Industrial Control Threat Detection System Based on Threat Intelligence Enhanced Map

Abstract

This invention relates to the field of network security technology, specifically to an industrial control threat detection system based on an enhanced threat intelligence graph. The system includes: collecting and parsing multi-source industrial data to generate a feature stream; constructing a threat intelligence graph to identify entities and relationships; performing correlation reasoning and attack path prediction based on the graph structure; multi-agent collaborative allocation of defense tasks to implement blocking and isolation; and achieving closed-loop security control through result verification and feedback. This invention constructs a spatiotemporally correlated data stream by parsing industrial communication messages and extracting multi-dimensional features. Combined with a threat intelligence database, it achieves dynamic mapping of threat entities and attributes to form an evolutionary graph. Based on the graph topology, it performs path search and risk assessment to predict attack paths. Multi-agent collaborative decision-making is introduced to decompose and execute defense tasks in parallel, improving response efficiency. Closed-loop feedback verifies the results and updates the knowledge base, enabling adaptive optimization and continuous evolution of the defense system.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to an industrial control threat detection system based on threat intelligence-enhanced graphs. Background Technology

[0002] Industrial control systems are core technology systems supporting the operation of critical infrastructures such as energy, manufacturing, transportation, and water resource management. They rely on monitoring and data acquisition systems and programmable logic controllers (PLCs) to achieve coordinated control of physical equipment and software. Due to the deep integration of operational and information technologies, the attack surface of industrial control systems has significantly expanded, leading to frequent targeted cyberattacks. Typical examples include worm viruses damaging centrifuges and power outages caused by grid attacks. These security threats not only cause significant economic losses but also directly impact public safety. Research in this field focuses on building efficient defense systems, improving the protection of industrial assets through structured recording of attackers' tactics, techniques, and processes, as well as real-time network traffic monitoring and analysis.

[0003] The Industrial Control Threat Intelligence Detection and Response System is a key solution for addressing the aforementioned threats, primarily encompassing technical aspects such as asset discovery, traffic analysis, intelligence archiving, and decision support. Specifically, it employs a structured framework-based attack behavior recording mechanism to classify and describe security threats; it acquires network visualization data through a real-time monitoring platform to achieve initial identification of abnormal traffic; and it utilizes a domain knowledge base to provide search support for analysts, assisting them in completing correlation analysis from threat entities to mitigation measures. In terms of processing flow, the system integrates system logs, threat reports, and technical entries to build a complete defense chain, thereby reducing the risks posed by security incidents.

[0004] Existing technologies primarily rely on static knowledge bases or isolated indicators, requiring significant manual intervention when handling heterogeneous data associations. The overall automation level and response speed of the processing flow have room for improvement. Furthermore, the interaction process is highly dependent on technical terminology, and differences in analyst experience can impact response efficiency. The depth of structured logical derivation across entities is limited, making the process of deriving a complete defense strategy from a single dimension cumbersome. In addition, some solutions based on general models exhibit biases in knowledge consistency under specific industrial scenarios, limiting the reliability of the results. Existing systems have weak dynamic optimization capabilities in response to user feedback and environmental changes, and the collaborative efficiency and decision quality of a single decision module when processing complex multi-dimensional queries in parallel require further optimization. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing an industrial control threat detection system based on threat intelligence enhancement graphs.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an industrial control threat detection system based on an enhanced threat intelligence map, the system comprising: The industrial site multi-source heterogeneous data acquisition module connects to the programmable logic controller and monitoring and acquisition system in the industrial control network through a physical interface, acquires communication messages and system logs, and parses the message payload according to a preset protocol to extract the source address, destination address, control command and physical parameter feature vectors to generate a real-time data stream sequence for the industrial site. The threat intelligence dynamic graph construction module calls the real-time data stream sequence of the industrial site, compares the blacklist and attack signature in the preset threat intelligence knowledge base, identifies threat entities and attributes, maps entities to nodes and interactions to directed edges and assigns weights, and generates an enhanced industrial control threat intelligence graph. The cross-domain correlation reasoning and attack path prediction module acquires the threat intelligence enhancement graph, extracts the neighborhood subgraph of abnormal nodes, calculates the propagation probability using a path search algorithm, and matches the attacker's tactical and technical process library entries to generate a potential attack path prediction set. The multi-agent collaborative response decision module, based on the potential attack path prediction set, calls the security agent agent to evaluate key assets, allocates defense tasks through a consensus algorithm, completes operations such as blocking connections, updating firewalls and isolating devices, and generates a multi-dimensional collaborative defense response strategy. The knowledge consistency verification and feedback module, based on the results of the multi-dimensional collaborative defense response strategy, classifies and organizes the system status data after the response, compares it with the preset security benchmark standard, determines the system recovery location, and forms a closed-loop feedback result for industrial control threat detection.

[0007] As a further aspect of the present invention, the real-time data stream sequence in the industrial field includes message timestamps, protocol type identifiers, instruction opcodes, and physical quantity offset values; the industrial control threat intelligence enhancement graph operation includes threat entity nodes, attack attribute tags, interactive association edges, and dynamic weight coefficients; the potential attack path prediction set includes starting attack nodes, intermediate jump paths, target damaged assets, and path confidence scores; the multi-dimensional collaborative defense response strategy includes task allocation indexes, instruction execution sequences, and feedback verification identifiers; and the closed-loop feedback result of industrial control threat detection includes consistency verification tags, current security margin indicators, and knowledge base update suggestions.

