Power generation side industrial control system network security target building method based on virtual-real combination

Abstract

The invention discloses a virtual-real combination-based power generation side industrial control system network security target construction method. The method comprises the following steps of: constructing a virtual-real combination target environment consisting of a physical equipment layer and a virtual model layer; the heterogeneous industrial control protocol between the physical equipment layer and the virtual model layer is analyzed, protocol semantic information is extracted, and a bidirectional dynamic mapping rule of a physical equipment state and a virtual model state is generated based on the protocol semantic information; based on a state change event of the physical equipment layer, according to a bidirectional dynamic mapping rule, synchronizing changed equipment state data to the virtual model layer in real time, and simulating protocol behavior logic corresponding to the equipment state data in the virtual model layer according to a security test requirement; and based on the attack instruction or the abnormal state signal generated by the virtual model layer, according to the protocol specification format of the target physical equipment, converting the instruction or the signal into an executable control command, and driving the physical equipment layer to execute an operation corresponding to the control command.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power network information security, and in particular relates to a power generation side industrial control system network security target building method based on virtual-real combination. BACKGROUND

[0002] With the rapid development of the energy internet, the industrial control system on the power generation side is facing increasingly severe network security threats. Traditional security protection methods mainly rely on firewall, intrusion detection and other border protection technologies, which are difficult to cope with advanced persistent threats (APT) targeting control protocol vulnerabilities. In recent years, the industrial control system network security range has become an important platform for verifying the effectiveness of defense measures, but the existing target construction technology has significant limitations.

[0003] The current mainstream scheme adopts a pure virtualization or full-physical device building mode. Although the pure virtualization target can simulate complex attack scenarios, it cannot truly reflect key security issues such as firmware vulnerabilities and hardware interface risks of physical devices; and the full-physical device target construction is costly and difficult to reproduce large-scale chain failure scenarios. This fragmentation leads to a deviation between the test results and the actual production environment, especially for key scenarios such as generator set coordinated control and excitation system protection that require high-precision physical feedback, the simulation degree is insufficient.

[0004] In terms of protocol layer interaction, the industrial control system on the power generation side generally exists in a multi-protocol heterogeneous environment such as Modbus / TCP, IEC 104, and PROFINET. The existing virtual-real combination scheme usually uses a protocol gateway for simple forwarding, lacks deep analysis of protocol semantics (such as function code permissions and data point dimensions), and causes state synchronization distortion between the virtual model and the physical device. For example, the millisecond-level voltage fluctuation signal output by the excitation controller is often simplified to a static value in the virtual environment, making attack tests targeting control cycle timing ineffective.

[0005] More critically, the existing target has security defects in the bidirectional mapping of attack behavior: attack instructions initiated from the virtual layer are difficult to adapt to the protocol specifications and security mechanisms specific to physical devices, which may trigger device malfunctions; and abnormal states fed back by physical devices cannot be accurately reconstructed in the virtual layer. This leads to new threats such as ransomware penetration of DCS systems in power plants and GOOSE protocol replay attacks, which are difficult to effectively verify. SUMMARY

[0006] The purpose of the embodiments of the present application is to provide a power generation side industrial control system network security target building method based on virtual-real combination, which realizes the secure coupling of virtual instructions and physical devices and the lossless synchronization of states in attack testing by constructing a closed-loop target environment with high-fidelity protocol semantic analysis and bidirectional dynamic mapping.

[0007] To address the aforementioned technical problems, a first aspect of this invention provides a method for constructing a cybersecurity target for a power generation-side industrial control system based on a combination of virtual and real-world methods, comprising the following steps:

[0008] A virtual-real combined target environment is constructed, consisting of a physical device layer and a virtual model layer, wherein the physical device layer contains the real hardware devices of the power generation side industrial control system, and the virtual model layer contains the digital simulation model of the power generation side industrial control system.

[0009] The heterogeneous industrial control protocol between the physical device layer and the virtual model layer is parsed, the protocol semantic information is extracted, and a bidirectional dynamic mapping rule between the physical device state and the virtual model state is generated based on the protocol semantic information.

[0010] Based on the state change events of the physical device layer, and in accordance with the bidirectional dynamic mapping rules, the changed device state data is synchronized to the virtual model layer in real time, and the protocol behavior logic corresponding to the device state data is simulated in the virtual model layer according to the security test requirements.

[0011] Based on the attack instructions or abnormal status signals generated by the virtual model layer, the instructions or signals are converted into executable control commands according to the protocol specification format of the target physical device, and the physical device layer is driven to perform the operation corresponding to the control commands.

[0012] Furthermore, the protocol semantic information includes function codes, data point types, and address mapping relationships;

[0013] The process of parsing the heterogeneous industrial control protocol between the physical device layer and the virtual model layer and extracting protocol semantic information includes:

[0014] Identify the protocol fingerprint features of the heterogeneous industrial control protocol, wherein the protocol fingerprint features include a protocol type identifier and a version number;

[0015] Based on the identified protocol fingerprint features, the corresponding protocol syntax rule base is loaded, and lexical analysis and syntax parsing operations are performed on the communication message to extract the function code field, data point type field and address mapping field in the communication message;

[0016] The extracted fields are semantically validated according to the physical dimension conversion rules, time synchronization accuracy requirements, and control command permission rules of the power generation side industrial control system.

[0017] The function code, data point type, and address mapping relationship that pass semantic verification will be output as executable protocol semantic information.

[0018] Furthermore, the bidirectional dynamic mapping rule for generating the physical device state and the virtual model state based on the protocol semantic information includes:

[0019] Based on the address mapping relationship in the protocol semantic information, a mapping unit between physical devices and virtual models is defined. Each mapping unit contains the physical device address and the corresponding virtual model logical address.

[0020] Based on the data point types in the protocol semantic information, a conversion relationship between physical device state variables and virtual model state variables is established. The conversion relationship includes the dimension normalization function of analog quantities and the Boolean logic judgment rules of state variables.

[0021] Configure bidirectional triggering conditions based on the function code permission level in the protocol semantic information. The bidirectional triggering conditions include a real-time threshold for synchronizing with the virtual model layer when the physical device state changes, and security verification rules for virtual model instructions to drive physical devices to execute.

[0022] The mapping unit, transformation relationship, and bidirectional triggering condition are compiled into a set of state mapping instructions that can be executed by the heterogeneous protocol bidirectional drive engine.

[0023] Furthermore, the step of synchronizing the changing device status data to the virtual model layer in real time according to the bidirectional dynamic mapping rule includes:

[0024] Obtain the source device address and changed data value of the state change event in the physical device layer, and match the corresponding virtual model logical address according to the mapping unit in the bidirectional dynamic mapping rule;

[0025] The transformation relationship in the bidirectional dynamic mapping rule is invoked to standardize the changed data value, including performing a dimensional standardization function transformation on the analog quantity and applying Boolean logic judgment rules to the state quantity;

[0026] Based on the real-time threshold configured in the bidirectional dynamic mapping rules, the standardized data is written to the matching virtual model logical address through the heterogeneous protocol bidirectional driving engine.

[0027] When a data write conflict or rule verification failure is detected, a device status synchronization anomaly alarm event is generated based on the security verification rules, and the current write operation is terminated.

[0028] Furthermore, the standardization process for the changed data values ​​by invoking the transformation relationship in the bidirectional dynamic mapping rule includes performing a dimensional standardization function transformation on the analog quantity and applying Boolean logic judgment rules to the state quantity, including:

[0029] Based on the raw data values ​​collected in real time by physical equipment and their associated equipment range metadata, the normalization coefficients of the dimensional standardization function are dynamically generated. The equipment range metadata includes the minimum range value, maximum range value and engineering unit dimension of the physical equipment as specified by the factory.

[0030] Based on the physical constraints of the power generation side industrial control system, a boundary verification function for analog quantity conversion is constructed. During the normalization process, the deviation rate between the original data value and the allowable value range of the physical constraints is calculated in real time. When the deviation rate exceeds the preset safe operation threshold, the abnormal interruption mechanism of the dimension conversion is triggered and the current data synchronization process is frozen.

[0031] For the Boolean logic judgment rules of state variables, combined with the state machine context information of the target virtual model, the judgment logic branch that matches the current device operation mode is dynamically loaded. The state machine context information includes the device start-stop phase identifier, fault chain reaction rules and safety interlock protection enable status predefined in the virtual model.

[0032] After performing Boolean logic judgment, a traceable data packet containing the original state value, judgment result value and judgment logic version number is generated, and the traceable data packet is written into the historical operation audit log of the virtual model layer, and at the same time serves as a data integrity verification credential triggered by the real-time threshold.

[0033] Furthermore, the step of writing the standardized data to the matching virtual model logical address through the heterogeneous protocol bidirectional driving engine includes:

[0034] Based on the communication protocol type identifier of the target virtual model logical address, the corresponding protocol stack driver model is dynamically loaded and the protocol session channel is initialized. The protocol stack driver model includes protocol-specific data encapsulation functions, error retransmission mechanisms, and session keep-alive heartbeat period parameters.

[0035] Based on the real-time threshold configured in the bidirectional dynamic mapping rules, a multi-protocol concurrent write priority scheduling queue is constructed. The write priority scheduling queue allocates transmission time slots according to the control loop response timeliness level of the power generation side industrial control system. Among them, logical address write requests involving equipment safety interlock protection are given the highest interrupt response priority.

[0036] When performing a data write operation, the security rule set verification logic preset in the protocol stack driver model is triggered synchronously. The security rule set includes data value range conflict detection rules, virtual model address access permission matrix and historical operation frequency circuit breaker threshold. If the verification fails, a write protection abnormal signal is fed back to the physical device layer.

[0037] Once the data is successfully written to the virtual model logical address, a transaction log is generated containing the source device address, target logical address, protocol type identifier, and security rule verification status. The transaction log is then synchronized in real time to the control unit event cache of the physical device layer, driving the control unit to update its local state mapping table.

