Intelligent detection and defense method and system for industrial control network attacks

Abstract

The application provides an intelligent detection and defense method and system for industrial control network attacks, and relates to the technical field of industrial control network security. First, the communication data stream of the industrial control network is collected and divided into data frame units, from which the protocol state transition identifier sequence and the control instruction semantic identifier sequence are separated and extracted, and the corresponding control instruction semantic association path is constructed. Then, the constructed control instruction semantic association path is compared with the preset reference path to generate a deviation distribution description. Next, the deviation distribution description is subjected to spatiotemporal coupling disturbance positioning. Finally, a linkage defense instruction set is generated according to the positioning result and sent to the switching device to trigger the port shutdown and flow mirroring analysis operation. The application can actively and intelligently detect and defend industrial control network attacks.

Description

Technical Field

[0001] This invention relates to the field of industrial control network security technology, and more specifically, to an intelligent detection and defense method and system for industrial control network attacks. Background Technology

[0002] In today's rapidly developing industrial automation landscape, industrial control networks are responsible for coordinating and controlling various industrial equipment to ensure the efficient and stable operation of production processes. However, as industrial control networks become increasingly interconnected with external networks, the risk of cyberattacks on them is also growing. Once an industrial control network is attacked, it may lead to loss of control of production equipment, interruption of production processes, or even serious safety accidents, causing huge economic losses to enterprises and even threatening the lives of personnel.

[0003] Currently, most traditional methods are based on fixed rules or signature databases, which can only detect known types of attacks and are often powerless against new or variant attacks, lacking flexibility and adaptability. Moreover, these methods typically focus only on a single layer of network communication, such as analyzing only network traffic characteristics or checking only the legitimacy of control commands, failing to comprehensively assess the risk of network attacks. In terms of defense, existing methods are mostly passive, taking measures only after an attack is detected, making it difficult to effectively block attacks in their early stages and thus unable to effectively curb their spread and proliferation. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide an intelligent detection and defense method for industrial control network attacks, the method comprising: The raw network communication data stream transmitted in the industrial control network communication link is collected, and the raw network communication data stream is divided into multiple data frame units with continuous time sequence markers. The data frame unit includes the industrial communication protocol header field payload and the industrial control instruction opcode field payload. Extract the protocol state transition identifier sequence of the industrial communication protocol header field payload and the control instruction semantic identifier sequence of the industrial control instruction opcode field payload from the data frame unit. Construct a protocol state transition topology path based on the protocol state transition identifier sequence and a control instruction semantic association path based on the control instruction semantic identifier sequence. The protocol state transition topology path is compared with the preset industrial communication protocol baseline state transition topology path to generate a first deviation distribution description. The control command semantic association path is compared with the preset set of legal control command semantic association paths to generate a second deviation distribution description. Spatiotemporal coupling perturbation localization processing is performed on the first deviation distribution description and the second deviation distribution description to generate the location coordinates of the attack perturbation source and the vector description of the attack perturbation propagation path; Based on the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path, a set of coordinated defense instructions, including port blocking instructions and traffic bypass redirection instructions, is generated. The set of coordinated defense instructions is sent to the industrial control network switching equipment to trigger port shutdown operation and traffic mirroring analysis operation.

[0005] Furthermore, embodiments of the present invention also provide an intelligent detection and defense system for industrial control network attacks, comprising: A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the aforementioned intelligent detection and defense method against industrial control network attacks by executing the machine-executable instructions.

[0006] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions stored in a computer-readable storage medium, wherein a processor of an intelligent detection and defense system against industrial control network attacks reads the machine-executable instructions from the computer-readable storage medium, and the processor executes the machine-executable instructions, causing the intelligent detection and defense system against industrial control network attacks to perform the aforementioned intelligent detection and defense method against industrial control network attacks.

[0007] Based on the above, by collecting the original network communication data stream from the industrial control network communication link and segmenting it into data frame units with continuous time sequence labels, and separating and extracting the protocol state transition identifier sequence and control command semantic identifier sequence from the data frame units, and constructing the protocol state transition topology path and control command semantic association path respectively, the normal mode of network communication can be accurately grasped. By comparing the constructed path with the preset benchmark path to generate a deviation distribution description, abnormal situations in network communication can be detected in a timely manner, effectively detecting potential network attacks. Spatiotemporal coupling disturbance localization processing of the deviation distribution description can determine the source and propagation path of the attack disturbance. Based on the localization results, a set of coordinated defense commands is generated and sent to the industrial control network switching equipment, triggering port shutdown operations and traffic mirroring analysis operations. This achieves proactive and timely defense, effectively blocking the propagation of attacks in the early stages, ensuring the safe and stable operation of the industrial control network, and significantly improving the industrial control network's ability to cope with network attacks. Attached Figure Description

[0008] Figure 1This is a schematic diagram of the execution flow of the intelligent detection and defense method for industrial control network attacks provided in the embodiments of the present invention.

[0009] Figure 2 This is a schematic diagram of exemplary hardware and software components of an intelligent detection and defense system for industrial control network attacks provided in an embodiment of the present invention. Detailed Implementation

[0010] Figure 1 This is a flowchart illustrating an intelligent detection and defense method for industrial control network attacks provided in one embodiment of the present invention, which will be described in detail below.

[0011] Step S110: Collect the raw network communication data stream transmitted in the industrial control network communication link, and divide the raw network communication data stream into multiple data frame units with continuous time sequence markers. The data frame unit includes the industrial communication protocol header field payload and the industrial control instruction opcode field payload.

[0012] Step S111: Capture the physical layer electrical signal waveform sequence flowing through the mirror port of the industrial control network switching device, convert the physical layer electrical signal waveform sequence into a binary bit stream sequence, identify the preamble synchronization header field of the industrial communication protocol from the start offset position of the binary bit stream sequence, and perform frame start delimiting processing on the binary bit stream sequence according to the boundary delimiter of the preamble synchronization header field.

[0013] Configure port mirroring on the industrial control network switching equipment to copy all transmit and receive traffic from the physical ports connecting the industrial control equipment cluster to a designated mirror monitoring port. Capture the physical layer electrical signal waveform sequence transmitted at the physical layer using a network interface card connected to this mirror monitoring port. The physical layer decoding chip of the network interface card decodes the physical layer electrical signal waveform sequence, converting level transitions into binary bit values ​​to obtain a binary bit stream sequence. Within this binary bit stream sequence, search for a specific preamble header field pattern according to the frame structure definition of the industrial communication protocol. When a bit segment matching the preamble header field pattern is detected, record the end position of that bit segment as the boundary of the frame start delimiter.

[0014] Step S112: After completing the frame start delimiting process, sequentially read the binary value of the length indicator field after the frame start delimiter from the binary bit stream sequence. Based on the binary value of the length indicator field, extract a continuous bit sequence segment from the starting position of the current frame start delimiter to the specified length offset position. Perform cyclic redundancy check (CRC) calculation on the extracted continuous bit sequence segment. Perform numerical consistency matching between the calculated CRC result and the CRC field carried at the end of the continuous bit sequence segment. After the numerical consistency matching passes, mark the continuous bit sequence segment as a valid data frame unit.