[0008] As a further aspect of the present invention, the industrial field multi-source heterogeneous data acquisition module includes: The communication message interception submodule acquires continuous communication data packets on the industrial Ethernet bus through the mirror port, arranges them according to the packet encapsulation order, identifies and removes damaged or duplicate data frames using a preset integrity verification algorithm, retains the effective payload that meets the preset length requirement, establishes an ordered message sequence, and generates a continuous valid communication record sequence. The semantic feature extraction submodule, based on the continuous valid communication record sequence, calls a preset industrial protocol parsing plugin to map the fields in each record item, identify the function code and address segment in the control field, normalize the physical quantity data, and convert the unstructured message data into a feature vector containing semantic information to generate a message semantic feature set. The spatiotemporal feature fusion submodule extracts the time stamp and physical location identifier corresponding to each feature vector according to the message semantic feature set, identifies the associated data items of different physical locations within the same time window, merges the evolution features of the time dimension and the distribution features of the spatial dimension into a matrix, constructs a multi-dimensional feature mapping matrix, and generates a real-time data stream sequence of the industrial site.

[0009] As a further aspect of the present invention, the threat intelligence dynamic graph construction module includes: The intelligence entity identification submodule acquires each marked feature item in the real-time data stream sequence of the industrial site, sequentially traverses the feature vector content, extracts the corresponding IP address, device model, process name and operation behavior data, compares the fields with the preset global threat intelligence database, identifies the malicious indicators present, constructs an entity index set, and generates a list of security threat entity identifiers. The association mapping submodule, based on the security threat entity identifier list, calls the interaction records in the real-time data stream, performs topological mapping on the source entity and destination entity corresponding to each group of interaction behaviors, extracts the access frequency, data transmission volume and connection duration between entities, performs weighted calculation on these indicators to determine the edge strength, constructs the logical association structure between entities, and generates a threat association mapping graph. The dynamic evolution submodule of the graph, based on the threat association mapping, sequentially compares the overlap between temporary nodes generated by newly accessed data streams and existing graph structures, identifies node items whose start and end times and interaction characteristics have changed, performs incremental updates according to the time dimension, and counts all node records that meet the evolution conditions, marks the topology state and merges similar entities, and generates an enhanced industrial control threat intelligence graph.

[0010] As a further aspect of the present invention, the cross-domain association reasoning and attack path prediction module includes: The abnormal node location submodule acquires real-time operating status data from the industrial control threat intelligence enhancement map, performs anomaly detection on the acquired records according to equipment type, filters records whose index values ​​deviate from the preset baseline range, adds anomaly level identifier and topology location number to each record in turn, establishes cross-domain association data format, and generates regional abnormal entity record set. The path derivation engine submodule, based on the regional abnormal entity record set, calls the directed edge information and attack feature vector in the graph, traverses the action items contained in each group of records according to the attack stage dimension, and multiplies and aggregates the probability values ​​under the same attack sequence, and outputs the attack success probability, potential loss estimate and propagation speed index in the path in sequence, and integrates them into a path combination item with a unified structure to generate three types of attack path structure sets. The path confidence assessment submodule, based on the three types of attack path structure sets, sequentially calls the indicator combination items between different predicted paths, determines the numerical differences between each combination item in dimensions such as confidence, coverage and threat level, classifies the levels according to the preset risk matrix, classifies the path items whose assessment results are in the preset high-risk range into the core monitoring category, marks the priority number to which they belong, establishes a predicted path mapping set, and generates a potential attack path prediction set.

[0011] As a further aspect of the present invention, the multi-agent cooperative response decision module includes: The task decomposition and execution submodule identifies all path items with the same attribution label in sequence based on the response requirements with consistent priority in the potential attack path prediction set, collects and processes the defense requirement field and establishes a task index table, organizes the operation instructions under the same defense target into a unified set structure, assigns a corresponding agent identification number to each set, and generates a collaborative task execution index group. The decision information collection submodule calls the feedback data of the collaborative task execution index group and the security agent intelligence to collect and process the execution status records of each intelligence under various tasks. According to the task index, it locates the available resource data of the corresponding intelligence and integrates them into a decision matrix structure corresponding to the task number and intelligence number. It also adds a task priority field to generate a response decision comparison matrix. The strategy optimization and screening submodule, based on the response decision comparison matrix, sequentially detects the changing trend of the execution effect record of each response instruction in the corresponding environment, judges the defense gain value under continuous operation items, selects the strategy number whose gain amplitude is within the preset preferred range threshold, and re-archives and organizes the screened defense actions to establish a response identifier set and generate a multi-dimensional collaborative defense response strategy.

[0012] As a further aspect of the present invention, the knowledge consistency verification and feedback module includes: The status data processing submodule calls the current status content of each execution unit in the multi-dimensional collaborative defense response strategy, reads the operating parameter fields recorded under each device in sequence, performs field merging and format standardization operations on all recorded content, establishes a unified index according to the device number, sorts the data according to the data acquisition time, outputs a status dataset with a consistent structure, and generates a current matrix of device operating status. The safety benchmark matching submodule, based on the current operating status matrix of the equipment, calls the safety level standard items set in the industrial control industry standard, compares each operating indicator in the matrix with the corresponding indicator item in each level item, performs item-by-item matching according to the field number, identifies the safety interval according to the standard value range, marks the corresponding safety level index, and generates a status performance level comparison table. The knowledge base labeling and updating submodule, based on the state performance level comparison table, sequentially counts the security distribution of the current system under each device dimension, determines whether the distribution has a consistent attribution, and if most indicators fall within the preset security stability range, then the defense logic is taken as the valid knowledge attribution and is reverse-labeled to the corresponding field of the threat intelligence knowledge base, establishing a dynamic evolution structure for industrial control and generating a closed-loop feedback result for industrial control threat detection.