[0038] Furthermore, the attack instructions or abnormal status signals generated based on the virtual model layer are converted into executable control commands according to the protocol specification format of the target physical device, including:

[0039] The semantic structure of the attack command is analyzed, and the command elements containing the operation object identifier, attack action type and attack parameter sequence are extracted. The protocol function code selection decision tree is dynamically constructed based on the real-time operation mode of the target physical device. The real-time operation mode is jointly determined by the current start / stop status of the physical device layer, the load rate and the protection device enable / disable status.

[0040] According to the frame structure constraints in the protocol specification format, the instruction elements are transformed into original instruction frames that conform to the target device communication protocol. At the same time, a security verification rule set generated by bidirectional dynamic mapping rules is injected. The security verification rule set includes instruction permission whitelist verification function, device status interlock condition verification function, and instruction timing continuity verification function.

[0041] Before the original command frame is sent to the physical device layer, the impact of the original command frame on the target device is simulated in a pre-execution sandbox environment. Based on the deviation between the predicted device state value in the simulation results and the real-time state of the physical device layer, the attack parameter sequence in the command frame is dynamically corrected. The deviation is calculated by weighting the device response time constant and process coupling coefficient unique to the power generation side industrial control system.

[0042] An auditable instruction package is generated, which includes the original instruction frame, the corrected instruction frame, and the pre-execution deviation report. The auditable instruction package is matched and verified against the historical attack scenario feature library of the virtual model layer. Only when the matching verification is successful and all items of the security verification rule set are verified, the corrected instruction frame is released to the physical device layer for execution.

[0043] Furthermore, the step of simulating the protocol behavior logic corresponding to the device state data in the virtual model layer according to security testing requirements includes:

[0044] Based on real-time synchronized device status data stream, the protocol behavior feature vector of physical device layer communication messages is dynamically extracted. The protocol behavior feature vector includes function code call frequency distribution matrix, data packet transmission time jitter rate and abnormal retransmission event count.

[0045] The protocol behavior feature vector is input into a pre-trained protocol state machine mirror model, which is a behavior model trained based on historical protocol communication logs, to generate a set of behavior simulation parameters including protocol session state transition paths, data integrity verification anomaly modes, and device response latency baselines.

[0046] In the virtual model layer, a protocol stack simulation environment isomorphic to the physical device layer is instantiated. The behavior strategy of the protocol stack is dynamically configured according to the behavior simulation parameter set. The behavior strategy includes a normal communication mode and an anomaly injection strategy for security testing. The anomaly injection strategy is limited to the vulnerability characteristics of the power generation industrial control protocol.

[0047] When the protocol behavior logic is detected to deviate from the expected security test target or the actual feature vector threshold of the physical device layer during the simulation, the protocol stack parameter adaptive calibration mechanism is triggered. The weight coefficients of the protocol state machine mirror model are dynamically adjusted through the gradient descent algorithm until the deviation converges to the safety tolerance range.

[0048] Furthermore, the operation of driving the physical device layer to execute the control command includes:

[0049] When control commands are transmitted to the physical device execution unit, the operating status monitoring data of the execution unit is collected in real time. Based on the boundary thresholds in the factory safety technical specifications of the power generation equipment, the equipment operation risk index of the current command execution path is calculated. The equipment operation risk index is defined as the percentage difference between the actual operating data and the maximum allowable operating value.

[0050] When the equipment operation risk index is lower than the preset risk threshold, the execution sequence of the control command is automatically reorganized according to the power generation system topology: the original command is broken down into multiple sub-commands, which are executed step by step through preset safety control nodes, and the execution interval of each sub-command is dynamically adjusted according to the equipment physical characteristic parameters.

[0051] During execution, the rate of change of equipment operation risk indicators is continuously monitored. If the rate of change exceeds the preset safety dynamic range, an execution interruption request is immediately sent to the virtual model layer and the local protection program of the physical device is activated.

[0052] After the command is executed, an execution report is generated, which includes the actual operation risk trajectory, execution interruption event records, and equipment operation load records. The execution report is compared with the benchmark parameters in the equipment life decay model constructed based on the stress-life curve, and the simulation impact assessment parameters of the target training on the equipment operation status are output. The execution report is then written into the historical operation audit log of the virtual model layer.

[0053] Accordingly, a second aspect of the present invention provides an electronic device, including: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute a method for building a network security target for a power generation side industrial control system based on virtual and real integration.

[0054] Accordingly, a third aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-described method for building a network security target for a power generation-side industrial control system based on a combination of virtual and real technologies.

[0055] The above-described technical solutions of the embodiments of the present invention have the following beneficial technical effects:

[0056] 1. Deeply analyze the semantics of heterogeneous protocols and establish bidirectional dynamic mapping rules. By extracting protocol semantic information such as function code permissions, data point dimensions, and address mapping relationships, and constructing bidirectional dynamic mapping rules including dimension standardization functions, Boolean logic rules, and real-time thresholds, this solves the problem of virtual layer and physical layer state synchronization distortion in multi-protocol (such as IEC 104, PROFINET) environments of power generation side industrial control systems. For example, millisecond-level voltage fluctuation signals of physical equipment can be accurately converted into dynamic values ​​in the virtual model, avoiding static simplification errors (such as excitation control signal distortion) caused by the lack of protocol semantics in traditional solutions. At the same time, through real-time threshold control and boundary verification functions, it ensures that the synchronization process conforms to the physical constraints of power generation equipment (such as range safety thresholds), significantly improving the test reliability against timing attacks (such as control cycle tampering).

[0057] 2. Based on the protocol specification-based security instruction conversion and pre-execution sandbox mechanism, attack instructions generated in the virtual layer (such as ransomware penetration logic) need to be reconstructed through the protocol function code decision tree and injected with security verification rule sets such as permission whitelists and device interlocks. Then, the physical device response is simulated through the pre-execution sandbox (such as predicting device state deviation). This mechanism achieves the first compatibility conversion between attack instructions and physical protocol specifications, avoiding the risk of device malfunction due to insufficient protocol compatibility in traditional solutions (such as false triggering of GOOSE protocol replay attacks). At the same time, the matching verification between the pre-execution deviation report and the historical attack scenario library ensures that the parameter sequence has been corrected before the instruction is released to the physical device, forming a closed-loop test link of "virtual attack → physical response → abnormal feedback → virtual reconstruction", effectively verifying the complete penetration path of APT attacks at the protocol layer.

[0058] 3. Equipment operation risk indicators drive protection and life assessment. When physical equipment executes attack commands, it calculates equipment operation risk indicators (such as the deviation rate between operating data and the maximum allowable value) in real time and dynamically reorganizes the command execution sequence based on the power generation system topology (such as disassembling sub-commands and adjusting execution intervals). When the risk change rate exceeds the limit, execution is immediately interrupted and local protection programs are activated (such as excitation system overvoltage protection), and the interruption event is simultaneously fed back to the virtual layer. This overcomes the blind spots of traditional targets in the security protection of physical equipment, especially for high-risk scenarios such as generator set coordinated control. The equipment life degradation assessment report generated after execution quantifies the impact of target testing on equipment operating status by comparing it with the stress-life curve benchmark parameters, providing data support for the optimization of security protection strategies. Attached Figure Description

[0059] Figure 1 This is a flowchart of a method for building a network security target for a power generation-side industrial control system based on a combination of virtual and real data, provided in an embodiment of the present invention. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0061] Please refer to Figure 1 The first aspect of this invention provides a method for constructing a cybersecurity target for a power generation-side industrial control system based on a combination of virtual and real technologies, comprising the following steps:

[0062] Step S100: Construct a virtual-real combined target environment consisting of a physical device layer and a virtual model layer, wherein the physical device layer contains the real hardware devices of the power generation side industrial control system, and the virtual model layer contains the digital simulation model of the power generation side industrial control system.

[0063] A target infrastructure is established, consisting of a physical device layer and a virtual model layer. The physical device layer integrates real hardware devices from the power generation side industrial control system (such as excitation controllers and DCS control stations), ensuring that physical characteristics such as hardware firmware vulnerabilities and interface risks can be accurately reproduced. The virtual model layer constructs simulation models (such as generator set coordination control models) that are functionally equivalent to the physical devices through digital simulation technology, supporting dynamic reconfiguration of large-scale complex scenarios. By providing realistic device responses through the physical layer and expanding the flexibility of test scenarios through the virtual layer, a complementary test foundation is formed.

[0064] Step S200: The heterogeneous industrial control protocol between the physical device layer and the virtual model layer is parsed, the protocol semantic information is extracted, and a bidirectional dynamic mapping rule between the physical device state and the virtual model state is generated based on the protocol semantic information.

[0065] For heterogeneous environments with multiple protocols on the power generation side (such as Modbus / TCP, IEC 104), this step completes three core operations: First, it identifies protocol fingerprint features (type identifier / version number), parses communication messages based on a pre-built syntax rule base, and extracts semantic elements such as function code permissions, data point dimensions, and address mapping relationships; second, it performs semantic verification on fields through physical dimension conversion rules and time synchronization accuracy requirements to eliminate state distortion caused by protocol misunderstandings in traditional solutions; finally, based on the verified semantic information, it constructs a dynamic mapping instruction set that includes physical-virtual address mapping units, state quantity conversion relationships (analog quantity normalization functions / state quantity Boolean logic rules), and bidirectional triggering conditions (real-time thresholds / security verification rules), providing a rule engine for cross-layer state synchronization.

[0066] Step S300: Based on the state change events of the physical device layer, and according to the bidirectional dynamic mapping rules, the changed device state data is synchronized to the virtual model layer in real time, and the protocol behavior logic corresponding to the device state data is simulated in the virtual model layer according to the security test requirements.