[0015] The length indicator field immediately following the start-of-frame delimiter is read from the binary bitstream sequence. The binary value of this length indicator field represents the byte length of the entire data frame. Based on this length value, a continuous bit sequence segment within a specified length offset range is extracted, starting from the beginning position of the start-of-frame delimiter. A Cyclic Redundancy Check (CRC) code is calculated on this continuous bit sequence segment (excluding the trailing CRC code field) using a polynomial division algorithm. This CRC code result is compared with the value of the CRC code field carried at the end of the continuous bit sequence segment. If they are equal, it indicates that no bit errors occurred during transmission, and the continuous bit sequence segment is marked as a valid data frame unit.

[0016] Step S113: Locate the starting offset position of the industrial communication protocol header field in the effective data frame unit, and extract the source device address identifier field, destination device address identifier field, protocol function code field and transaction processing identifier field as the industrial communication protocol header field payload starting from the starting offset position of the industrial communication protocol header field.

[0017] According to the frame format specification of the industrial communication protocol, the header fields of the industrial communication protocol are located at fixed offsets within the valid data frame unit. The protocol function code field, located at offset_func and occupying 1 byte, identifies the type of protocol interaction behavior of this data frame (e.g., reading a holding register, writing a single register, writing multiple registers, etc.). The source device address identifier field and the destination device address identifier field are located at offset_src and offset_dst, respectively, identifying the device addresses of the communication initiator and receiver. The transaction processing identifier field is located at offset_trans and is used to associate request frames with response frames. The binary values ​​of the corresponding fields are extracted from these offset positions and combined to form the payload of the industrial communication protocol header fields.

[0018] Step S114: Locate the starting offset position of the industrial control instruction opcode field in the effective data frame unit, and extract the instruction operation type encoding field, instruction operation object register address field, and instruction operation value range field as the payload of the industrial control instruction opcode field starting from the starting offset position of the industrial control instruction opcode field.

[0019] According to the frame format specification of the industrial communication protocol, the opcode field of the industrial control instruction is located in the protocol data unit portion of the valid data frame unit. The instruction operation type encoding field is located at offset_op and is used to identify the specific control operation type (such as starting the device, stopping the device, setting parameter values, etc.). The instruction operation object register address field is located at offset_reg and is used to identify the address number of the internal register of the operated industrial field device. The instruction operation value range field is located at offset_val and is used to carry the value written to the register or the range of registers to be read. The binary values ​​of the corresponding fields are extracted from these offset positions and combined to form the payload of the industrial control instruction opcode field.

[0020] Step S115: Perform session grouping aggregation processing on multiple valid data frame units belonging to the same continuous communication session according to the consistency of the transaction processing identifier field to generate a session grouping aggregation cluster. Perform timestamp processing on the valid data frame units contained in each session grouping aggregation cluster according to the order in which the frames arrive at the mirror port. Add a monotonically increasing continuous time series marker to each valid data frame unit.

[0021] Iterate through all valid data frame units and extract the value of the transaction identifier field for each valid data frame unit. Valid data frame units with the same transaction identifier field value are grouped into the same session group cluster; these data frame units belong to the same request-response communication session. For each session group cluster, assign monotonically increasing timestamp sequence numbers to the valid data frame units in the order they arrive at the mirror monitoring port. The first arriving valid data frame unit is marked with timestamp t1, the second with timestamp t2, and so on.

[0022] Step S116: Store the valid data frame units with the attached continuous time series markers into a circular buffer storage area. The circular buffer storage area is used to maintain a snapshot of historical data frame units within a preset time window. Output the valid data frame units with attached continuous time series markers stored in the circular buffer storage area as a whole as multiple data frame units with continuous time series markers.

[0023] A fixed-size circular buffer is created, employing a first-in, first-out (FIFO) queue structure. Valid data frame units with attached continuous time-series tags are sequentially written into the circular buffer. When the buffer is full, new valid data frame units overwrite the oldest stored ones, thus maintaining a snapshot of historical data frame units within a preset time window. When an external processing module requests data, all currently stored valid data frame units with attached continuous time-series tags in the circular buffer are output as a whole, serving as multiple data frame units with continuous time-series tags.

[0024] Step S120: Extract the protocol state transition identifier sequence of the industrial communication protocol header field payload and the control instruction semantic identifier sequence of the industrial control instruction opcode field payload from the data frame unit. Construct a protocol state transition topology path based on the protocol state transition identifier sequence and a control instruction semantic association path based on the control instruction semantic identifier sequence.

[0025] Step S121: For each data frame unit with continuous time series markers, parse the specific encoded value of the protocol function code field in the payload of the industrial communication protocol header, and map the specific encoded value of the protocol function code field to the corresponding protocol interaction behavior type descriptor.

[0026] For each data frame unit, the binary value of the protocol function code field is extracted from the payload of its industrial communication protocol header. A mapping table is established between the encoded values ​​of the protocol function codes and the protocol interaction behavior type descriptors. This mapping table is predefined according to the industrial communication protocol standard specification. For example, the function code encoded value 0x01 maps to the read coil status behavior descriptor, the function code encoded value 0x03 maps to the read holding register behavior descriptor, the function code encoded value 0x06 maps to the write single register behavior descriptor, and the function code encoded value 0x10 maps to the write multiple register behavior descriptor. The specific encoded value of the protocol function code field is converted into the corresponding protocol interaction behavior type descriptor through a lookup operation.

[0027] Step S122: Extract the source device address identifier field and the destination device address identifier field from the payload of the industrial communication protocol header. Combine the source device address identifier field and the destination device address identifier field to form a communication endpoint dual identifier. Perform triple concatenation processing on the communication endpoint dual identifier and the protocol interaction behavior type descriptor to generate a protocol state transition identifier atomic unit containing a communication initiator address identifier, a communication receiver address identifier, and a protocol interaction behavior type descriptor.

[0028] Extract the values ​​of the source device address identifier field and the destination device address identifier field from the payload of the industrial communication protocol header. Concatenate the source device address identifier field values ​​and the destination device address identifier field values ​​in sequence to form a communication endpoint dual identifier, which uniquely identifies the communication relationship between a pair of communication entities. Concatenate the communication endpoint dual identifier with the protocol interaction behavior type descriptor obtained in step S121 as a triple to generate a protocol state transition identifier atomic unit, whose data structure is (source device address, destination device address, protocol interaction behavior type).

[0029] Step S123: According to the increasing order of the continuous time series markers, arrange the multiple protocol state transition marker atomic units corresponding to the dual identifier of the same communication endpoint in a head-to-tail arrangement to generate a protocol state transition marker sequence representing the stage transition relationship of the industrial communication protocol interaction process.

[0030] Protocol state transition identifier atomic units with the same communication endpoint dual identifier are selected from all data frame units. These protocol state transition identifier atomic units are arranged in ascending order of the continuous time sequence labels of their respective data frame units to form a sequence. Adjacent elements in this sequence represent two consecutive protocol interactions between the same pair of communication entities, and the overall structure of the sequence describes the stage transition trajectory of the protocol state machine of the two communicating parties.

[0031] Step S124: Using each protocol state transition identifier atomic unit in the protocol state transition identifier sequence as a topology node, and the temporal adjacency relationship between two adjacent protocol state transition identifier atomic units as a topology directed edge, construct a protocol state transition topology path consisting of a set of topology nodes and a set of topology directed edges.