[0013] This invention constructs a real-time data stream sequence with spatiotemporal correlation by parsing the protocol specifications and extracting multi-dimensional features from industrial field communication messages. Combined with structured entry matching in a threat intelligence database, it achieves dynamic mapping between threat entities and attack attributes at the graph level, constructing an enhanced graph with evolutionary capabilities. By running path search algorithms and risk assessment models on the graph topology, it achieves accurate prediction of attacker penetration paths, overcoming the problem of insufficient logical deduction depth caused by isolated indicator analysis in traditional solutions. This invention further introduces a multi-agent collaborative decision-making mechanism. Through task decomposition and consensus verification, it transforms complex defense response processes into parallel executable instruction sequences, significantly improving the system's response speed and decision quality when handling large-scale, multi-dimensional complex attacks. A closed-loop feedback module verifies the consistency of response effects, transforming effective defense experience into knowledge base entries in real time. This ensures that the detection strategy remains highly consistent with the dynamically changing industrial environment, achieving adaptive optimization and continuous evolution of the defense system. Attached Figure Description

[0014] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a flowchart illustrating the acquisition process of the multi-source heterogeneous data acquisition module for industrial sites according to the present invention. Figure 3 This is a flowchart illustrating the acquisition process of the threat intelligence dynamic graph construction module of the present invention. Figure 4 This is a flowchart illustrating the acquisition process of the cross-domain association reasoning and attack path prediction module of the present invention. Figure 5 This is a flowchart illustrating the acquisition process of the multi-agent collaborative response decision-making module of the present invention. Figure 6 This is a flowchart of the knowledge consistency verification and feedback module of the present invention. Detailed Implementation

[0015] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0016] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0017] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0018] Please see Figure 1 This invention provides a technical solution: an industrial control threat detection system based on an enhanced threat intelligence graph, the system comprising: The industrial site multi-source heterogeneous data acquisition module connects to the programmable logic controller and monitoring and acquisition system in the industrial control network through a physical interface, acquires real-time communication messages and system logs, parses the message payload according to the preset protocol, extracts the original feature vector containing source address, destination address, control command and physical parameters, and generates a real-time data stream sequence for the industrial site. The threat intelligence dynamic graph construction module calls the real-time data stream sequence of the industrial site, compares the blacklist entries in the preset threat intelligence knowledge base with the attack signature, identifies the threat entities and their associated attributes in the data stream, uses the graph construction algorithm to map the entities as graph nodes, maps the logical interactions between entities as directed edges, and assigns edge weights according to the interaction frequency to form an enhanced industrial control threat intelligence graph. The cross-domain correlation reasoning and attack path prediction module enhances the node topology in the graph by acquiring industrial control threat intelligence, extracts the neighborhood subgraph of the current abnormal node, calculates the propagation probability of abnormal behavior in the graph using a preset path search algorithm, and matches it with the structured entries in the attacker's tactics, techniques and processes library to form an attack chain derivation model and output a set of potential attack path predictions. The multi-agent collaborative response decision module, based on a set of potential attack path predictions, calls multiple security agent agents distributed in network nodes to evaluate key assets on the predicted paths, allocates defense tasks among the agents through a preset consensus algorithm, and sequentially completes the action process of blocking abnormal connections, updating firewall rules, and isolating infected devices, thereby generating a multi-dimensional collaborative defense response strategy. The knowledge consistency verification and feedback module, based on the results of the multi-dimensional collaborative defense response strategy, classifies and organizes the system status data after the response, compares it with the preset security benchmark standards, determines the system recovery location, and forms a closed-loop feedback result for industrial control threat detection.

[0019] The real-time data stream sequence in the industrial field includes message timestamps, protocol type identifiers, command opcodes, and physical quantity offsets. The industrial control threat intelligence enhancement graph operation includes threat entity nodes, attack attribute tags, interactive correlation edges, and dynamic weight coefficients. The potential attack path prediction set includes starting attack nodes, intermediate jump paths, target damaged assets, and path confidence scores. The multi-dimensional collaborative defense response strategy includes task allocation indexes, command execution sequences, and feedback verification identifiers. The closed-loop feedback results of industrial control threat detection include consistency verification tags, current security margin indicators, and knowledge base update suggestions. Please see Figure 2 The industrial site multi-source heterogeneous data acquisition module includes: The communication message interception submodule acquires continuous communication data packets on the industrial Ethernet bus through the mirror port, arranges them according to the packet encapsulation order, identifies and removes damaged or duplicate data frames using a preset integrity verification algorithm, retains the effective payload that meets the preset length requirement, establishes an ordered message sequence, and generates a continuous valid communication record sequence. Continuous communication data packets on the industrial Ethernet bus are acquired through a mirror port. During the data access phase, the system performs low-level preprocessing on the 10,000 consecutive Ethernet data packets, reading the timestamp and sequence number fields from the packet header and strictly arranging them in ascending order of packet sequence number. This step aims to provide a stable and orderly underlying traffic support environment for subsequent deep analysis. After sorting, a preset cyclic redundancy check (CRC) integrity verification algorithm is used to identify and remove damaged data frames. For the retained data frames, their source IP address, destination IP address, and transport layer sequence number are read sequentially. Data frames where all three are consistent and the timestamp difference is within the range of 0 milliseconds to 5 milliseconds are identified as duplicate redundant data and removed. Payloads with a length within the preset range of 64 bytes to 1518 bytes are retained and stored in an array in ascending order of timestamp, generating a continuous valid communication record sequence.