[0067] Real-time synchronization and protocol behavior simulation from physical state to the virtual layer are achieved: When a state change occurs in the physical device layer (such as excitation voltage fluctuation), the virtual logical address is matched according to the mapping rules generated by S200, and the original data is standardized (analog quantities are dynamically normalized according to the device range, and state quantities are combined with the virtual model state machine context for Boolean judgment). The processed data is written to the virtual layer according to the real-time threshold through the heterogeneous protocol driver engine, while data conflicts are detected and security alarms are triggered. In the virtual layer, protocol behavior feature vectors (function code call frequency, transmission time jitter rate) are extracted based on the synchronous data stream, input into the pre-trained protocol state machine mirror model, and the protocol stack behavior strategy is dynamically configured (normal communication mode or anomaly injection strategy limited to power generation protocol vulnerabilities) to achieve high-fidelity protocol-level reproduction of physical signals such as millisecond-level voltage fluctuations.

[0068] Step S400: Based on the attack instructions or abnormal status signals generated by the virtual model layer, the instructions or signals are converted into executable control commands according to the protocol specification format of the target physical device, and the physical device layer is driven to execute the operation corresponding to the control commands.

[0069] This step completes the secure drive from virtual attack commands to physical devices: parsing the semantics of attack commands (operation target / attack type / parameter sequence), constructing a protocol function code decision tree based on the target device's real-time operating mode (start / stop status / load rate); converting command elements into raw command frames according to device protocol specifications, and injecting a security verification rule set (permission whitelist / device interlock conditions); simulating the impact of commands on physical devices through pre-execution sandbox, and dynamically correcting attack parameters based on predicted state deviation; after the verified command frames are released to the physical layer, real-time monitoring of device operating risk indicators (device deviation rate between actual operating conditions and security thresholds) is conducted, and device security is ensured through mechanisms such as command decomposition, execution timing reassembly, and local protection program activation, ultimately generating a device lifespan degradation assessment report.

[0070] By employing deep semantic parsing of protocols and bidirectional dynamic mapping rules, we have overcome industry challenges such as the synchronization distortion between virtual models and physical device states in traditional targets (e.g., millisecond-level fluctuations in excitation signals are statically simplified) and the disconnect between attack commands and physical protocol specifications (e.g., GOOSE replay attacks mistakenly trigger device actions). We have constructed a closed-loop verification chain of "attack command → virtual simulation → physical execution → state feedback," which enables the full-link reproduction of advanced threats such as ransomware penetration while ensuring device security. This significantly improves the realism of key scenario tests such as generator set coordinated control and the reliability of defense verification.

[0071] Specifically, step S200 involves parsing the heterogeneous industrial control protocol between the physical device layer and the virtual model layer, extracting protocol semantic information including function codes, data point types, and address mapping relationships, including:

[0072] Step S211: Identify the protocol fingerprint features of heterogeneous industrial control protocols. The protocol fingerprint features include a protocol type identifier and a version number.

[0073] By deeply analyzing the structural features and interaction patterns of communication messages, fingerprints of heterogeneous industrial control protocols are identified. Specifically, based on specific byte sequences in the message header (such as the function code identifier bit of Modbus / TCP), handshake process timing characteristics (such as the U-frame format start character of IEC 104), and protocol version declaration fields (such as the device identifier number of PROFINET), a protocol fingerprint containing a unique identifier for the protocol type (e.g., "MB / TCP-01" represents the Modbus TCP standard version) and a precise version number (e.g., "IEC104-2016") is extracted. This identification process supports real-time protocol classification in a multi-protocol hybrid environment on the power generation side, providing a basis for type matching for subsequent syntax parsing.

[0074] Step S212: Load the corresponding protocol syntax rule library based on the identified protocol fingerprint features, perform lexical analysis and syntax parsing operations on the communication message, and extract the function code field, data point type field and address mapping field from the communication message.

[0075] Based on the protocol fingerprint features identified by S211, a pre-built protocol syntax rule library (including lexical segmentation rules, syntax tree construction templates, and field location indexes) is dynamically loaded. Lexical analysis is performed on the original communication message: the message is segmented into the smallest semantic units (e.g., splitting the IEC 104 message into type identifier TI, variable structure qualifier VSQ, etc.); then, syntax parsing is performed: according to the frame structure hierarchy of the protocol specification (e.g., the context tree of PROFINET), the function code field (e.g., "0x06" in Modbus represents a write register operation), the data point type field (e.g., the 32-bit floating-point code of analog quantity AI or the Boolean bit identifier of status quantity DI), and the address mapping field (e.g., the mapping relationship from the device physical address "0x40001" to the logical point number "PV101") are located and extracted, realizing the accurate conversion from binary message to structured semantic elements.

[0076] Step S213: Perform semantic verification on the extracted fields according to the physical dimension conversion rules, time synchronization accuracy requirements, and control command permission rules of the power generation side industrial control system.

[0077] The extracted fields undergo triple semantic rule verification: First, the dimension conversion rules are verified based on the physical characteristics of the power generation equipment. For example, the original data value corresponding to the excitation voltage range (0-1000V) (such as the 12-bit AD sampling value 4095) needs to be converted to the engineering value dimension (750.2V). If the conversion result exceeds the safe operating range of the equipment, an invalid flag is triggered. Second, the time synchronization accuracy is verified. For control signals that require millisecond-level response, such as the GOOSE protocol, the deviation between the timestamp field and the target global clock is verified to be within the allowable threshold (such as ±2ms). Finally, the instruction permissions are verified according to the power generation control strategy. For example, the function code of the turbine speed regulation instruction can only be called by the high-level control layer when the unit is in grid-connected state. Fields that fail the verification will be discarded and an error log will be generated.

[0078] Step S214: Output the function code, data point type, and address mapping relationship that have passed semantic verification as executable protocol semantic information.

[0079] The verified protocol elements are transformed into executable semantic information objects: function codes are bound to permission levels (e.g., "0x10" write multi-register operation requires security level 3 authorization), data point types are associated with dimensional conversion functions (e.g., AI type is bound to the linear conversion formula of "AD value → engineering value"), and address mapping relationships are encapsulated into bidirectional lookup tables (supporting forward mapping and reverse indexing from physical address to virtual logical address). Finally, a standardized semantic information set is output for direct use by the subsequent bidirectional dynamic mapping engine.

[0080] By combining protocol fingerprinting with the collaborative parsing of a syntax rule base, the bottleneck of adapting to heterogeneous environments with multiple protocols in traditional solutions is overcome. Semantic verification is performed by combining the unique physical range, time accuracy, and control authority rules of the power generation side to eliminate state distortion caused by protocol misunderstanding (such as excitation voltage dimension conversion errors). Finally, executable protocol semantic information is generated, laying the foundation for high-fidelity state synchronization between the virtual model and physical equipment, especially solving the semantic consistency problem of millisecond-level control signals in cross-layer transmission.

[0081] Furthermore, the bidirectional dynamic mapping rule for generating the physical device state and the virtual model state based on protocol semantic information in step S200 includes:

[0082] Step S221: Define a mapping unit between physical devices and virtual models based on the address mapping relationship in the protocol semantic information. Each mapping unit contains the physical device address and the corresponding virtual model logical address.

[0083] Based on the address mapping relationships in the protocol semantic information, logical association units between physical devices and virtual models are constructed. Each mapping unit explicitly binds the specific hardware address of the physical device (such as the excitation controller register address "0x3001A") to the corresponding logical address identifier in the virtual model (such as "EXC_Voltage_Output" in the simulation system), forming bidirectionally indexable address pairs. This process fully considers the multi-node topology characteristics of power generation equipment, supports associating the same physical address with multiple virtual logical addresses (such as mapping the generator speed signal to both the coordination control model and the excitation protection model simultaneously), providing a precise addressing basis for cross-layer data synchronization.

[0084] Step S222: Establish the conversion relationship between physical device state variables and virtual model state variables based on the data point types in the protocol semantic information. The conversion relationship includes the dimensional standardization function of the analog quantity and the Boolean logic judgment rule of the state variable.

[0085] A differentiated conversion mechanism is designed based on the data point type: For analog quantities (such as turbine steam pressure values), a dimensional normalization function is dynamically generated based on the equipment's factory-calibrated range metadata (minimum range 0MPa - maximum range 25MPa) to convert the original AD sampled value (such as 16384) into a normalized value with engineering units (12.5MPa); for state quantities (such as circuit breaker opening and closing signals), Boolean logic decision rules are configured in conjunction with the virtual model's state machine context (such as unit start-up and shutdown phase identifiers). For example, in the "unit cold start" mode, the "closed ready" signal of the physical equipment is mapped to the "excitation allowed" state of the virtual layer. This step ensures that the physical signal characteristics are transmitted without loss in the virtual environment.

[0086] Step S223: Configure bidirectional triggering conditions based on the function code permission level in the protocol semantic information. The bidirectional triggering conditions include the real-time threshold for synchronizing with the virtual model layer when the physical device state changes, and the security verification rules for the virtual model instructions to drive the physical device to execute.

[0087] Dual constraints are set for function code permission levels: In the physical-to-virtual direction, a real-time threshold for state synchronization is defined (e.g., excitation voltage fluctuations must be synchronized to the virtual layer within 5ms); exceeding this timeout triggers a data failure flag. In the virtual-to-physical direction, a security verification rule chain is constructed. For example, when the virtual layer sends a "adjust excitation current" command, it must verify whether the target device is currently in "automatic control mode" and whether the load rate is below 90%; otherwise, command execution is blocked. The rule base is deeply integrated with the power generation system's security interlock logic (e.g., prohibiting power setpoint modification when the generator is disconnected), mitigating the risk of equipment malfunction at the protocol layer.

[0088] Step S224: Compile the mapping unit, transformation relationship and bidirectional triggering condition into a state mapping instruction set that can be executed by the heterogeneous protocol bidirectional drive engine.

