population , ); Next, parameter adjustments will be performed, among which... For state space, The action space is responsible for adjusting the detection threshold and fitness weights. For the reward function: ， ， in, For dynamic detection threshold, As a weight for recall rate, As a weight for false alarm rate, To improve coverage against new types of attacks, To maintain population diversity, the parameters are then updated based on real-time feedback. During operation, the parameters are automatically corrected based on real-time alarms and false alarm statistics.

9. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, This also includes screening the initial antibody detector population, including: The first step is to assess the fitness of the initial antibody detector population using the fitness function. Overall performance of the dynamic balance detector: ， in: ， ， ， Calculated from real-time alarm verification results, FPR is obtained through false alarm statistics. A coefficient used to measure coverage against new types of attacks. Dynamically adjusted by crossover mutation, TP represents the true positive rate, FN represents the false negative rate, FP represents the false positive rate, and TN represents the true negative rate. For a new set of attack samples (i.e., attack types that did not appear during the training phase), Non-self detector With attack samples cosine similarity, For dynamic detection thresholds; Next, selection and crossover are performed: a tournament selection algorithm is used, starting from the initial antibody detector population in generation t. Five detectors were randomly selected from the pool, and the remaining ones were retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. , The crossover probability; After the new generation detector is deployed to the test environment, it collects data over 24 hours. If the actual recall rate deviates from the simulated value by more than a threshold, the population re-initialization mechanism is triggered.

10. An apparatus for a risk monitoring method for industrial control networks based on immune recognition as described in any one of claims 1-9, characterized in that, include: The acquisition module is used to acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets. A preprocessing module is used to preprocess the data to obtain a standardized antigen vector; The training module is used to perform hybrid training on a preset deep autoencoder and graph neural network model based on a standardized antigen vector and an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model. A compression module is used to input a standardized antigen vector into a lightweight model to obtain a compressed antigen vector. The detection module is used to detect the compressed antigen vector based on the initial detector population to obtain the antigen vector that triggers the alarm.

Images