[0020] The semantic feature extraction submodule, based on a continuous and valid communication record sequence, calls a preset industrial protocol parsing plugin to map the fields in each record item, identify the function codes and address segments in the control fields, normalize the physical quantity data, and convert unstructured message data into feature vectors containing semantic information to generate a message semantic feature set. Based on a continuous and valid communication record sequence, this module sequentially reads the application layer network payload content from the record sequence. The system calls a preset communication protocol parsing plugin to perform deep mapping and segmentation of the fields in each record item. During this process, the 7th and 8th bytes in the control field are accurately identified as the 0x04 function code identifier, and the 22nd to 24th bytes are identified as the data block address segment, thus completing the initial structured stripping of unstructured data within the protocol. After stripping, the original temperature value data of the physical quantity 45.0 degrees Celsius in the corresponding address segment of the payload is further extracted. Using the maximum value of 85.0 degrees Celsius and the minimum value of 15.0 degrees Celsius in the acquired historical normal operating temperature data as interval endpoints, the current acquired physical quantity is substituted into the normalization process to obtain a normalized value of 0.429. These discrete message data are converted into a vector structure containing multi-dimensional semantic information such as function codes, address segments, and normalized values, generating a message semantic feature set.

[0021] The spatiotemporal feature fusion submodule extracts the time stamp and physical location identifier corresponding to each feature vector according to the message semantic feature set, identifies the associated data items of different physical locations within the same time window, merges the evolution features of the time dimension and the distribution features of the spatial dimension into a matrix, constructs a multi-dimensional feature mapping matrix, and generates a real-time data stream sequence of the industrial site.

[0022] Based on the semantic feature set of the messages, this module sequentially extracts the corresponding 1000-millisecond timestamps and physical device hardware address location identifiers within each multi-dimensional feature vector. In a multi-source, heterogeneous industrial environment, the system accurately identifies associated data items at different physical locations within the same time window. This cross-device spatiotemporal alignment mechanism effectively captures the implicit collaborative interaction states and potential communication cycle patterns between controllers scattered throughout the workshop. After completing the spatiotemporal alignment, the feature vectors within the aggregation group are horizontally merged according to the lexicographical order of their corresponding hardware addresses. The evolutionary features of the temporal dimension and the distribution features of the spatial dimension are deeply integrated; for example, feature vectors corresponding to different hardware addresses are captured and concatenated to construct a multi-dimensional feature mapping matrix. This result demonstrates that the unstructured communication traffic of various dispersed devices has been transformed into a unified temporal multi-dimensional feature format, generating a real-time data stream sequence for the industrial site.

[0023] Please see Figure 3 The threat intelligence dynamic graph construction module includes: The intelligence entity identification submodule acquires the marked feature items in the real-time data stream sequence of the industrial site, sequentially traverses the feature vector content, extracts the corresponding IP address, device model, process name and operation behavior data, compares the fields with the preset global threat intelligence database, identifies the malicious indicators present, constructs an entity index set, and generates a list of security threat entity identifiers. This module acquires the specific location indices of each marked feature item in the real-time data stream sequence from the industrial site, and sequentially traverses the internal data content of the multi-dimensional feature vector. According to preset length rules, it extracts the corresponding Internet Protocol address (192.168.1.10), specific device model, background process name, and specific operational behavior data. This data extraction process provides high-precision local feature elements for subsequent threat intelligence comparison, ensuring the integrity and usability of basic intelligence information. After extraction, a fixed-length 256-bit local feature hash value is generated from the above fields using a bitwise XOR hash algorithm. This hash value is then compared bitwise with the verified malicious indicator hash values ​​stored in the preset global threat intelligence database. When the Hamming distance is 0, the module accurately identifies the malicious indicator records, extracts the corresponding network address and process name, constructs an entity index set, and systematically registers it, generating a list of security threat entity identifiers.

[0024] The association mapping submodule, based on the security threat entity identifier list, calls the interaction records in the real-time data stream, performs topological mapping on the source entity and destination entity corresponding to each group of interaction behaviors, extracts the access frequency, data transmission volume and connection duration between entities, performs weighted calculation on these indicators to determine the edge strength, constructs the logical association structure between entities, and generates a threat association mapping graph. Based on the security threat entity identifier list, this module calls upon massive interaction log data from the real-time data stream. Deep topological mapping analysis is performed on the source network address entity A and the destination network address entity B corresponding to each group of interaction behaviors. The access frequency between entities is extracted as 450 times, the data transfer volume as 15.5MB, and the connection duration as 120 seconds. Simultaneously, the corresponding maximum observation values ​​obtained in the independent network sandbox verification are 1000 times, 50.0MB, and 300 seconds, respectively. After obtaining the basic indicators, the sandbox results are input into the principal component analysis stage to extract the variance proportions of the first three principal components, obtaining corresponding indicator weight values ​​of 0.5, 0.3, and 0.2, respectively. These extracted core indicators are weighted to determine the edge strength between network entities, and the comprehensive edge strength value of 0.407 is obtained by substituting the measured data. Based on this value, the logical association structure and directional access channels between related entities are constructed, generating a threat association mapping diagram.