[0089] The aforementioned mapping units, conversion relationships, and triggering conditions are compiled into a set of machine instructions executable by the heterogeneous protocol bidirectional drive engine. The instruction set adopts a layered structure: the address mapping layer implements real-time lookup of physical and logical addresses; the data conversion layer has a built-in library of dimensional calculation functions and state determination logic; and the execution control layer integrates real-time scheduling algorithms and security rule validators. Finally, a self-descriptive instruction packet (containing protocol type identifiers, version compatibility flags, and error handling pointers) is generated, directly driving the target engine to complete millisecond-level state synchronization and secure instruction forwarding.

[0090] By defining dynamic mapping units and designing state transition rules, the problem of virtual model distortion caused by physical signal characteristics (such as range nonlinearity) in the power generation side industrial control system is overcome. Based on the bidirectional trigger condition configuration of function code permissions, the deep coupling of virtual instructions and physical equipment security strategies (such as blocking excitation regulation instructions in unsafe states) is realized for the first time in the target. The compiled executable instruction set provides a highly reliable state synchronization engine for heterogeneous protocol environments, laying the foundation for accurate reproduction of advanced attack tests (such as time series attacks on excitation control).

[0091] Specifically, step S300, based on the bidirectional dynamic mapping rules, synchronizes the changing device status data to the virtual model layer in real time, including:

[0092] Step S311: Obtain the source device address and changed data value of the state change event in the physical device layer, and match the corresponding virtual model logical address according to the mapping unit in the bidirectional dynamic mapping rule.

[0093] When a device in the physical device layer experiences a state change and generates an event, the first step is to accurately capture the source of this change, i.e., obtain the address of the physical device that caused the state change event and the specific changed data value. Subsequently, a search and matching process is performed based on predefined and maintained "bidirectional dynamic mapping rules." The core component of these rules is the "mapping unit," which essentially establishes a clear, one-to-one correspondence or specific logical association between the physical device address and its corresponding logical address in the virtual model. By querying these mapping units, the unique logical address in the virtual model layer that represents the state of the device or a part of the device corresponding to the changed physical device address can be accurately found, laying the foundation for the target location in subsequent data synchronization.

[0094] Step S312: The transformation relationship in the bidirectional dynamic mapping rule is invoked to standardize the changed data value, including performing dimensional standardization function transformation on the analog quantity and applying Boolean logic judgment rules to the state quantity.

[0095] The focus is on performing necessary normalization processing on the original changed data values ​​to ensure that they can be correctly understood and consistently used by the virtual model layer. This involves invoking the pre-configured transformation relationship definitions for the specific data point in the "bidirectional dynamic mapping rules." The core purpose of this transformation is to achieve data standardization: for continuously changing analog data (such as temperature, pressure, flow rate, etc.), specific dimensional normalization functions are applied for conversion, such as uniformly converting original values ​​of different units (e.g., Fahrenheit to Celsius, psi to Bar) or different ranges to standard units or normalized values ​​agreed upon internally by the virtual model layer; for discrete state data (e.g., switch status, fault codes, etc.), Boolean logic judgment rules or other predefined enumeration mapping rules are applied to convert device-specific signal states (e.g., "1 / 0", "ON / OFF", "High / Medium / Low") into logical states uniformly recognized by the virtual model layer (e.g., "True / False", standardized status codes). This processing ensures that device data from different manufacturers and different protocols have consistent semantics and format within the virtual model layer.

[0096] Step S313: Based on the real-time threshold configured in the bidirectional dynamic mapping rules, the standardized data is written to the matching virtual model logical address through the heterogeneous protocol bidirectional driving engine.

[0097] Referring to the "real-time threshold" configured for this data point or data category in the "bidirectional dynamic mapping rules," this threshold defines the maximum allowable latency or the minimum required timeliness level for the data update, guiding the priority and scheduling strategy of data transmission. Then, the actual write operation is performed through a key component, the "heterogeneous protocol bidirectional drive engine." This engine can abstract and adapt to various underlying industrial communication protocols (such as Modbus, OPC UA, Profinet, MQTT, etc.), providing a unified interface and transmission mechanism. According to the rule requirements, and under the premise of meeting the real-time threshold constraints, the engine efficiently and accurately writes the data value, after standardization processing in step S312, into the virtual model logical address determined in step S311, thereby completing the real-time reflection of physical device state changes in the virtual model.

[0098] Step S314: When a data write conflict or rule verification failure is detected, a device status synchronization abnormality alarm event is generated based on the security verification rule and the current write operation is terminated.

[0099] During the data write operation in step S313, continuous status monitoring and rule verification are performed. If a potential data write conflict is detected (e.g., the virtual model target address is updated simultaneously by multiple sources, resulting in inconsistent data versions, or the written value violates the data range or type constraints defined in the model), or if the final verification before writing according to the "bidirectional dynamic mapping rules" fails (e.g., the converted data violates business rules or security policies), an exception handling process will be triggered immediately. This process generates a detailed device status synchronization exception alarm event based on preset "security verification rules." This event includes information such as the error type, relevant device address, model address, and conflicting data values, used to notify maintenance personnel or upper-level systems. More importantly, as a security measure, the current write operation will be immediately terminated to prevent erroneous or conflicting data from polluting the virtual model, ensuring the consistency and reliability of the virtual model's state, and awaiting manual intervention or a higher-level error recovery mechanism.

[0100] The above steps collectively constitute the core mechanism for real-time, accurate, and reliable synchronization of physical device states to the virtual model layer in a digital twin system. Through a rule-driven automated process, a closed-loop, bidirectional, and mappable real-time transmission of state changes between physical entities and the virtual model is achieved. Specifically: mapping rules ensure precise correspondence between the positional relationships of physical devices and virtual model elements; standardized transformations shield the heterogeneity of underlying devices, unify data semantics, and provide clean and consistent data input to the model layer; real-time thresholds and heterogeneous protocol engines guarantee reliable transmission of critical state updates within acceptable latency ranges, meeting the differentiated timeliness requirements of various application scenarios; and conflict detection and security circuit breaker mechanisms significantly enhance system robustness, effectively preventing the spread of erroneous data and maintaining the accuracy and authority of the virtual model as a trustworthy mirror of the physical world. Overall, these mechanisms are the key technological foundation supporting the real-time performance, fidelity, and reliable operation of digital twins.

[0101] Furthermore, step S312 involves calling the transformation relationship in the bidirectional dynamic mapping rules to standardize the changed data values, including performing dimensional standardization function transformation on analog quantities and applying Boolean logic judgment rules to state quantities, including:

[0102] Step S312a: Based on the raw data values ​​collected in real time by the physical equipment and its associated equipment range metadata, the normalization coefficients of the dimensional standardization function are dynamically generated. The equipment range metadata includes the minimum range value, maximum range value and engineering unit dimension of the physical equipment as specified at the factory.

[0103] Based on the raw data values ​​collected in real time by physical equipment, and combined with the equipment range metadata associated with that data point (including the minimum and maximum range values ​​calibrated by the equipment at the factory, as well as the original engineering unit dimensions, such as 0-1000℃, 4-20mA), the normalization coefficients required for the dimensional standardization function are automatically generated. These coefficients linearly or non-linearly map the numerical values ​​of the original equipment's specific range and unit to the standardized dimensions defined in the virtual model layer (such as relative values ​​of 0-1.0 or standard SI units), ensuring that the same type of data from different sources and with different ranges is expressed and calculated in the virtual model using a unified benchmark.

[0104] Step S312b: Construct a boundary verification function for analog quantity conversion based on the physical constraints of the power generation side industrial control system. During the normalization process, calculate the deviation rate between the original data value and the allowable value range of the physical constraints in real time. When the deviation rate exceeds the preset safe operation threshold, trigger the abnormal interruption mechanism of the dimension conversion and freeze the current data synchronization process.

[0105] A boundary verification function is constructed based on the actual physical constraints of the power generation side control system (such as maximum pipeline pressure, winding limit temperature, and rotor overspeed threshold). During normalization, this function calculates the deviation rate between the original data values ​​and the safe operating range allowed by the physical constraints in real time. Once the calculated deviation rate exceeds the preset safe operating threshold (indicating data anomalies or potential equipment hazards), a dimension conversion anomaly interruption mechanism is immediately triggered, halting the standardization process for the current data point and freezing the entire data synchronization process. This prevents invalid or hazardous data from contaminating the virtual model, allowing time for subsequent fault diagnosis and intervention.

[0106] Step S312c: Based on the Boolean logic judgment rules for the state variables, and combined with the state machine context information of the target virtual model, dynamically load the judgment logic branch that matches the current device operating mode. The state machine context information includes the device start / stop phase identifier, fault chain reaction rules, and safety interlock protection enable status predefined in the virtual model.

[0107] Boolean logic decisions for state variables (such as switches, valves, and fault signals) do not apply a fixed set of rules. Instead, they dynamically load the decision logic branch that best matches the current actual operating mode of the equipment, taking into account the state machine context information in the target virtual model (including predefined equipment start / stop phase identifiers, fault cascading reaction rule sets, and the enabled states of safety interlock protection functions). For example, the decision logic for the same "ready" signal may differ during equipment startup, normal operation, or emergency shutdown; when safety interlock protection is activated, the decision for a fault signal may trigger more stringent cascading actions. This dynamic loading ensures that the state decision results conform to the current actual operating scenario and constraints of the equipment.

[0108] Step S312d: After performing the Boolean logic judgment, a traceable data packet containing the original state value, the judgment result value, and the judgment logic version number is generated, and the traceable data packet is written into the historical operation audit log of the virtual model layer, and at the same time serves as a data integrity verification credential triggered by the real-time threshold.

[0109] After applying Boolean logic decision rules to derive the final state value, a structured, traceable data packet is generated. This data packet contains three key elements: the original, unprocessed device state value; the final state result value after processing by the decision rules; and the specific version identifier of the applied decision logic rule. This data packet is simultaneously written to a dedicated historical operation audit log in the virtual model layer for persistent storage, providing original evidence for post-event traceability, responsibility identification, and rule verification. Furthermore, this data packet also serves as credential for triggering data integrity verification based on real-time thresholds in subsequent steps (such as S313 real-time writing), ensuring that the write operation is based on a complete and verifiable decision result.