[0032] Each protocol state transition identifier atomic unit in the protocol state transition identifier sequence is considered as a topological node in a directed graph. Between any two adjacent protocol state transition identifier atomic units in the sequence, a topological directed edge is established from the earlier topological node to the later topological node. All topological nodes constitute a topological node set, and all topological directed edges constitute a topological directed edge set. The topological node set and the topological directed edge set together constitute the protocol state transition topological path, which is a directed graph data structure where each directed edge from node A to node B represents a protocol state transition from A to B.

[0033] Step S125: For each data frame unit with a continuous time series marker, parse the specific encoding value of the instruction operation type encoding field in the industrial control instruction opcode field payload it carries, and map the specific encoding value of the instruction operation type encoding field to the corresponding control instruction action type descriptor.

[0034] For each data frame unit, the binary value of the instruction operation type encoding field is extracted from its industrial control instruction opcode field payload. A mapping table is established between the instruction operation type encoding value and the control instruction action type descriptor. For example, encoding value 0x01 maps to a device start action descriptor, encoding value 0x02 maps to a device stop action descriptor, encoding value 0x03 maps to a parameter set value action descriptor, and encoding value 0x04 maps to a status read value action descriptor. A lookup operation is then used to convert the specific encoding value of the instruction operation type encoding field into the corresponding control instruction action type descriptor.

[0035] Step S126: Extract the address offset of the instruction operation object register address field in the load of the industrial control instruction opcode field, map the address offset to the corresponding logical identifier of the industrial field controlled execution component, and perform binary concatenation processing on the control instruction action type descriptor and the logical identifier of the industrial field controlled execution component to generate a control instruction semantic identifier atomic unit that represents the execution of a specific control action on a specific industrial field controlled execution component.

[0036] Extract the binary value of the instruction operand register address field from the opcode field payload of the industrial control instruction. This binary value represents the address offset of the internal register of the industrial field device. Establish a mapping table between the register address offset and the logical identifier of the controlled actuator in the industrial field. This mapping table is predefined according to the point table configuration file of the industrial control system. Convert the register address offset into the corresponding logical identifier of the controlled actuator in the industrial field (such as the speed register of motor M101, the opening register of valve V202, etc.). Concatenate the control instruction action type descriptor with the logical identifier of the controlled actuator in the industrial field into a tuple to generate a control instruction semantic identifier atomic unit, whose data structure is (control instruction action type, controlled actuator identifier).

[0037] Step S127: According to the increasing order of the continuous time series markers, arrange the multiple control instruction semantic identifier atomic units that act on the logical identifiers of the controlled execution components in the same industrial site in a head-to-tail arrangement to generate a control instruction semantic identifier sequence representing the evolution process of the industrial control instruction operation intent. Take each control instruction semantic identifier atomic unit in the control instruction semantic identifier sequence as a semantic node, and take the control intent transition relationship between two adjacent control instruction semantic identifier atomic units as a semantic association edge to construct a control instruction semantic association path composed of a set of semantic nodes and a set of semantic association edges.

[0038] From all data frame units, control instruction semantic identifier atomic units with the same logical identifier for the controlled execution component in the industrial field are selected. These control instruction semantic identifier atomic units are arranged in ascending order of their respective data frame unit's continuous time sequence markers, forming a control instruction semantic identifier sequence. Each control instruction semantic identifier atomic unit in this sequence is considered a semantic node in a directed graph. Semantic association edges are established between any two adjacent semantic nodes in the sequence, with the direction pointing from the earlier semantic node to the later semantic node. All semantic nodes constitute a semantic node set, and all semantic association edges constitute a semantic association edge set, together forming the control instruction semantic association path.

[0039] Step S130: Perform path deviation comparison processing between the protocol state transition topology path and the preset industrial communication protocol benchmark state transition topology path to generate a first deviation distribution description; perform semantic deviation comparison processing between the control command semantic association path and the preset set of legal control command semantic association paths to generate a second deviation distribution description.

[0040] Step S131: Obtain the industrial communication protocol baseline state transition topology path template pre-installed in the industrial control network intrusion detection system. The industrial communication protocol baseline state transition topology path template defines the legal protocol state transition topology node sequence and legal topology directed edge connection relationship allowed in the normal communication process of the industrial control network.

[0041] The storage medium of the industrial control network intrusion detection system pre-stores an industrial communication protocol baseline state transition topology path template. This industrial communication protocol baseline state transition topology path template is pre-built according to the state machine model defined in the industrial communication protocol standard specification, and includes a valid sequence of topology nodes (i.e., allowed protocol state transition identifier atomic units) and a valid directed topology edge connection relationship (i.e., a directed edge that allows a transition from one protocol state transition identifier atomic unit to another protocol state transition identifier atomic unit).

[0042] Step S132: Perform a node set difference comparison process between the set of topology nodes contained in the protocol state transition topology path and the set of legal topology nodes contained in the industrial communication protocol baseline state transition topology path template, and identify abnormal topology node entities that exist only in the protocol state transition topology path and not in the set of legal topology nodes.

[0043] Iterate through each topology node in the protocol state transition topology path and check if the node exists in the set of valid topology nodes. If a topology node does not have a corresponding match in the set of valid topology nodes, mark it as an abnormal topology node entity. An abnormal topology node entity indicates an illegal protocol interaction behavior not defined in the industrial communication protocol standard specification.

[0044] Step S133: Perform a directed edge connection relationship difference comparison between the set of directed edges contained in the protocol state transition topology path and the set of legal directed edges contained in the industrial communication protocol benchmark state transition topology path template, and identify abnormal directed edge entities whose connection relationship between the source topology node and the destination topology node does not conform to the definition specification of the legal directed edge set.

[0045] Traverse each directed edge in the protocol state transition topology path, extracting the source and destination nodes of that directed edge. Check if the directed edge connection from the source node to the destination node exists in the set of valid directed edges. If not, mark the directed edge as an abnormal directed edge entity. An abnormal directed edge entity indicates that an illegal state transition has occurred in the protocol state machine.

[0046] Step S134: Calculate the frequency of occurrence of the abnormal topology node entity in the protocol state transition topology path and record it as the abnormal node occurrence frequency parameter; calculate the frequency of occurrence of the abnormal topology directed edge entity in the protocol state transition topology path and record it as the abnormal directed edge occurrence frequency parameter.

[0047] The protocol state transition topology path is traversed, and the number of times each abnormal topology node entity is marked is counted to obtain the abnormal node occurrence frequency parameter. The number of times each abnormal topology directed edge entity is marked is counted to obtain the abnormal directed edge occurrence frequency parameter. These frequency parameters reflect the degree of repetition of abnormal behavior.

[0048] Step S135: Mark the node position coordinates of the abnormal topology node entity and the directed edge path trajectory of the abnormal topology directed edge entity on the topology structure diagram of the protocol state transition topology path, and generate a protocol state transition topology path deviation diagram description with deviation position annotation.

[0049] The protocol state transition topology is plotted as a directed graph. On this graph, the locations of anomalous topology nodes are marked using a first visual marker (e.g., red highlight). The trajectories of directed edges in the anomalous topology are marked using a second visual marker (e.g., bold red arrows). Graphical description data containing these annotations is generated to visually demonstrate deviations from the protocol state transition path.