[0025] The dynamic evolution submodule of the graph compares the overlap between temporary nodes generated by newly accessed data streams and existing graph structures according to the threat association mapping graph. It identifies node items whose start and end times and interaction characteristics have changed, performs incremental updates according to the time dimension, and counts all node records that meet the evolution conditions. It marks the topology status and merges similar entities to generate an enhanced industrial control threat intelligence graph.

[0026] Based on the enhanced industrial control threat intelligence map, the overlap between the set of temporary nodes generated by newly accessed data streams and the set of nodes in the previous time frame is compared sequentially. Newly accessed temporary nodes in the network are accurately identified through rigorous difference operations. By sampling the control network status for seven consecutive days, the 95th percentile of the natural fluctuation of edge strength is obtained, resulting in a change threshold of 0.15. This threshold provides a solid benchmark for the system to judge normal business fluctuations and potential abnormal structural evolution. After obtaining the benchmark, the absolute value of the difference in edge strength between consecutive time slices is compared with 0.15 to identify node items whose start and end times and interaction characteristics have changed significantly. Incremental updates are performed along the time dimension, and all node records that meet the evolution conditions are comprehensively statistically analyzed. Node items with the same device model and network addresses located in the same subnet segment are read, their topology status is marked, and similar entity attributes are merged to generate the enhanced industrial control threat intelligence map.

[0027] Please see Figure 4 The cross-domain correlation reasoning and attack path prediction module includes: The abnormal node location submodule acquires real-time operational status data from the industrial control threat intelligence enhancement map, performs anomaly detection on the acquired records according to equipment type, filters records whose index values ​​deviate from the preset baseline range, adds anomaly level identifier and topology location number to each record in turn, establishes cross-domain association data format, and generates regional abnormal entity record sets. This module acquires massive amounts of real-time operational status data from the enhanced industrial control threat intelligence map. It performs anomaly detection on the minute-by-minute core processor utilization parameters of workshop CNC machine tools, categorized by equipment type. A preset baseline range of 5% to 60% is set, and records with measured values ​​deviating from this range by 85% undergo in-depth filtering. This detection mechanism aims to quickly extract potentially compromised industrial control assets exhibiting abnormal resource consumption characteristics from complex background traffic. After identifying anomalous records, records exceeding the baseline by 0% to 20% are marked as Level 1 anomaly, 20% to 50% as Level 2, and greater than 50% as Level 3. Based on a measured exceedance rate of 41.67%, each record is assigned a Level 2 anomaly label. Simultaneously, the topological location number of the enhanced map's adjacency matrix is ​​bound to this record, establishing a cross-domain collaborative associated data structure format and generating a regional set of anomalous entity records.

[0028] The path derivation engine submodule, based on the regional abnormal entity record set, calls the directed edge information and attack feature vector in the graph, traverses and processes the action items contained in each group of records according to the attack stage dimension, and multiplies and aggregates the probability values ​​under the same attack sequence, and outputs the attack success probability, potential loss estimate and propagation speed index in the path in sequence, and integrates them into a path combination item with a unified structure to generate three types of attack path structure sets. Based on a regional anomaly entity record set, this module utilizes the directed edge topology information and extracted attack feature vectors from the graph. It systematically traverses the three sequential attack actions contained in each record group according to the attack lifecycle stage. Substituting the edge strength value of 0.407 obtained from the previous stage, it directly obtains a single action step success probability of 0.289. This derivation process transforms the static graph association structure into a dynamic attack penetration probability index, providing data support for subsequent predictions. After obtaining the initial probability, it combines the probability values ​​of 0.315 and 0.420 from the other two sequential steps, multiplying and aggregating the probability values ​​under the same attack sequence, outputting a total attack success probability of 0.038 within the path. It extracts the historical asset rating score of 85 for the corresponding node in the graph and combines it with the total probability to obtain a potential loss estimate of 3.23. It sums the edge transmission delays of all nodes within the path and calculates their reciprocal as a propagation speed index, integrating them into a unified path combination term to generate three types of attack path structure sets.

[0029] The path confidence assessment submodule, based on the three types of attack path structure sets, sequentially calls the indicator combinations between different predicted paths, determines the numerical differences between each combination of items in terms of confidence, coverage, and threat level, classifies the levels according to the preset risk matrix, classifies the path items whose assessment results are in the preset high-risk range into the core monitoring category, marks their priority number, establishes a predicted path mapping set, and generates a potential attack path prediction set.

[0030] Based on the three types of attack path structures, this module sequentially calls different combinations of indicators between predicted paths for comprehensive analysis. A sample set of 200 known network intrusion events is selected for multiple linear regression to obtain confidence weight coefficients of 0.65 and 0.35. Combining the previously output probability and loss data, the system determines the numerical differences between each combination of indicators in high-dimensional feature spaces such as confidence, coverage, and threat level, thus generating a comprehensive risk confidence evaluation value of 0.036. After obtaining the comprehensive evaluation value, it is standardized and classified according to a preset risk matrix. Values ​​less than 0.02 are defined as low-risk, 0.02 to 0.05 as medium-risk, and greater than 0.05 as high-risk. The evaluation result of 0.036 is determined to be within the preset medium-to-high-risk range. These high-risk path items are uniformly classified into the core monitoring resource pool. These paths are precisely labeled with a priority number of 2, establishing a mapping set of predicted paths and generating a set of potential attack path predictions.