[0110] The above steps collectively constitute the core guarantee layer for the standardized processing of equipment status data in a digital twin system. Through multi-layered dynamic, secure, and auditable conversion mechanisms, the data quality, security, and reliability of the input virtual model are significantly improved. Specifically: dynamic dimensional normalization eliminates the impact of equipment heterogeneity, providing the model with analog quantity data of a unified benchmark; boundary security verification embeds domain knowledge (such as power generation control constraints) into the conversion process, proactively intercepting abnormal data and ensuring the security and rationality of the virtual model's state; context-aware state determination ensures that rule application closely follows the real-time operation stage and protection state of the equipment, greatly improving the business fit and decision accuracy of state quantity conversion; and traceable data packets establish a complete evidence chain from raw data to model state, satisfying strict operational audit compliance requirements and providing a reliable basis for data synchronization integrity verification. Overall, this mechanism is a key preprocessing step to ensure that the data in the digital twin virtual model is reliable, secure, and conforms to business scenarios.

[0111] Furthermore, step S313, which involves writing the standardized data to the matching virtual model logical address via a heterogeneous protocol bidirectional driving engine, includes:

[0112] Step S313a: Based on the communication protocol type identifier of the target virtual model logical address, dynamically load the corresponding protocol stack driver model and initialize the protocol session channel. The protocol stack driver model includes protocol-specific data encapsulation functions, error retransmission mechanisms, and session keep-alive heartbeat period parameters.

[0113] First, the communication protocol type identifier (such as OPCUA, Modbus-TCP, IEC-104, etc.) associated with the logical address of the target virtual model is parsed, and the corresponding protocol stack driver model is dynamically loaded accordingly. This model is a pre-built implementation library for a specific protocol, containing protocol-specific data encapsulation functions (responsible for converting standardized data into message formats conforming to the protocol specification), error retransmission mechanisms (ensuring transmission reliability, such as timeout retransmission and acknowledgment strategies), and session persistence heartbeat period parameters (defining the periodic signal intervals to maintain connection activity). After loading, a dedicated protocol session channel is initialized based on the target address and protocol requirements, establishing a stable, low-latency communication link for subsequent data transmission.

[0114] Step S313b: Based on the real-time threshold configured in the bidirectional dynamic mapping rules, a multi-protocol concurrent write priority scheduling queue is constructed. The write priority scheduling queue allocates transmission time slots according to the control loop response timeliness level of the power generation side industrial control system. Among them, logical address write requests involving equipment safety interlock protection are given the highest interrupt response priority.

[0115] Based on the real-time threshold configured for each data point in the "bidirectional dynamic mapping rules," a multi-protocol concurrent write priority scheduling queue is constructed. The core scheduling strategy of this queue is to dynamically allocate transmission time slots according to the business importance of the data point in the power generation side industrial control system (especially its impact on the timeliness level of the control loop response). For example, loop data that directly affects equipment safety or rapid control (such as speed, pressure, and protection signals) receive higher priority and shorter scheduling waiting times. Specifically, logical address write requests involving equipment safety interlock protection are given the highest interrupt response priority, ensuring that such critical safety state changes can immediately preempt transmission resources and be updated to the virtual model in near real-time, maximizing system safety.

[0116] In step S313c, when performing a data write operation, the security rule set verification logic preset in the protocol stack driver model is triggered synchronously. The security rule set includes data value range conflict detection rules, virtual model address access permission matrix and historical operation frequency circuit breaker threshold. If the verification fails, a write protection abnormal signal is fed back to the physical device layer.

[0117] Before or during the actual data write operation, the protocol stack driver model synchronously triggers the security rule set verification logic pre-set within the model. This rule set includes multiple layers of protection: data value range conflict detection rules (checking whether the written value is within the reasonable range defined by the virtual model to prevent exceeding the limit from damaging the model logic); virtual model address access permission matrix (verifying whether the current operating entity has the right to modify the target address); and historical operation frequency circuit breaker threshold (monitoring the write frequency to this address per unit time to prevent denial of service or data storms caused by abnormally high-frequency operations). If any verification fails, not only will the current write operation be aborted, but a write protection anomaly signal will also be immediately sent back to the source device or its controller at the physical device layer, notifying it of the synchronization status anomaly, thus achieving two-way protection.

[0118] Step S313d: After the data is successfully written to the virtual model logical address, a transaction log containing the source device address, target logical address, protocol type identifier and security rule verification status is generated. The transaction log is synchronized to the control unit event buffer of the physical device layer in real time, driving the control unit to update its local state mapping table.

[0119] Once data is successfully written to the target virtual model's logical address, a structured transaction log is automatically generated. This log records the key elements of this operation in detail: source device address (physical device identifier), target logical address (location in the virtual model), protocol type identifier (transmission protocol used), and security rule verification status (recording whether all security rules passed). This transaction log is not merely for archiving; it is synchronized in real-time to the control unit's event buffer at the physical device layer. Upon receiving this log, the control unit immediately updates its local state mapping table (typically referring to the device state image area maintained internally by controllers such as PLCs / DCS), ensuring that the physical device layer is clearly aware that its state changes have been accurately received and recorded by the virtual model layer. This maintains consistency in the physical side's understanding of the current state of the virtual model, providing an accurate benchmark for possible reverse control or state comparison.

[0120] The above steps jointly construct a cross - protocol, highly reliable, and strongly secure data writing execution engine in the digital twin system. Its technical effect essentially lies in achieving the accurate, efficient, and controlled injection of standardized data into the virtual model through protocol dynamic adaptation, intelligent scheduling, embedded security verification, and closed - loop confirmation mechanisms. Specifically, it is manifested as follows: The dynamic protocol stack loading shields the underlying communication complexity and ensures the connection reliability in heterogeneous environments; The intelligent scheduling based on real - time thresholds and business priorities guarantees the transmission timeliness of key data (especially safety interlock data) and meets the extremely fast response requirements of industrial control for critical events; The multi - dimensional security rule verification executed synchronously during writing constructs an active defense barrier at the protocol driver layer, effectively preventing illegal, unauthorized, or destructive writing, protecting the integrity of the virtual model, and feeding back anomalies to the physical layer for linkage protection; The closed - loop transaction log generated and issued after successful writing打通了 the information loop of "physical state change → virtual model update → physical layer confirmation", ensuring the strong consistency of the state mapping between the physical device layer and the virtual model layer and laying a trustworthy foundation for two - way interaction. Overall, this mechanism is the core transmission guarantee for the digital twin to achieve high - fidelity, high - real - time, and high - security state synchronization.

[0121] Further, the protocol behavior logic corresponding to simulating device status data according to security test requirements in the virtual model layer in step S300 includes:

[0122] Step S321, based on the real - time synchronized device status data stream, dynamically extract the protocol behavior feature vectors of the communication messages of the physical device layer. The protocol behavior feature vectors include the function code call frequency distribution matrix, the data packet transmission time jitter rate, and the abnormal re - transmission event count.

[0123] Based on the real - time synchronized device status data stream, dynamically parse the original communication messages of the physical device layer, extract the key behavior features therefrom, and construct protocol behavior feature vectors. This vector contains three - dimensional quantization metrics: the function code call frequency distribution matrix (statistically counting the call times and distribution rules of different protocol function codes within a unit time to reflect the device operation mode), the data packet transmission time jitter rate (calculating the deviation rate between the actual arrival time of the message and the theoretical period to measure communication stability), and the abnormal re - transmission event count (recording the number of data packet re - transmissions triggered by checksum failures or timeouts to indicate channel quality or device anomalies). These features jointly constitute the digital fingerprint of protocol communication behavior.

[0124] Step S322, input the protocol behavior feature vectors into a pre - trained protocol state machine mirror model. The protocol state machine mirror model is a behavior model trained based on historical protocol communication logs, and generate a set of behavior simulation parameters including the protocol session state transition path, the data integrity verification abnormal mode, and the device response delay baseline.

[0125] Note: There is an unclear part "打通了" in the original Chinese text. I translated it as "打通了" in a literal way for now. You may need to check and correct it according to the actual meaning.The protocol behavior feature vector extracted in step S321 is input into a pre-trained protocol state machine mirror model (this model is trained based on massive historical protocol communication logs and can simulate the communication behavior patterns of the device under various operating conditions). Based on this, the model infers and outputs a set of behavior simulation parameters. This parameter set contains three core parameters: protocol session state transition path (describing the temporal logic of protocol interactions in startup, operation, and maintenance states), data integrity verification anomaly mode (summarizing common verification error types and triggering conditions in historical communication), and device response latency baseline (establishing a latency distribution model for normal device response under different loads). These parameters provide data support for high-fidelity protocol simulation at the virtual model layer.

[0126] Step S323: Instantiate a protocol stack simulation environment that is isomorphic to the physical device layer in the virtual model layer, and dynamically configure the behavior strategy of the protocol stack according to the behavior simulation parameter set. The behavior strategy includes a normal communication mode and an exception injection strategy for security testing. The exception injection strategy is limited to the vulnerability characteristics of the power generation industrial control protocol, including: message tampering location distribution for the unit conversion field, time jitter retransmission mode based on the control cycle, and function code unauthorized call triggering conditions.

[0127] Instantiate a protocol stack simulation environment that is completely isomorphic to the physical device layer at the virtual model layer (e.g., simulating a PLC protocol stack from the same manufacturer). Based on the behavior simulation parameter set generated in step S322, dynamically configure the behavior strategy of the protocol stack: strictly follow the behavior baseline of the physical device in normal communication mode; activate the anomaly injection strategy in security test mode (this strategy is strictly limited to the typical vulnerability characteristics of power generation industrial control protocols), specifically including three types of targeted attack simulations: message tampering location distribution of the dimension conversion field (targeting specific offset tampering of the dimension field in analog transmission to test the robustness of dimension conversion), time jitter retransmission mode based on control cycle (injecting delayed or out-of-order messages in critical control cycles to test the fault tolerance capability of the real-time control system), and function code unauthorized call triggering conditions (attempting to execute high-authority function code operations with low-privilege identity to test the completeness of the access control mechanism).