[0050] Step S136: Combine and encapsulate the abnormal node occurrence frequency parameter, the abnormal directed edge occurrence frequency parameter, and the protocol state transition topology path deviation diagram description with deviation position annotation to generate a first deviation distribution description.

[0051] The frequency parameters of abnormal node occurrences, the frequency parameters of abnormal directed edges occurrences, and the deviation diagram of the protocol state transition topology path with deviation position annotations are encapsulated into a data structure, which is the first deviation distribution description. The first deviation distribution description is used to characterize the abnormal behavior features at the protocol state transition level.

[0052] Step S137: Obtain the template of the set of legal semantic association paths of control commands pre-installed in the industrial control network intrusion detection system. The template of the set of legal semantic association paths of control commands defines the set of semantic node sequences and the set of legal semantic association edge connections of legal control command semantic association paths allowed in the normal production process of the industrial control network.

[0053] The storage medium of the industrial control network intrusion detection system pre-stores a template of legal semantic association paths for control commands. This template is pre-constructed based on the normal production process of the industrial control system and contains multiple legal semantic association paths for control commands. Each legal path defines a sequence of semantic nodes (i.e., the order in which the atomic units of the semantic identifiers of control commands are allowed to appear) and the legal semantic association edges connecting the semantic nodes.

[0054] Step S138: Perform sequence similarity comparison processing on the semantic node sequence contained in the semantic association path of the control instruction and the semantic node sequence of each legal semantic association path of the control instruction in the set template of legal semantic association paths of the control instruction, and calculate the number of sequence editing operation steps as the sequence semantic deviation parameter.

[0055] An edit distance algorithm is used to calculate the degree of difference between the semantic node sequence of the control instruction semantic association path and each legal semantic node sequence. Edit distance is defined as the minimum number of insertion, deletion, or replacement operations required to transform one sequence into another. The calculated minimum edit distance is used as a sequence semantic deviation parameter. The larger the sequence semantic deviation parameter, the more severe the deviation of the control instruction semantic association path from the legal pattern.

[0056] Step S139: Perform edge connection consistency comparison processing on the semantic connection relationship contained in the semantic association path of the control instruction and the legal semantic association relationship in the set template of legal semantic association paths of the control instruction. Identify abnormal semantic association edge entities whose source semantic node and destination semantic node jump relationship does not conform to the operation logic specification of legal control instruction. Record the sequence semantic deviation parameter and extract the position information of the abnormal semantic association edge entities in the semantic association path of the control instruction to generate an abnormal semantic association edge position list.

[0057] Traverse each semantic association edge in the control instruction semantic association path, extracting the source and destination semantic nodes of that edge. Check whether the control intent transition relationship from the source to the destination semantic node conforms to the logical specifications of the industrial production process. If it does not conform (e.g., jumping directly from a stop action to a write parameter action, lacking the necessary start action in between), mark the semantic association edge as an abnormal semantic association edge entity. Record the index position of the abnormal semantic association edge entity in the semantic node sequence, generating a list of abnormal semantic association edge positions.

[0058] Step S1310: Combine and encapsulate the sequence semantic deviation parameter with the list of abnormal semantic associated edge positions to generate a second deviation distribution description.

[0059] The sequence semantic deviation parameter and the list of anomalous semantic associated edge positions are encapsulated into a data structure, which is the second deviation distribution description. The second deviation distribution description is used to characterize anomalous behavioral features at the semantic level of control instructions.

[0060] Step S140: Perform spatiotemporal coupling perturbation localization processing on the first deviation distribution description and the second deviation distribution description to generate the location coordinates of the attack perturbation source and the vector description of the attack perturbation propagation path.

[0061] Step S141: Parse the node position coordinates of the abnormal topological node entity and the continuous time series label range corresponding to the abnormal topological node entity from the first deviation distribution description; parse the directed edge path trajectory of the abnormal topological directed edge entity and the continuous time series label range corresponding to the abnormal topological directed edge entity from the first deviation distribution description; parse the position index sequence of the abnormal semantic associated edge entity and the continuous time series label range corresponding to the abnormal semantic associated edge entity from the second deviation distribution description.

[0062] The first deviation distribution description data structure is unpacked, and the node position coordinates of the anomalous topological node entities and the continuous time series label ranges of the first and last observations of these anomalous topological node entities are extracted. Similarly, the directed edge path trajectories of the anomalous topological directed edge entities and their continuous time series label ranges are extracted. The second deviation distribution description data structure is unpacked, and the position index sequences of the anomalous semantically associated edge entities and their continuous time series label ranges are extracted.

[0063] Step S142: Perform time-axis alignment and coverage processing on the continuous time-series label range corresponding to the abnormal topological node entity and the continuous time-series label range corresponding to the abnormal semantic associated edge entity, and extract the time-overlapping region sequence in which the two overlap on the time axis. For each time-overlapping region in the time-overlapping region sequence, extract the composite abnormal event concurrent fragment in the time-overlapping region that simultaneously contains abnormal topological node entities, abnormal topological directed edge entities, and abnormal semantic associated edge entities.

[0064] The continuous time series labeling ranges of anomalous topological node entities and anomalous semantically associated edge entities are compared on a unified time axis. Time intervals where the two ranges overlap are identified as time overlap regions. For each time overlap region, it is checked whether anomalous topological node entities, anomalous topological directed edge entities, and anomalous semantically associated edge entities exist simultaneously within that region. If all three exist simultaneously, all anomalous entities within the time overlap region are recorded as a composite anomalous event concurrent segment.

[0065] Step S143: For the concurrent fragments of the composite abnormal events, extract the source device address identifier field carried by the earliest abnormal topology node entity, map the source device address identifier field to the corresponding physical network access port logical identifier, and use the physical network access port logical identifier as the coordinate for locating the source of the attack disturbance.

[0066] In a concurrent segment of a complex anomaly event, the abnormal topology node entities are traversed in ascending order of continuous time series labels to find the earliest abnormal topology node entity. The source device address identifier field value is extracted from the protocol state transition identifier atomic unit of this abnormal topology node entity. Based on a pre-defined device address to physical port mapping table, the source device address identifier field value is converted into the corresponding physical network access port logical identifier (such as a switch port number). This physical network access port logical identifier is the coordinate for locating the source of the attack disturbance.

[0067] Step S144: For the concurrent fragment of the composite abnormal event, extract the destination device address identifier field sequence of the directed edge entity of the abnormal topology in ascending order according to the continuous time series marker, and generate the subsequent infected device address identifier transition chain sequence starting from the location coordinates of the attack disturbance source.

[0068] In the concurrent fragments of composite anomalies, the directed edge entities of the anomaly topology are traversed in ascending order of continuous time series labels. For each directed edge entity of the anomaly topology, the value of its destination device address identifier field is extracted. The values ​​of the destination device address identifier field are arranged in chronological order to form a subsequent infected device address identifier transition chain sequence, which describes the path of attack propagation from the source device to other devices.

[0069] Step S145: Based on the physical network topology deployment location corresponding to each device address identifier in the subsequent infected device address identifier transition chain sequence, draw directional line segments and line segment length ratios from the location coordinates of the attack disturbance source to each subsequent infected device address identifier on the industrial control network physical topology structure diagram, and convert the directional line segments and line segment length ratios into an attack disturbance propagation path vector description that includes spatial direction angle parameters and propagation distance step size parameters.