[0031] Please see Figure 5 The multi-agent collaborative response decision-making module includes: The task decomposition and execution submodule identifies all path items with the same attribution label based on the response requirements with consistent priority in the potential attack path prediction set, collects and processes the defense requirement fields and establishes a task index table, organizes the operation instructions under the same defense target into a unified set structure, assigns an agent identification number to each set, and generates a collaborative task execution index group. Based on the high priority of emergency response needs within the potential attack path prediction set, this module sequentially identifies all threatened path items with the same attribute tag number of 2. The defense requirement fields contained within these paths are uniformly collected and preprocessed, extracting all defense path combinations with identical defense requirement strings, and establishing a global task index table based on this. This task decomposition process ensures that complex collaborative defense actions can be accurately broken down into atomic operations that can be executed by a single node. After task decomposition, micro-operation instructions such as blocking ports corresponding to the same defense target are organized into a highly unified hash table set structure. These operation instructions are assigned a unique identifier number to the corresponding security agent, clearly defining the dictionary key as the network address of the controlled device and the dictionary value as the specific action operation instruction set. Through this key-value pair binding relationship, the system achieves precise anchoring of defense strategies and front-line execution units, generating collaborative task execution index groups.

[0032] The decision information collection submodule calls the feedback data of the collaborative task execution index group and the security agent agent to collect and process the execution status records of each agent under various tasks. According to the task index, it locates the available resource data of the corresponding agent and integrates them into a decision matrix structure corresponding to the task number and agent number. It also adds a task priority field to generate a response decision comparison matrix. This module periodically aggregates the execution status records of each agent in various assigned tasks by invoking real-time feedback data from the collaborative task execution index group and security agent agents distributed at the edge. Based on the global task index table, it locates the current available resource data for each agent, including 1024MB of available memory and 75% core processor idle rate. This information aggregation mechanism establishes a status awareness channel between the management center and edge execution nodes, ensuring the scientific nature of resource scheduling. After completing resource status awareness, this available resource data is integrated with the corresponding specific task number into a two-dimensional array decision matrix structure containing multi-dimensional status features. To highlight the urgency of tasks, a task priority field with a value of 2 is directly appended to the last column of this decision matrix. This context-rich matrix structure allows the system to examine the carrying capacity and task load of each node from a global perspective, generating a response decision comparison matrix.

[0033] The strategy optimization and screening submodule, based on the response decision comparison matrix, sequentially detects the changing trend of the execution effect record of each response command in the corresponding environment, judges the defense gain value under continuous operation items, selects the strategy number whose gain amplitude is within the preset preferred range threshold, and re-archives and organizes the screened defense actions to establish a response identifier set and generate a multi-dimensional collaborative defense response strategy.

[0034] Based on the response decision comparison matrix, this module sequentially detects the execution effect records and trends of each response command in the corresponding industrial field environment. It extracts the network traffic load rate of a specific port at 80% before the blocking operation and the total traffic load rate at 45% after the operation. Logical judgment is performed on the defense gain value under continuous operation items to obtain the actual gain amplitude of 35%. The median value of 20% and the lower limit of service interruption at 50% are extracted from the closed environment test records for each blocking operation. After extracting the environmental characteristic indicators, 20% to 50% are selected as the preset security preference range threshold. The obtained 35% gain value is rigorously compared with this preference range to confirm that the gain amplitude is within the preset preference range threshold and has not triggered an availability crisis for the business system. The corresponding blocking rule defense actions with positive benefits are re-archived and standardized to establish a globally universal security response identifier set and generate a multi-dimensional collaborative defense response strategy.

[0035] Please see Figure 6The knowledge consistency verification and feedback module includes: The status data processing submodule calls the current status content of each execution unit in the multi-dimensional collaborative defense response strategy, reads the operating parameter fields recorded under each device in sequence, performs field merging and format standardization operations on all recorded content, establishes a unified index according to the device number, sorts the data according to the data acquisition time, outputs a status dataset with a consistent structure, and generates a current matrix of device operating status. This module retrieves the current feedback status of each distributed execution unit in the multi-dimensional collaborative defense response strategy, sequentially reading the underlying operating parameter fields recorded under each industrial control gateway device. Deep field merging and format standardization cleaning are performed on all records containing core data such as session connection count, packet drop rate, and rule matching hit rate. The session concurrent connection numeric segments are uniformly converted to integer format, and non-standardized abnormal fields such as interspersed English characters are removed. After the cleaning operation, a unified fast retrieval index is established across the entire network based on the device hardware location address number. Strictly sorted according to the timestamps assigned by the underlying data acquisition system, these cleaned parameters are stored in a multi-dimensional array structure in memory. Through the above serialization and processing, the originally chaotic feedback logs are reconstructed into a high-quality structured dataset with time-series characteristics, outputting a standardized operating status dataset with a consistent structure, generating a current device operating status matrix.