[0128] Step S324: When the protocol behavior logic is detected to deviate from the expected security test target or the actual feature vector threshold of the physical device layer during the simulation, the protocol stack parameter adaptive calibration mechanism is triggered. The weight coefficients of the protocol state machine mirror model are dynamically adjusted through the gradient descent algorithm until the deviation converges to the safety tolerance range.

[0129] During the protocol behavior simulation, the protocol behavior logic of the virtual model layer is continuously monitored to see if it deviates from the expected security test target (such as vulnerability reproduction coverage) or the actual feature vector threshold of the physical device layer (such as the historical maximum jitter rate). Once a deviation is detected, an adaptive calibration mechanism for protocol stack parameters is immediately triggered: the gradient descent algorithm is used to dynamically adjust the weight coefficients of different features in the protocol state machine mirror model (such as increasing the weight of the impact of jitter rate on the state transition path), and through iterative optimization, the deviation between the simulated behavior and the target is gradually converged to the preset safety tolerance range (i.e., the maximum allowable behavioral deviation range), ensuring that the simulation results meet the test validity requirements without deviating from the real behavior boundary of the physical device.

[0130] A high-fidelity simulation technology system for protocol behavior in digital twin systems, geared towards security testing, was constructed. Its core value lies in achieving deep mirroring and controllable variation of the protocol communication behavior of physical devices through a closed-loop process of feature extraction, model-driven simulation, strategy-based simulation, and dynamic calibration. Specifically: real-time feature vectors provide a dynamic data foundation for simulation; the behavioral parameter set generated by the pre-trained model ensures consistency between the simulation logic and the historical behavior of the physical device; isomorphic protocol stacks and anomaly injection strategies enable security testing to accurately reproduce protocol-layer vulnerabilities unique to power generation industrial control scenarios (such as dimensional tampering, periodic jitter, and unauthorized operations); and the parameter adaptive calibration mechanism ensures that the simulation process remains controllable, effective, and within the boundaries of physical reality. Overall, this mechanism provides a repeatable, customizable, and high-fidelity virtualized verification environment for protocol security testing of power generation industrial control systems, significantly reducing the risks and costs of field testing.

[0131] Specifically, in step S400, the attack commands or abnormal status signals generated based on the virtual model layer are converted into executable control commands according to the protocol specification format of the target physical device, including:

[0132] Step S411: Parse the semantic structure of the attack command, extract the command elements containing the operation object identifier, attack action type and attack parameter sequence, and dynamically construct the protocol function code selection decision tree based on the real-time operation mode of the target physical device. The real-time operation mode is jointly determined by the current start / stop status of the physical device layer, the load rate and the protection device on / off status.

[0133] First, deep semantic analysis is performed on the attack commands to identify and separate key command components: clearly specifying the specific device or component to be operated (operation target identifier), requiring the device to perform a certain action or enter a certain abnormal state (attack action type), and the detailed control parameters required to perform the action or maintain the state (attack parameter sequence). Next, this step dynamically constructs a "protocol function code selection decision tree" based on the target physical device's current actual operating state—a dynamic scenario determined by multiple key state variables, including whether the device is running or shut down, the current actual load rate, and whether various protection devices (such as overload protection and short-circuit protection) are engaged (activated) or disengaged (disabled). This decision tree intelligently judges and selects the underlying communication protocol function code that best matches the current situation and accurately expresses the attack intent, laying the foundation for subsequently constructing specific command frames.

[0134] Step S412: Based on the frame structure constraints in the protocol specification format, the instruction elements are converted into original instruction frames that conform to the target device communication protocol. At the same time, a security verification rule set generated by bidirectional dynamic mapping rules is injected. The security verification rule set includes instruction permission whitelist verification function, device status interlock condition verification function, and instruction timing continuity verification function.

[0135] Based on the frame structure defined in the target device's communication protocol specification (such as start flag, address field, function code field, data field, checksum field, etc.), precise assembly is performed. The operation target identifier, attack action type, and attack parameter sequence are filled into the corresponding positions in the data field, and necessary address and checksum information are added to form a raw command frame that can be transmitted over the physical communication line. Simultaneously, a crucial step is to synchronously inject a security verification rule set generated by a "bidirectional dynamic mapping rule" during the command frame construction process. This rule set is not static but dynamically correlated with the virtual model layer's perception of the system state and the real-time feedback from the physical device layer. It mainly includes three types of real-time verification functions: command permission whitelist verification function (verifies whether the current request source has permission to execute this specific command on the target device), device state interlock condition verification function (verifies whether the target device's current state allows the execution of the command, such as whether the device is stopped but receives a start command, or whether protection has been activated but receives an operation command, etc.), and command timing continuity verification function (verifies whether the current command conforms to the expected operation flow sequence, preventing skipped or out-of-order operations). These security rules are embedded in the processing logic of the instruction frame before the instruction is sent, providing a basis for subsequent verification.

[0136] Step S413: Before the original command frame is sent to the physical device layer, the operation impact of the original command frame on the target device is simulated in the pre-execution sandbox environment. Based on the deviation between the predicted device state value in the simulation results and the real-time state of the physical device layer, the attack parameter sequence in the command frame is dynamically corrected. The deviation is calculated by weighting the device response time constant and process coupling coefficient unique to the power generation side industrial control system.

[0137] Before the original command frame is sent to the physical device for execution, a crucial "pre-execution sandbox" step is introduced for safety buffering and verification. This sandbox environment is a highly realistic simulation environment that receives the original command frame and simulates the complete operational impact of the command on the target physical device and its associated processes within a virtual environment. After the simulation runs, the sandbox outputs a series of predicted device state values ​​(such as key process parameters like voltage, current, speed, temperature, and valve opening). Subsequently, the deviation between these predicted state values ​​and the actual state values ​​reported in real time by the physical device layer through sensors is calculated. This deviation calculation is not a simple difference but fully considers the characteristics of the power generation side industrial control system, specifically introducing the device response time constant (characterizing the speed of the device's dynamic response) and the process coupling coefficient (characterizing the strength of the mutual influence between different process parameters) as weighting factors for a weighted comprehensive evaluation. Based on the calculated deviation, the attack parameter sequence in the original command frame is dynamically and specifically modified (e.g., adjusting the size of the set value, changing the rate of action, or limiting the scope of operation) to generate a "modified command frame" that is theoretically less impactful on the system, more in line with the expected attack effect, or safer. This aims to reduce the severe disturbances or unexpected risks that may be caused by directly executing the original command.

[0138] Step S414: Generate an auditable instruction package containing the original instruction frame, the corrected instruction frame, and the pre-execution deviation report. Match and verify the auditable instruction package with the historical attack scenario feature library of the virtual model layer. Only when the matching verification is successful and all items of the security verification rule set are verified, release the corrected instruction frame to the physical device layer for execution.

[0139] First, the original instruction frame, the instruction frame corrected after sandbox simulation and deviation calculation, and a pre-execution deviation report containing details of the deviation calculation and simulation prediction results are packaged into a complete "auditable instruction package," which has complete traceability information. Next, this instruction package is sent to the virtual model layer for matching and verification against a historical attack scenario feature library stored therein. This verification aims to identify whether the behavior pattern of the current instruction package matches known, verified as high-risk, or anomalous attack patterns. Only when two strict conditions are met simultaneously will the corrected instruction frame be finally released to the physical device layer for execution: first, the matching verification result with the historical attack scenario feature library is "passed" (or no high-risk pattern was matched); second, all items in the security verification rule set injected in step S412 (including three verification functions: permission whitelist, state interlock, and temporal continuity) pass the verification. If any verification fails, the instruction frame will be intercepted. This dual verification mechanism significantly raises the security threshold for instruction execution.

[0140] Through the synergistic effects of dynamic environment adaptation, structured encapsulation and security rule embedding, pre-execution simulation and dynamic parameter correction, and dual verification auditing, the security, controllability, and auditability of injecting instructions into the physical device layer are significantly improved. This effectively reduces the risk of malicious or abnormal instructions causing physical device malfunctions, damage, or cascading failures due to protocol adaptation errors, privilege escalation, state conflicts, timing disorders, or improper parameters. In particular, by introducing pre-execution sandbox simulation and deviation-weighted assessment based on device characteristics, the impact of instruction execution on actual processes can be proactively predicted and mitigated, demonstrating a strong guarantee capability for the operational security of critical infrastructure. Simultaneously, the generated auditable instruction package provides detailed evidence for post-event traceability analysis, strengthening the overall defense depth.

[0141] Specifically, the operation corresponding to the control command executed by the physical device layer in step S400 includes:

[0142] Step S421: When the control command is transmitted to the physical device execution unit, the operation status monitoring data of the execution unit is collected in real time. Based on the boundary threshold in the factory safety technical specification of the power generation equipment, the equipment operation risk index of the current command execution path is calculated. The equipment operation risk index is defined as the percentage difference between the actual operating data and the maximum allowable operating value.

[0143] When a control command (usually a modified instruction frame processed by steps S411-S414) is transmitted to the execution unit of the target physical device (such as a motor controller, valve actuator, etc.), real-time monitoring data of the execution unit and its associated equipment (such as key operating parameters like current, voltage, temperature, pressure, speed, vibration, etc.) are simultaneously collected. Subsequently, based strictly on the various operating boundary thresholds (such as maximum allowable current, maximum allowable temperature, safe speed range, etc.) specified in the safety technical specifications defined at the time of manufacture of the power generation equipment, the real-time operating risk index of the equipment under the current control command execution path is calculated. This index is explicitly defined as: the difference between the actual value of a key operating condition data point currently collected by the equipment and the maximum allowable operating value in the corresponding safety technical specifications, further converted into a percentage of this difference relative to the maximum allowable operating value. For example, if the current temperature of a motor winding is 85℃, and the maximum allowable temperature in the specifications is 95℃, then the risk index is (95-85) / 95*100%≈10.53%. This percentage value intuitively reflects the "buffer space" between the current operating conditions and the safety boundary. The lower the risk index, the closer it is to the upper limit, and the higher the risk.