[0070] Based on the physical topology diagram of the industrial control network, the physical location corresponding to the coordinates of the attack disturbance source is obtained, as well as the physical location corresponding to each device address identifier in the subsequent infected device address identifier transition chain sequence. Directional line segments are drawn from the source location to each infected device location, with the line segment length proportional to the physical distance or network hop count between the two devices. Each directional line segment is converted into a spatial direction angle parameter (angle value relative to the reference direction) and a propagation distance step parameter (the numerical value of the line segment length), which are combined to form a vector description of the attack disturbance propagation path.

[0071] Step S146: Associate and bind the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path to generate a merged output dataset of attack disturbance spatiotemporal location and propagation description used to describe the spatiotemporal spread process of the attack in the network.

[0072] The location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path are associated and stored in the same data structure to generate a spatiotemporal location and propagation description dataset of the attack disturbance. This dataset fully describes the starting location and spread trajectory of the attack behavior in the industrial control network.

[0073] Step S150: Generate a set of linked defense instructions containing port blocking instructions and traffic bypass redirection instructions based on the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path. Send the set of linked defense instructions to the industrial control network switching device to trigger port shutdown operation and traffic mirroring analysis operation.

[0074] Step S151: Based on the logical identifier of the physical network access port corresponding to the location coordinates of the attack disturbance source, look up the corresponding Internet Protocol address and physical port index number of the switching device in the preset industrial control network switching device port configuration mapping table.

[0075] The industrial control network switching device port configuration mapping table is a database table. Each record contains the logical identifier of the physical network access port, the management Internet Protocol address of the corresponding switching device, and the physical port index number of that port on the switching device. Using the coordinates of the attack / disruption source as the query key, the matching record is retrieved from this mapping table, and the corresponding management Internet Protocol address and physical port index number of the switching device are extracted.

[0076] Step S152: Generate a port management configuration instruction data packet for the Internet Protocol address and physical port index number of the switching device. The payload of the port management configuration instruction data packet includes a port management status field and the port management status field is set to a port closed status code value.

[0077] Construct a Simple Network Management Protocol (SMPP) data unit, setting its data unit type field to "Setup Request". In the variable binding list, enter the management object identifier corresponding to the physical port, and set the value of this management object identifier to the port's closed status code. Encapsulate this SMPP data unit into a port management configuration command data packet.

[0078] Step S153: Based on the subsequent infected device address identifier transition chain sequence in the attack disturbance propagation path vector description, extract the switching device management Internet Protocol address and physical port index number corresponding to the subsequent infected device address identifier hop by hop.

[0079] Iterate through each device address identifier in the subsequent infected device address identifier transition chain sequence. For each device address identifier, look up its corresponding switch management Internet Protocol address and physical port index number in the industrial control network switch device port configuration mapping table.

[0080] Step S154: For each infected device address identifier in the subsequent infected device address identifier transition chain sequence, generate a corresponding traffic mirroring configuration instruction data packet. The payload of the traffic mirroring configuration instruction data packet includes a source port index field to be mirrored and a destination observation port index field.

[0081] For each infected device address identifier and its corresponding physical port index number, a traffic mirroring configuration command data packet is constructed. This traffic mirroring configuration command data packet adopts the format of the Remote Switching Port Analysis Technology Protocol and includes a source port analysis session identifier, a source port index field to be mirrored, and a mirroring destination observation port index field.

[0082] Step S155: Sort and combine the port management configuration instruction data packet and the traffic mirroring configuration instruction data packet according to the instruction execution priority, wherein the instruction execution priority of the port management configuration instruction data packet is set to the highest priority level, and the instruction execution priority of the traffic mirroring configuration instruction data packet is set to the second-highest priority level.

[0083] Mark port management configuration command packets as the highest priority and traffic mirroring configuration command packets as the second highest priority. Arrange the command packets into a command sequence according to their priority from highest to lowest, ensuring that the port shutdown operation is executed before the traffic mirroring configuration operation.

[0084] Step S156: Encapsulate the sorted and combined port management configuration instruction data packet and the traffic mirroring configuration instruction data packet into a set of linked defense instructions containing attack source shutdown instruction fields and attack path mirroring instruction fields. Send the set of linked defense instructions to the Simplified Network Management Protocol (SMMP) proxy process of the industrial control network switching device corresponding to the attack disturbance source location coordinates through a Simple Network Management Protocol (SMMP) message write operation. Parse the port management configuration instruction data packet, modify the physical layer link state register value of the corresponding physical port index number to perform port shutdown operation, and parse the traffic mirroring configuration instruction data packet to configure the access control list rule entries of the switching chip to perform traffic replication and forwarding operation from the source port index to be mirrored to the observation port index of the mirroring destination.

[0085] All instruction data packets are encapsulated into a set of coordinated defense instructions and sent to the target switch's SMN proxy process via a SMN message write operation. The switch's SMN proxy process parses the port management configuration instruction data packets, writes a port shutdown value to the switch chip's physical layer link status register, and the physical layer stops sending link pulse signals, thus achieving the port shutdown operation. Simultaneously, the switch's SMN proxy process parses the traffic mirroring configuration instruction data packets, writes matching rules to the switch chip's access control list rule table, and copies the inbound or outbound traffic from the specified source port for forwarding to the mirrored destination observation port.

[0086] Step S157: Receive the replicated network communication traffic data forwarded by the security analysis device connected to the mirror destination observation port index, and perform deep packet parsing on the replicated network communication traffic data to extract attack payload signatures.

[0087] The security analysis device connects to the observation port of the mirrored target network and continuously receives the mirrored network communication traffic data. The device performs protocol decoding and application layer payload extraction on the received network communication traffic data, extracting attack payload signatures for subsequent attack signature analysis and rule updates.

[0088] Step S210: After generating the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path, extract the total topology path deviation parameter from the first deviation distribution description and extract the sequence semantic deviation parameter from the second deviation distribution description. Perform interval assignment matching processing on the total topology path deviation parameter and the preset deviation level judgment threshold set to determine the deviation severity level segment where the total topology path deviation parameter is located.

[0089] The frequency parameters of abnormal nodes and abnormal directed edges are extracted from the first deviation distribution description, and the two are added together to obtain the total deviation parameter of the topological path. The preset deviation grading judgment threshold set contains multiple threshold intervals, each interval corresponding to a severity level. The total deviation parameter of the topological path is compared with each threshold interval to determine the interval to which it belongs, thereby obtaining the corresponding deviation severity level segment (e.g., mild deviation, moderate deviation, severe deviation).

[0090] Step S220: Perform interval assignment matching processing on the sequence semantic deviation parameter and the preset semantic deviation level judgment threshold set to determine the semantic deviation severity level segment where the sequence semantic deviation parameter is located. Perform logical disjunction and combination operation processing on the deviation severity level segment and the semantic deviation severity level segment to generate a threat situation comprehensive evaluation level identifier that represents the current comprehensive attack threat situation.

[0091] The sequence semantic deviation parameter is compared with each threshold interval in the semantic deviation grading threshold set to determine its corresponding semantic deviation severity level segment. The higher level between the deviation severity level segment and the semantic deviation severity level segment is taken as the threat situation comprehensive assessment level identifier.