[0036] The safety benchmark matching submodule, based on the current equipment operating status matrix, calls the safety level standard items set in the industrial control industry standard, compares each operating indicator in the matrix with the corresponding indicator item in each level item, performs item-by-item matching according to field number, identifies the safety interval according to the standard value range, marks the corresponding safety level index, and generates a status performance level comparison table. Based on the current equipment operating status matrix, this module calls upon pre-defined safety level standard items from industrial control industry standards. It collects historical stable operating data from industrial control networks of similar scale to obtain the mean of 1500 and standard deviation of 200 for the number of session connections. Following statistical principles, it sets the upper limit of the baseline value to 2100, thus establishing a quantitative safety and stability range of 0 to 2100 in the system. This range provides an objective and scientific metric for assessing whether field equipment is within the safe operating threshold. After obtaining the metric, it performs a horizontal comparison between each operating indicator in the matrix and the corresponding indicator item in each level item. It extracts the measured value of 1250 concurrent session connections corresponding to a specific device in the current matrix. It performs item-by-item matching by field number, comparing and determining that 1250 is completely within this safety and stability range. Based on the standard value range, it accurately identifies the safety range type to which it belongs and explicitly marks the corresponding safety level index (Level A), generating a status performance level comparison table.

[0037] The knowledge base labeling and updating submodule, based on the status performance level comparison table, sequentially counts the security distribution of the current system under each device dimension, determines whether the distribution has a consistent attribution, and if most indicators fall within the preset security stability range, then the defense logic is taken as the valid knowledge attribution and is reverse-labeled to the corresponding field in the threat intelligence knowledge base, establishing a dynamic evolution structure for industrial control and generating closed-loop feedback results for industrial control threat detection.

[0038] Based on the status performance level comparison table, this module sequentially statistically analyzes the macro-level security distribution of the current system across various device dimensions. In this detection, 8 out of 10 gateway devices were classified as Level A, resulting in a maximum security level ratio of 80%. To determine if this macro-level distribution exhibits consistent attribution characteristics, a lower limit of 75% (the critical percentage where majority decisions do not reverse) was selected as the system's preset core threshold for consistency judgment. After determining the threshold, the actual level ratio of 80% was confirmed to be greater than this set threshold. If most indicators stably fall within the preset security range, the system uses the issued defense logic as valid knowledge attribution. The corresponding defense logic code segment is extracted and back-annotated to the corresponding field in the verification column of the threat intelligence knowledge base association record table. This step successfully established a dynamic evolutionary feedback structure for industrial control, generating a closed-loop feedback result for industrial control threat detection.

[0039] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An industrial control threat detection system enhanced with threat intelligence based graph, characterized in that, The system comprises: An industrial field multi-source heterogeneous data acquisition module connects programmable logic controllers in an industrial control network and a monitoring and acquisition system through a physical interface, acquires real-time communication messages and system logs, parses message payloads according to a preset protocol, extracts source addresses, destination addresses, control instructions and physical parameter feature vectors, and generates an industrial field real-time data stream sequence; A threat intelligence dynamic graph construction module calls the industrial field real-time data stream sequence, compares blacklists and attack feature codes in a preset threat intelligence knowledge base, identifies threat entities and attributes, maps entities into nodes and interactions into directed edges and assigns weights, and generates an industrial control threat intelligence enhanced graph; A cross-domain correlation reasoning and attack path prediction module acquires the threat intelligence enhanced graph, extracts abnormal node neighborhood subgraphs, calculates propagation probabilities using a path search algorithm, and matches attacker tactical and technical process library entries to generate a potential attack path prediction set; A multi-agent collaborative response decision module, based on the potential attack path prediction set, calls security agent intelligent entities to evaluate key assets, assigns defense tasks through a consensus algorithm, completes blocking connections, updates firewall and isolation device operations, and generates a multi-dimensional collaborative defense response strategy.

2. The threat intelligence enhanced graph-based industrial control threat detection system of claim 1, wherein: The industrial field real-time data stream sequence includes message timestamps, protocol type identifiers, instruction operation codes and physical quantity offset values, the industrial control threat intelligence enhanced graph operations include threat entity nodes, attack attribute labels, interaction correlation edges and dynamic weight coefficients, the potential attack path prediction set includes starting attack nodes, intermediate jump paths, target compromised assets and path confidence scores, and the multi-dimensional collaborative defense response strategy includes task allocation indexes, instruction execution sequences and feedback verification identifiers.

3. The threat intelligence enhanced graph-based industrial control threat detection system of claim 1, wherein, The industrial field multi-source heterogeneous data acquisition module comprises: A communication message interception submodule acquires continuous communication data packets on an industrial Ethernet bus through a mirror port, arranges them in packet order, identifies and removes damaged or duplicate data frames using a preset integrity check algorithm, retains valid payloads that meet preset length requirements, establishes an ordered message sequence, and generates a continuous valid communication record sequence; A semantic feature extraction submodule, based on the continuous valid communication record sequence, calls a preset industrial protocol analysis plug-in, maps fields in each record item, identifies function codes and address segments in control fields, normalizes physical quantity data, converts unstructured message data into feature vectors containing semantic information, and generates a message semantic feature set; A space-time feature fusion submodule extracts time tags and physical location identifiers corresponding to each feature vector in sequence according to the message semantic feature set, identifies associated data items in different physical locations within the same time window, combines time dimension evolution features and space dimension distribution features in a matrix, constructs a multi-dimensional feature mapping matrix, and generates an industrial field real-time data stream sequence.