[0144] Step S422: When the equipment operation risk index is lower than the preset risk threshold, the execution sequence of the control command is automatically reorganized according to the power generation system topology: the original command is broken down into multiple sub-commands, which are executed step by step through preset safety control nodes, and the execution interval of each sub-command is dynamically adjusted according to the equipment physical characteristic parameters.

[0145] When the current equipment's operational risk index is determined to be below a preset risk threshold (this threshold is usually set below the safety boundary to provide a safety margin), it means that the equipment has room for operation, but the risk is relatively controllable or requires cautious operation. In this case, the original control command is not executed directly. Instead, based on the topology of the entire power generation system (such as a power plant) (reflecting the physical connections, functional dependencies, and energy flow relationships between equipment), the original single control command is intelligently and automatically broken down and reassembled into multiple logically equivalent but physically step-by-step, ordered sub-command sequences. These sub-commands are sent step-by-step to the target execution unit through preset safety control nodes (which can be understood as logical points or physical controllers with monitoring and coordination capabilities). More importantly, the execution interval between each sub-command is not fixed but dynamically adjusted according to the physical characteristic parameters of the target equipment or related equipment (such as thermal time constant, mechanical inertia, fluid response time, etc.). For example, for a command involving the start-up of high-power equipment, the execution interval of the broken-down sub-commands may be lengthened to allow sufficient time for parameters such as equipment temperature and stress to reach a new stable state, avoiding a surge in instantaneous risk index due to excessively rapid operation.

[0146] Step S423: During the execution process, continuously monitor the rate of change of the equipment operation risk indicators. If the rate of change exceeds the preset safety dynamic range, immediately send an execution interruption request to the virtual model layer and activate the local protection program of the physical device.

[0147] Not only does it continuously monitor the equipment's operational risk indicators, but more importantly, it calculates the rate of change of these risk indicators in real time (i.e., the speed at which the risk indicator rises or falls per unit time). Once the rate of change of a risk indicator exceeds the preset safe dynamic range (which defines the boundary of the permissible and safe rate of rise or fall of the risk indicator), it indicates that the equipment state is undergoing an abnormally drastic or unexpected change, which may be about to trigger or has already triggered a problem (such as accelerated equipment overload, sudden temperature rise, etc.). At this time, dual protection measures are immediately taken: First, an execution interruption request is sent to the virtual model layer, requesting the upper-level system to terminate the sending of subsequent commands (or sub-commands); second, the local protection program built into the target physical device is activated directly at the same time. These local protection programs are preset safety logics in the equipment firmware or underlying control system (such as overcurrent protection tripping, over-temperature shutdown, vibration over-limit shutdown, etc.), which aim to force the equipment into a safe state (such as shutdown, load reduction) as quickly as possible and along the shortest path, preventing the accident from escalating and buying time for subsequent manual intervention.

[0148] Step S424: After the command execution is completed, an execution report is generated that includes the actual operation risk trajectory, execution interruption event records and equipment operation load records. The execution report is compared with the benchmark parameters in the equipment life decay model built based on the stress-life curve. The simulation impact assessment parameters of the target training on the equipment operating status are output, and the execution report is written to the historical operation audit log of the virtual model layer.

[0149] Regardless of whether the command is fully executed, a detailed execution report is generated. This report includes at least: the actual trajectory of equipment operating risk indicators over time during command execution (risk trajectory); whether any interruption events occurred during execution (triggered by step S423) and their specific records (time, cause, triggered protective actions, etc.); and key operating load records of the equipment during command execution (such as power output, flow rate, pressure, etc.). Subsequently, the data in this report, especially the actual operating risk trajectory and equipment load records, are compared and analyzed with the benchmark parameters defined in the equipment life decay model constructed based on the equipment's "stress-life curve." The stress-life curve describes the decay law of the fatigue life of the equipment under mechanical or thermal stress (load) of different magnitudes and frequencies. By comparing the actual operating load / stress with the model benchmark, the simulated impact of the execution process of this specific control command on the actual operating life of the equipment can be quantitatively assessed, outputting one or a set of "simulated impact assessment parameters of target training on equipment operating status." These parameters reveal the "cost" of this operation in terms of the long-term health of the equipment. Finally, this execution report, which includes raw data, analysis results, and evaluation parameters, is fully written into the historical operation audit log of the virtual model layer, providing a valuable historical data foundation for subsequent audit trails, performance analysis, model optimization (such as updating the life decay model), and risk prediction.

[0150] The steps described above (S421-S424) collectively construct a closed-loop, adaptive, and safety-first control command execution assurance system for the physical execution layer of power generation equipment. Through real-time risk quantification, risk- and topology-based elastic command reconfiguration, dynamic rate-of-change monitoring and rapid circuit breaker protection, and progressive protection through post-execution impact assessment and knowledge accumulation, the safety, reliability, and sustainability of executing control commands (especially potentially disruptive instructions) on physical equipment are significantly enhanced. This mechanism proactively senses real-time risks during operation, dynamically adjusts execution strategies to smooth out impacts and distribute loads, and triggers local protection at millisecond speeds when abnormally accelerated risk changes are detected, minimizing equipment damage or system crashes. In-depth post-execution analysis not only provides audit evidence of operational compliance and safety, but more importantly, by comparing actual operational data with equipment lifespan models, it quantitatively assesses the impact of operations on the long-term health of the equipment, providing a scientific basis for optimizing future operational strategies and extending equipment lifespan, thus achieving a balance between operational safety and long-term asset reliability.

[0151] Accordingly, a second aspect of the present invention provides an electronic device, including: at least one processor and a memory connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, cause the at least one processor to execute a method for building a cybersecurity target for a power generation-side industrial control system based on a virtual-real hybrid architecture.

[0152] Accordingly, a third aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-described method for building a network security target for a power generation-side industrial control system based on a combination of virtual and real technologies.

[0153] The embodiments of the present invention aim to protect a method for building a cybersecurity target for a power generation-side industrial control system based on a combination of virtual and real technologies, and have the following effects:

[0154] 1. Deeply analyze the semantics of heterogeneous protocols and establish bidirectional dynamic mapping rules. By extracting protocol semantic information such as function code permissions, data point dimensions, and address mapping relationships, and constructing bidirectional dynamic mapping rules including dimension standardization functions, Boolean logic rules, and real-time thresholds, this solves the problem of virtual layer and physical layer state synchronization distortion in multi-protocol (such as IEC 104, PROFINET) environments of power generation side industrial control systems. For example, millisecond-level voltage fluctuation signals of physical equipment can be accurately converted into dynamic values ​​in the virtual model, avoiding static simplification errors (such as excitation control signal distortion) caused by the lack of protocol semantics in traditional solutions. At the same time, through real-time threshold control and boundary verification functions, it ensures that the synchronization process conforms to the physical constraints of power generation equipment (such as range safety thresholds), significantly improving the test reliability against timing attacks (such as control cycle tampering).

[0155] 2. Based on the protocol specification-based security instruction conversion and pre-execution sandbox mechanism, attack instructions generated in the virtual layer (such as ransomware penetration logic) need to be reconstructed through the protocol function code decision tree and injected with security verification rule sets such as permission whitelists and device interlocks. Then, the physical device response is simulated through the pre-execution sandbox (such as predicting device state deviation). This mechanism achieves the first compatibility conversion between attack instructions and physical protocol specifications, avoiding the risk of device malfunction due to insufficient protocol compatibility in traditional solutions (such as false triggering of GOOSE protocol replay attacks). At the same time, the matching verification between the pre-execution deviation report and the historical attack scenario library ensures that the parameter sequence has been corrected before the instruction is released to the physical device, forming a closed-loop test link of "virtual attack → physical response → abnormal feedback → virtual reconstruction", effectively verifying the complete penetration path of APT attacks at the protocol layer.

[0156] 3. Equipment operation risk indicators drive protection and life assessment. When physical equipment executes attack commands, it calculates equipment operation risk indicators (such as the deviation rate between operating data and the maximum allowable value) in real time and dynamically reorganizes the command execution sequence based on the power generation system topology (such as disassembling sub-commands and adjusting execution intervals). When the risk change rate exceeds the limit, execution is immediately interrupted and local protection programs are activated (such as excitation system overvoltage protection), and the interruption event is simultaneously fed back to the virtual layer. This overcomes the blind spots of traditional targets in the security protection of physical equipment, especially for high-risk scenarios such as generator set coordinated control. The equipment life degradation assessment report generated after execution quantifies the impact of target testing on equipment operating status by comparing it with the stress-life curve benchmark parameters, providing data support for the optimization of security protection strategies.

[0157] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0159] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0160] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for constructing a cybersecurity target for a power generation-side industrial control system based on a combination of virtual and real-world technologies, characterized in that... Includes the following steps: A virtual-real combined target environment is constructed, consisting of a physical device layer and a virtual model layer, wherein the physical device layer contains the real hardware devices of the power generation side industrial control system, and the virtual model layer contains the digital simulation model of the power generation side industrial control system. The heterogeneous industrial control protocol between the physical device layer and the virtual model layer is parsed, the protocol semantic information is extracted, and a bidirectional dynamic mapping rule between the physical device state and the virtual model state is generated based on the protocol semantic information. Based on the state change events of the physical device layer, and in accordance with the bidirectional dynamic mapping rules, the changed device state data is synchronized to the virtual model layer in real time, and the protocol behavior logic corresponding to the device state data is simulated in the virtual model layer according to the security test requirements. Based on the attack instructions or abnormal status signals generated by the virtual model layer, the instructions or signals are converted into executable control commands according to the protocol specification format of the target physical device, and the physical device layer is driven to perform the operation corresponding to the control commands.

2. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies according to claim 1, characterized in that, The protocol semantic information includes function codes, data point types, and address mapping relationships; The process of parsing the heterogeneous industrial control protocol between the physical device layer and the virtual model layer and extracting protocol semantic information includes: Identify the protocol fingerprint features of the heterogeneous industrial control protocol, wherein the protocol fingerprint features include a protocol type identifier and a version number; Based on the identified protocol fingerprint features, the corresponding protocol syntax rule base is loaded, and lexical analysis and syntax parsing operations are performed on the communication message to extract the function code field, data point type field and address mapping field in the communication message; The extracted fields are semantically validated according to the physical dimension conversion rules, time synchronization accuracy requirements, and control command permission rules of the power generation side industrial control system. The function code, data point type, and address mapping relationship that pass semantic verification will be output as executable protocol semantic information.

3. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies according to claim 1, characterized in that, The bidirectional dynamic mapping rules for generating physical device states and virtual model states based on the protocol semantic information include: Based on the address mapping relationship in the protocol semantic information, a mapping unit between physical devices and virtual models is defined. Each mapping unit contains the physical device address and the corresponding virtual model logical address. Based on the data point types in the protocol semantic information, a conversion relationship between physical device state quantities and virtual model state quantities is established. The conversion relationship includes the dimension normalization function of analog quantities and the Boolean logic judgment rules of state quantities. Configure bidirectional triggering conditions based on the function code permission level in the protocol semantic information. The bidirectional triggering conditions include a real-time threshold for synchronizing with the virtual model layer when the physical device state changes, and security verification rules for virtual model instructions to drive physical devices to execute. The mapping unit, transformation relationship, and bidirectional triggering condition are compiled into a set of state mapping instructions that can be executed by the heterogeneous protocol bidirectional drive engine.

4. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies according to claim 3, characterized in that, The step of synchronizing the changing device status data to the virtual model layer in real time according to the bidirectional dynamic mapping rule includes: Obtain the source device address and changed data value of the state change event in the physical device layer, and match the corresponding virtual model logical address according to the mapping unit in the bidirectional dynamic mapping rule; The transformation relationship in the bidirectional dynamic mapping rule is invoked to standardize the changed data value, including performing a dimensional standardization function transformation on the analog quantity and applying Boolean logic judgment rules to the state quantity; Based on the real-time threshold configured in the bidirectional dynamic mapping rules, the standardized data is written to the matching virtual model logical address through the heterogeneous protocol bidirectional driving engine. When a data write conflict or rule verification failure is detected, a device status synchronization anomaly alarm event is generated based on the security verification rules, and the current write operation is terminated.

5. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies according to claim 4, characterized in that, The standardization of changed data values ​​by invoking the transformation relationship in the bidirectional dynamic mapping rule includes performing dimensional standardization function transformation on analog quantities and applying Boolean logic judgment rules to state quantities, including: Based on the raw data values ​​collected in real time by physical equipment and their associated equipment range metadata, the normalization coefficients of the dimensional standardization function are dynamically generated. The equipment range metadata includes the minimum range value, maximum range value and engineering unit dimension of the physical equipment as specified by the factory. Based on the physical constraints of the power generation side industrial control system, a boundary verification function for analog quantity conversion is constructed. During the normalization process, the deviation rate between the original data value and the allowable value range of the physical constraints is calculated in real time. When the deviation rate exceeds the preset safe operation threshold, the abnormal interruption mechanism of the dimension conversion is triggered and the current data synchronization process is frozen. For the Boolean logic judgment rules of state variables, combined with the state machine context information of the target virtual model, the judgment logic branch that matches the current device operation mode is dynamically loaded. The state machine context information includes the device start-stop phase identifier, fault chain reaction rules and safety interlock protection enable status predefined in the virtual model. After performing Boolean logic judgment, a traceable data packet containing the original state value, judgment result value and judgment logic version number is generated, and the traceable data packet is written into the historical operation audit log of the virtual model layer, and at the same time serves as a data integrity verification credential triggered by the real-time threshold.

6. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies according to claim 4, characterized in that, The step of writing the standardized data to the matching virtual model logical address through the heterogeneous protocol bidirectional driving engine includes: Based on the communication protocol type identifier of the target virtual model logical address, the corresponding protocol stack driver model is dynamically loaded and the protocol session channel is initialized. The protocol stack driver model includes protocol-specific data encapsulation functions, error retransmission mechanisms, and session keep-alive heartbeat period parameters. Based on the real-time threshold configured in the bidirectional dynamic mapping rules, a multi-protocol concurrent write priority scheduling queue is constructed. The write priority scheduling queue allocates transmission time slots according to the control loop response timeliness level of the power generation side industrial control system. Among them, logical address write requests involving equipment safety interlock protection are given the highest interrupt response priority. When performing a data write operation, the security rule set verification logic preset in the protocol stack driver model is triggered synchronously. The security rule set includes data value range conflict detection rules, virtual model address access permission matrix and historical operation frequency circuit breaker threshold. If the verification fails, a write protection abnormal signal is fed back to the physical device layer. Once the data is successfully written to the virtual model logical address, a transaction log is generated containing the source device address, target logical address, protocol type identifier, and security rule verification status. The transaction log is then synchronized in real time to the control unit event cache of the physical device layer, driving the control unit to update its local state mapping table.

7. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies, as described in any one of claims 1-6, is characterized in that... The attack commands or abnormal status signals generated based on the virtual model layer are converted into executable control commands according to the protocol specification format of the target physical device, including: The semantic structure of the attack command is analyzed, and the command elements containing the operation object identifier, attack action type and attack parameter sequence are extracted. The protocol function code selection decision tree is dynamically constructed based on the real-time operation mode of the target physical device. The real-time operation mode is jointly determined by the current start / stop status of the physical device layer, the load rate and the protection device enable / disable status. According to the frame structure constraints in the protocol specification format, the instruction elements are transformed into original instruction frames that conform to the target device communication protocol. At the same time, a security verification rule set generated by bidirectional dynamic mapping rules is injected. The security verification rule set includes instruction permission whitelist verification function, device status interlock condition verification function, and instruction timing continuity verification function. Before the original command frame is sent to the physical device layer, the impact of the original command frame on the target device is simulated in a pre-execution sandbox environment. Based on the deviation between the predicted device state value in the simulation results and the real-time state of the physical device layer, the attack parameter sequence in the command frame is dynamically corrected. The deviation is calculated by weighting the device response time constant and process coupling coefficient unique to the power generation side industrial control system. An auditable instruction package is generated, which includes the original instruction frame, the corrected instruction frame, and the pre-execution deviation report. The auditable instruction package is matched and verified against the historical attack scenario feature library of the virtual model layer. Only when the matching verification is successful and all items of the security verification rule set are verified, the corrected instruction frame is released to the physical device layer for execution.

8. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world technologies according to claim 7, characterized in that, The step of simulating the protocol behavior logic corresponding to the device state data in the virtual model layer according to security testing requirements includes: Based on real-time synchronized device status data stream, the protocol behavior feature vector of physical device layer communication messages is dynamically extracted. The protocol behavior feature vector includes function code call frequency distribution matrix, data packet transmission time jitter rate and abnormal retransmission event count. The protocol behavior feature vector is input into a pre-trained protocol state machine mirror model, which is a behavior model trained based on historical protocol communication logs, to generate a set of behavior simulation parameters including protocol session state transition paths, data integrity verification anomaly modes, and device response latency baselines. In the virtual model layer, a protocol stack simulation environment isomorphic to the physical device layer is instantiated. The behavior strategy of the protocol stack is dynamically configured according to the behavior simulation parameter set. The behavior strategy includes a normal communication mode and an anomaly injection strategy for security testing. The anomaly injection strategy is limited to the vulnerability characteristics of the power generation industrial control protocol. When the protocol behavior logic is detected to deviate from the expected security test target or the actual feature vector threshold of the physical device layer during the simulation, the protocol stack parameter adaptive calibration mechanism is triggered. The weight coefficients of the protocol state machine mirror model are dynamically adjusted through the gradient descent algorithm until the deviation converges to the safety tolerance range.

9. The method for constructing a network security target for a power generation-side industrial control system based on a combination of virtual and real-world methods, as described in claim 8, is characterized in that... The operation of driving the physical device layer to execute the control command includes: When control commands are transmitted to the physical device execution unit, the operating status monitoring data of the execution unit is collected in real time. Based on the boundary thresholds in the factory safety technical specifications of the power generation equipment, the equipment operation risk index of the current command execution path is calculated. The equipment operation risk index is defined as the percentage difference between the actual operating data and the maximum allowable operating value. When the equipment operation risk index is lower than the preset risk threshold, the execution sequence of the control command is automatically reorganized according to the power generation system topology: the original command is broken down into multiple sub-commands, which are executed step by step through preset safety control nodes, and the execution interval of each sub-command is dynamically adjusted according to the equipment physical characteristic parameters. During execution, the rate of change of equipment operation risk indicators is continuously monitored. If the rate of change exceeds the preset safety dynamic range, an execution interruption request is immediately sent to the virtual model layer and the local protection program of the physical device is activated. After the command is executed, an execution report is generated, which includes the actual operation risk trajectory, execution interruption event records, and equipment operation load records. The execution report is compared with the benchmark parameters in the equipment life decay model constructed based on the stress-life curve, and the simulation impact assessment parameters of the target training on the equipment operation status are output. The execution report is then written into the historical operation audit log of the virtual model layer.

10. An electronic device, characterized in that, include: At least one processor; And a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute the method for building a network security target for a power generation side industrial control system based on virtual-real integration as described in any one of claims 1-9.

Images