[0092] Step S230: Obtain the attack scenario feature knowledge base pre-installed in the industrial control network intrusion detection system. The attack scenario feature knowledge base stores a set of combined pattern rules of protocol state transition path deviation distribution feature patterns and control command semantic path deviation distribution feature patterns corresponding to historical attack events.

[0093] The attack scenario feature knowledge base is a rule base, where each rule contains preconditions and a conclusion. The preconditions describe a specific set of combination patterns of protocol state transition path deviation features and control command semantic path deviation features, while the conclusion describes the corresponding attack type and attack intent.

[0094] In detail, the attack scenario feature knowledge base is constructed as follows.

[0095] This attack scenario feature knowledge base adopts a production rule representation, with each rule consisting of an antecedent and a consequence. The antecedent describes the combination of the distribution feature patterns of protocol state transition path deviations and control command semantic path deviations, while the consequence describes the corresponding attack type and attack intent. The knowledge base is constructed based on a labeled dataset of historical attack events, containing a total of 2000 labeled samples, covering five types of industrial control network attacks: denial-of-service attacks, man-in-the-middle attacks, command injection attacks, replay attacks, and scanning probing attacks.

[0096] The knowledge base rules are extracted using an association rule mining algorithm (Apriori algorithm). First, feature itemsets are extracted from the labeled samples. These features include: abnormal topological node types, abnormal topological directed edge types, abnormal semantic association edge types, abnormal node occurrence frequency ranges, and sequence semantic deviation ranges. The minimum support threshold is set to 0.05, and the minimum confidence threshold is set to 0.85. The algorithm scans the dataset, generating frequent 1-itemsets, then iteratively generates frequent k-itemsets. Finally, association rules that meet the confidence thresholds are extracted from the frequent itemsets. Each rule is assigned a matching confidence weight, which is determined based on the rule's accuracy statistics in historical data.

[0097] Step S240: Perform pattern matching inference processing on the combination features of the abnormal topology node entity set and the abnormal topology directed edge entity set in the first deviation distribution description, and the combination features of the abnormal semantic association edge entity set in the second deviation distribution description, with the combination pattern rule set in the attack scenario feature knowledge base.

[0098] The currently detected sets of abnormal topological node entities, abnormal topological directed edge entities, and abnormal semantic associated edge entities are used as fact inputs. Each rule in the attack scenario feature knowledge base is traversed, and the fact is checked to see if it satisfies the rule's preconditions. A forward chain reasoning algorithm is used; when a fact matches the preconditions of a rule, the conclusion of that rule is triggered.

[0099] Step S250: If the matching confidence output by the pattern matching inference processing exceeds the preset matching confidence baseline, extract the corresponding attack type nominal descriptor and attack intent target type descriptor from the attack scenario feature knowledge base.

[0100] Each rule is associated with a matching confidence value, which represents the degree of match between the currently detected abnormal feature pattern and the attack pattern described by the rule. A matching confidence baseline is set. When the matching confidence exceeds this baseline, attack type descriptors (such as "denial-of-service attack", "man-in-the-middle attack", "instruction injection attack") and attack intent target type descriptors (such as "disrupting the production process", "stealing process parameters", "damaging controlled equipment") are extracted from the rule.

[0101] Step S260: Combine the threat situation comprehensive evaluation level identifier, the attack type nominal descriptor, and the attack intent target type descriptor to generate an attack behavior semantic interpretation report description structure. Attach the attack behavior semantic interpretation report description structure to the extended instruction payload field of the linked defense instruction set and send it along with the linked defense instruction set to the upper-layer security operation management console of the industrial control network switching device.

[0102] The threat situation assessment level identifier, attack type descriptor, and attack intent target type descriptor are combined into a JSON or XML description structure, which is then appended to the extended instruction payload field of the coordinated defense instruction set. The extended coordinated defense instruction set is sent to the upper-level security operations management console via a secure transmission channel, where it is parsed and rendered into a visual situational awareness view on the human-machine interface.

[0103] Step S310: After sending the set of linked defense instructions to the industrial control network switching device to trigger the port shutdown operation, receive the port shutdown operation execution status receipt message from the industrial control network switching device, parse the message payload field of the port shutdown operation execution status receipt message, and extract the operation result status code field indicating whether the port shutdown operation was successfully executed.

[0104] After sending the port management configuration command data packet, the Simple Network Management Protocol (SMMP) agent process of the industrial control network switch returns a response message. The payload field of this response message is parsed to extract the operation result status code field. A value of 0 in the operation result status code field indicates successful operation, while a non-zero value indicates operation failure.

[0105] Step S320: If the operation result status code field indicates that the port shutdown operation failed, extract the fault cause code value of the port shutdown operation failure from the extended error cause code field of the port shutdown operation execution status receipt message, and map the fault cause code value to the corresponding physical link fault type descriptor or device configuration conflict type descriptor.

[0106] If the operation result status code field indicates failure, the fault cause code value is extracted from the extended error cause code field of the response message. According to the preset error code mapping table, the fault cause code value is converted into a human-readable physical link fault type descriptor (such as "fiber link interruption", "port negotiation failure") or device configuration conflict type descriptor (such as "virtual LAN configuration conflict", "access control list resource shortage").

[0107] Step S330: Generate a backup link blocking remediation strategy instruction for port shutdown operation failure based on the physical link failure type descriptor or device configuration conflict type descriptor. The backup link blocking remediation strategy instruction includes cascaded port shutdown configuration parameters for the upstream aggregation switching device of the attack disturbance source location coordinates.

[0108] When directly shutting down the attack source port fails, a backup link blocking remediation policy instruction is generated. This instruction contains the Internet Protocol address of the upstream aggregation switch and the index number of the cascading ports that need to be shut down. By shutting down the cascading ports on the upstream aggregation switch, attack traffic can be blocked from a more upstream location.

[0109] Step S340: The backup link blocking remedy policy instruction is sent to the command line management interface process of the upstream aggregation switching device at the location coordinate of the attack disturbance source through the Secure Shell Protocol communication channel. The command line management interface process of the upstream aggregation switching device parses the cascading port shutdown configuration parameters in the backup link blocking remedy policy instruction and executes the port shutdown configuration command on the specified physical port of the upstream aggregation switching device.

[0110] An encrypted command-line session is established with the upstream aggregation switch via a secure shell protocol, sending backup link blocking remedy policy instructions to the command-line management interface process. The command-line management interface process parses the parameters in the instructions, executes the interface configuration commands, and sets the management status of the specified physical port to "off".

[0111] Step S350: After receiving the successful execution receipt of the cascade port shutdown configuration command from the upstream aggregation switching device, update the link connectivity status data record in the industrial control network topology connection diagram and mark the link branches affected by the attack as physically isolated.

[0112] After the upstream aggregation and switching device executes the port shutdown command, it returns a success receipt. Upon receiving the receipt, the corresponding link branch record is located in the industrial control network topology diagram, and the connectivity status field of that record is updated to "physically isolated".

[0113] Step S360: Based on the physically isolated status markers in the updated industrial control network topology connection diagram, re-route the control command issuance path of the industrial production process, generate a backup control command issuance path routing table entry that bypasses the physically isolated link branches, and send it to the routing information database of the routing switching device in the industrial control network.