4. The threat intelligence enhanced graph-based industrial control threat detection system of claim 1, wherein, The threat intelligence dynamic graph construction module comprises: The information entity identification submodule obtains each feature item marked in the industrial field real-time data stream sequence, sequentially traverses the feature vector content, extracts the corresponding IP address, device model, process name and operation behavior data, compares the fields with the preset global threat information library, identifies the malicious indicators existing therein, constructs an entity index set, and generates a security threat entity identification list; The correlation relationship mapping submodule, based on the security threat entity identification list, calls the interaction records in the real-time data stream, topologically maps the source entity and the destination entity corresponding to each group of interaction behaviors, extracts the access frequency, data transmission volume and connection duration between entities, performs weighted calculation on these indicators to determine the edge strength, constructs the logical correlation structure between entities, and generates a threat correlation relationship mapping graph; The graph dynamic evolution submodule, according to the threat correlation relationship mapping graph, sequentially compares the coincidence degree of the temporary nodes generated by the newly accessed data stream and the existing graph structure, identifies the node items with changed start and end times and interaction characteristics, performs incremental update according to the time dimension and counts all node records meeting the evolution conditions, marks the topological state and merges similar entities, and generates an industrial control threat information enhanced graph.

5. The threat intelligence enhanced graph-based industrial control threat detection system of claim 1, wherein, The cross-domain correlation reasoning and attack path prediction module comprises: The abnormal node positioning submodule obtains the real-time running state data in the industrial control threat information enhanced graph, performs abnormality detection on the obtained records according to the device type, filters the records with index values deviating from the preset baseline range, sequentially adds abnormality level identifiers and topological position numbers to each record, establishes a cross-domain correlation data format, and generates a regional abnormal entity record set; The path derivation engine submodule, based on the regional abnormal entity record set, calls the directed edge information and attack feature vector in the graph, traverses each record containing action items according to the attack stage dimension, and multiplies and aggregates the probability values under the same attack sequence, sequentially outputs the attack success probability, potential loss estimate value and propagation speed indicator in the path, integrates the path combination items into a unified structure, and generates a three-class attack path structure set; The path confidence evaluation submodule, according to the three-class attack path structure set, sequentially calls the index combination items between different predicted paths, determines the numerical differences between each group of combination items in the confidence, coverage range and threat level dimensions, performs grade division according to the preset risk matrix, classifies the path items with evaluation results in the preset high-risk interval into the core monitoring class, and labels the priority number thereof, establishes a predicted path mapping set, and generates a potential attack path prediction set.

6. The threat intelligence enhanced graph-based industrial control threat detection system of claim 1, wherein, The multi-agent collaborative response decision module comprises: The task decomposition execution submodule, based on the response requirements with the same priority in the potential attack path prediction set, sequentially identifies all path items with the same attribute label, collects and processes the defense demand fields and establishes a task index table, arranges the operation instructions under the same defense target into a unified set structure, assigns each group of sets with a corresponding agent identifier number, and generates a collaborative task execution index group; The decision information collection submodule calls the feedback data of the collaborative task execution index group and the security agent intelligence to collect and process the execution status records of each intelligence under various tasks. According to the task index, it locates the available resource data of the corresponding intelligence and integrates them into a decision matrix structure corresponding to the task number and intelligence number. It also adds a task priority field to generate a response decision comparison matrix. The strategy optimization and screening submodule, based on the response decision comparison matrix, sequentially detects the changing trend of the execution effect record of each response instruction in the corresponding environment, judges the defense gain value under continuous operation items, selects the strategy number whose gain amplitude is within the preset preferred range threshold, and re-archives and organizes the screened defense actions to establish a response identifier set and generate a multi-dimensional collaborative defense response strategy.

7. The threat intelligence enhanced graph-based industrial control threat detection system of claim 1, wherein, The system also includes: The knowledge consistency verification and feedback module, based on the results of the multi-dimensional collaborative defense response strategy, classifies and organizes the system status data after the response, compares it with the preset security benchmark standard, determines the system recovery location, and forms a closed-loop feedback result for industrial control threat detection. The closed-loop feedback results of the industrial control threat detection include consistency verification tags, current security margin indicators, and knowledge base update suggestions.

8. The threat intelligence enhanced graph-based industrial control threat detection system of claim 7, wherein, The knowledge consistency verification and feedback module includes: The status data processing submodule calls the current status content of each execution unit in the multi-dimensional collaborative defense response strategy, reads the operating parameter fields recorded under each device in sequence, performs field merging and format standardization operations on all recorded content, establishes a unified index according to the device number, sorts the data according to the data acquisition time, outputs a status dataset with a consistent structure, and generates a current matrix of device operating status. The safety benchmark matching submodule, based on the current operating status matrix of the equipment, calls the safety level standard items set in the industrial control industry standard, compares each operating indicator in the matrix with the corresponding indicator item in each level item, performs item-by-item matching according to the field number, identifies the safety interval according to the standard value range, marks the corresponding safety level index, and generates a status performance level comparison table. The knowledge base labeling and updating submodule, based on the state performance level comparison table, sequentially counts the security distribution of the current system under each device dimension, determines whether the distribution has a consistent attribution, and if most indicators fall within the preset security stability range, then the defense logic is taken as the valid knowledge attribution and is reverse-labeled to the corresponding field of the threat intelligence knowledge base, establishing a dynamic evolution structure for industrial control and generating a closed-loop feedback result for industrial control threat detection.

Images