[0114] Using the updated topology graph as input, a shortest path first (SSF) routing algorithm (such as OSPF or IS-IS) is run. When calculating paths, the link costs of physically isolated links are set to infinity, causing the algorithm to automatically avoid these links. New routing table entries are generated and updated via routing protocol update messages to each routing switch in the industrial control network, updating their routing information databases.

[0115] Step S410: Obtain the replicated network communication traffic data forwarded by the security analysis device connected to the mirror destination observation port index as an attack traffic sample data set, perform deep parsing of the transport layer payload on each attack traffic data packet in the attack traffic sample data set, and extract the content of the industrial communication protocol application data unit field in the transport layer payload.

[0116] The security analysis equipment receives and replicates network communication traffic data through the mirror destination observation port, using this data as a sample attack traffic dataset. For each attack traffic packet, the Ethernet header, Internet Protocol header, and Transmission Control Protocol header are stripped, and the Industrial Communication Protocol Application Data Unit (ICD) field content in the transport layer payload is extracted.

[0117] Step S420: Perform variable-length byte sequence sliding window segmentation on the content of the application data unit field of the industrial communication protocol to generate a set of overlapping byte sequence segments with a fixed window length and a fixed sliding step size. Calculate the information entropy value of each overlapping byte sequence segment in the set of overlapping byte sequence segments, and mark overlapping byte sequence segments with information entropy values ​​exceeding a preset information entropy threshold as high randomness payload segments.

[0118] Set the window length L and the sliding step size S. Starting from the beginning of the data unit field content in the industrial communication protocol application, sequentially extract byte sequence segments of length L, sliding forward S bytes each time, with an overlap of LS bytes between adjacent segments. For each byte sequence segment, calculate the information entropy value H = -Σp_i*log2(p_i), where p_i is the frequency of byte value i in the segment. Set an information entropy threshold H_th, and mark segments with H > H_th as high randomness payload segments.

[0119] Step S430: Using the offset starting point and segment length of the high randomness payload fragment in the field content of the industrial communication protocol application data unit as feature extraction boundary parameters, extract the attack feature code candidate string sequence from the field content of the industrial communication protocol application data unit, perform string fuzzy hash matching processing on the attack feature code candidate string sequence and the known attack feature library pre-installed in the industrial control network intrusion detection system, and remove redundant attack feature code candidate string sequences whose similarity to existing feature entries in the known attack feature library exceeds the preset similarity tolerance.

[0120] Record the starting offset and length of each highly random payload fragment within the application data unit field content. Using these positions and lengths as boundaries, extract the corresponding substrings from the original application data unit field content to obtain a sequence of candidate attack signature strings. Calculate a fuzzy hash value (such as ssdeep hash) for each candidate string and compare it with the fuzzy hash values ​​of existing feature entries in the known attack signature database. If the similarity exceeds a preset similarity tolerance, mark the candidate string as redundant and discard it.

[0121] Step S440: Perform regular expression syntax transformation on the candidate string sequence of attack signature codes after removing redundancy to generate attack signature code regular expression rule entries that describe the structural pattern of the candidate string sequence of attack signature codes. Write the attack signature code regular expression rule entries into the rule base file of the industrial control network intrusion detection system and load the rule base file into the feature matching engine memory structure of the industrial control network intrusion detection system.

[0122] The candidate string sequences of attack signatures, after redundancy removal, undergo regular expression transformation: fixed strings are converted to literals, and variable parts (such as the value range of certain bytes) are converted to character sets or wildcards. The generated regular expression rule entries are appended to the intrusion detection system's rule base file. A rule base reload operation is triggered, loading the new rule entries into the feature matching engine's memory.

[0123] Step S450: After the feature matching engine memory structure of the industrial control network intrusion detection system completes the rule base file reload operation, the attack feature code regular expression rule entries are applied to the real-time deep packet inspection and filtering process of the subsequently received industrial control network communication data stream.

[0124] The feature matching engine extracts the application-layer payload of each subsequently received data packet and matches it against regular expression rule entries in memory. The matching algorithm employs either a deterministic finite automaton or a non-deterministic finite automaton.

[0125] Step S460: When a data frame unit that matches the attack signature regular expression rule entry is found in the real-time deep packet inspection filtering process, a discard operation is immediately triggered for the data frame unit and an alarm log record containing the matching rule number and the matching timestamp is generated.

[0126] When a data packet payload successfully matches a regular expression rule entry, the feature matching engine immediately discards the packet to prevent the attack payload from reaching the target device. Simultaneously, an alarm log is generated, containing information such as the matching rule number, matching timestamp, source address, and destination address.

[0127] For example, the method may further include: step S510: after triggering the port shutdown operation and traffic mirroring analysis operation, collecting the port transmit / receive byte counter value and the port transmit / receive data packet counter value of the industrial control network switching equipment as the basic data for port traffic statistics, and performing time window aggregation processing on the basic data for port traffic statistics according to a fixed time aggregation granularity to generate a set of port traffic throughput time series curve data points.

[0128] The system periodically collects the transmit / receive byte counters and transmit / receive packet counters of the switching device ports using the Simple Network Management Protocol (SMMP). A time aggregation granularity T_agg (e.g., 1 second) is set. The throughput within each time window is calculated as: (current window counter value - previous window counter value) / T_agg. The throughput values ​​for each time window are arranged in chronological order to generate a set of time-series curve data points for port traffic throughput.

[0129] Step S520: Input the set of port traffic throughput time series curve data points into the self-learning time series prediction analysis model pre-set in the industrial control network intrusion detection system. The self-learning time series prediction analysis model outputs a sequence of predicted port traffic throughput values ​​within a preset time period in the future.

[0130] The self-learning time series prediction analysis model employs an autoregressive moving average model or a long short-term memory network. The model input is a throughput sequence within a past time window, and the output is a sequence of predicted throughput values ​​for a future preset time period. The specific architecture, training process, and application methods of the self-learning time series prediction analysis model are detailed below.

[0131] This self-learning time series prediction analysis model employs a Long Short-Term Memory (LSTM) network architecture, comprising an input layer, two LSM hidden layers, and a fully connected output layer. The input layer receives port traffic throughput sequence data from the past W time windows, with each time step having a feature dimension of 1 (i.e., a univariate time series). The first LSM hidden layer contains 128 memory units, and the second LSM hidden layer contains 64 memory units. Each Long Short-Term Memory (LSTM) unit has the following internal structure: a forget gate f_t = sigmoid(W_f·[h_{t-1}, x_t] + b_f), an input gate i_t = sigmoid(W_i·[h_{t-1}, x_t] + b_i), an output gate o_t = sigmoid(W_o·[h_{t-1}, x_t] + b_o), a candidate memory unit state c't = tanh(W_c·[h_{t-1}, x_t] + b_c), a memory unit state update c_t = f_t * c_{t-1} + i_t * c't, and a hidden state update h_t = o_t * tanh(c_t). The fully connected output layer maps the output h_T of the last time step of the second LSM hidden layer to the predicted value y_pred = W_y·h_T + b_y.

[0132] The training process of this self-learning time-series predictive analysis model is as follows. The training dataset consists of time-series data on port traffic throughput collected during the normal operation of industrial control network switching equipment, containing a total of 50,000 samples. Each sample uses throughput observations from 100 consecutive time points as input features, with the corresponding labels being throughput observations from the subsequent 10 time points. The input data is standardized using Z-Score: x'=(x-μ) / σ, where μ is the mean of the training set and σ is the standard deviation of the training set. The loss function is the mean squared error loss MSE=(1 / N)*Σ(y_pred-y_true)^2. The optimizer is Adam, with an initial learning rate of 0.001, an exponential decay rate beta1 for the first moment estimation of 0.9, and an exponential decay rate beta2 for the second moment estimation of 0.999. The batch size is set to 32, and the number of training epochs is set to 100. An early stopping mechanism is used, stopping training when the validation set loss does not decrease for 15 consecutive epochs. The evaluation index is the mean absolute percentage error (MAPE) = (1 / N) * Σ|(y_pred-y_true) / y_true|.

[0133] When applying the model, port traffic throughput data is collected in real time and Z-score standardized according to the standardized parameters used during training. The standardized sequence data of the past W time points is input into the model, and after forward propagation, the model outputs standardized prediction values ​​for the next H time points. The prediction values ​​are then de-standardized (multiplied by the standard deviation of the training set and added to the mean) to obtain a sequence of physically meaningful port traffic throughput prediction values.

[0134] Step S530: Calculate the deviation fluctuation range between the predicted port traffic throughput value sequence within the future preset time period and the actual observed port traffic throughput value sequence during the same historical period. If the actual observed port traffic throughput value exceeds the upper or lower limit of the deviation fluctuation range multiple times consecutively, it is determined that the industrial control network communication link connected to the corresponding port has abnormal traffic fluctuation behavior.

[0135] Calculate the residual sequence between the predicted value and the historical actual observation value, and determine the mean and standard deviation of the residuals. Set the deviation fluctuation range to mean ± k times the standard deviation. When the actual observation value exceeds this range for M consecutive times (e.g., 3 times), it is determined that there is abnormal flow fluctuation behavior.

[0136] Step S540: For industrial control network communication links exhibiting abnormal traffic fluctuations, extract traffic payload data packet samples from the communication link during the period of abnormal fluctuations, and perform fast protocol parsing processing on the traffic payload data packet samples to identify the distribution concentration characteristics of their protocol function code fields. If the distribution concentration characteristics of the protocol function code fields show that the frequency of occurrence of a single protocol function code field exceeds the preset concentration judgment baseline, it is determined that the communication link is suffering from a denial-of-service attack targeting a specific protocol function code.

[0137] During the period of abnormal fluctuations, capture traffic payload data packet samples of the link. Quickly parse the industrial communication protocol header of each data packet to extract the protocol function code field. Analyze the frequency of occurrence of each protocol function code value. If the frequency of occurrence of a certain protocol function code value exceeds a preset concentration threshold (e.g., 80%), it is determined to be a denial-of-service attack targeting that specific protocol function code.

[0138] Step S550: Based on the determination result of the denial-of-service attack behavior, generate an access control list blacklist rule entry for the address identifier field of the source device connected to the communication link, and set the filtering action field of the access control list blacklist rule entry to drop data packets.

[0139] Construct an access control list rule entry. The rule matching condition is that the source device address identifier field equals the source device address of the attacked link, and the rule action is drop. This rule entry will be used to block all subsequent traffic from this source address.

[0140] Step S560: The access control list blacklist rule entries are sent to the access control list rule hardware storage table entries of each switching device in the industrial control network through the remote procedure call interface. After the access control list rule hardware storage table entries complete the rule entry writing operation, the dedicated integrated circuit chip of the switching device performs a hardware line-speed discard operation on the data packets that match the access control list blacklist rule entries.

[0141] Access control list (ACL) blacklist rule entries are sent to each switching device via a remote procedure call (RPC) interface. The switching device then writes these rule entries into the ACL hardware storage table of its application-specific integrated circuit (ASIC) chip. When subsequent data packets arrive at the switching device, the ASIC chip performs a hardware-level match; if a match is found, the packet is discarded without consuming CPU resources.

[0142] Step S610: After generating the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path, the set of abnormal topology node entities in the protocol state transition topology path is arranged into an abnormal topology node time sequence according to their appearance order in the protocol state transition topology path, and the set of abnormal semantic association edge entities in the control command semantic association path is arranged into an abnormal semantic association edge time sequence according to their position index in the control command semantic association path.

[0143] Extract all anomalous topology node entities from the protocol state transition topology path and arrange them in the order of their appearance to form an anomalous topology node temporal sequence. Extract all anomalous semantic association edge entities from the control instruction semantic association path and arrange them according to their position index to form an anomalous semantic association edge temporal sequence.

[0144] Step S620: For each abnormal topology node entity in the abnormal topology node time sequence, extract the communication endpoint dual identifier contained in the abnormal topology node entity, and map the communication endpoint dual identifier to the corresponding physical device function role type descriptor. The physical device function role type descriptor includes engineer station device identifier, operator station device identifier, programmable logic controller device identifier, and human-machine interface device identifier.

[0145] Extract the communication endpoint dual identifier from each abnormal topology node entity and split it into source device address and destination device address. According to the preset device function role mapping table, convert the device address into device function role type descriptor (such as "engineer station", "operator station", "programmable logic controller", "human-machine interface").

[0146] Step S630: For each abnormal semantic association edge entity in the abnormal semantic association edge time sequence, extract the logical identifier of the industrial field controlled execution component associated with the source semantic node and the logical identifier of the industrial field controlled execution component associated with the destination semantic node corresponding to the abnormal semantic association edge entity, and generate a description of the dual relationship of control permission jump of the controlled component.

[0147] Extract the controlled execution component logical identifier from the source semantic node of each anomalous semantic association edge entity, and extract another controlled execution component logical identifier from the destination semantic node. Pair these two identifiers to generate a controlled component control permission jump dual relationship description, indicating that the attacker is attempting to transfer control permissions from one component to another.

[0148] Step S640: Perform cross-layer association mapping processing on the physical device functional role type descriptor and the control permission jump dual relationship description of the controlled component to construct a cross-layer attack behavior association graph structure from abnormal behavior of the industrial control network communication protocol layer to abnormal behavior of the industrial field physical device control layer. The top-level node of the cross-layer attack behavior association graph structure represents the functional role of the industrial control network physical device affected by the attack, the bottom-level node of the cross-layer attack behavior association graph structure represents the controlled execution component of the industrial field affected by the attack, and the inter-layer edges of the cross-layer attack behavior association graph structure represent the penetration and transmission relationship of the attack behavior from the communication protocol layer to the physical control layer.

[0149] Create a bipartite graph structure. The top-level node set consists of physical device function role type descriptors, and the bottom-level node set consists of controlled execution component logical identifiers. Edges between top-level nodes are established based on the time sequence of abnormal topology nodes, and edges between bottom-level nodes are established based on the time sequence of abnormal semantic association edges. Inter-layer edges from top-level nodes to bottom-level nodes are established based on the mapping relationship between communication endpoint dual identifiers and controlled execution component logical identifiers.

[0150] Step S650: Perform graph topology propagation dynamics simulation on the cross-layer attack behavior association graph structure, using the top-level node in the cross-layer attack behavior association graph structure as the source node for the attack incentive signal injection, and the inter-layer edges in the cross-layer attack behavior association graph structure as the propagation channel for the attack incentive signal, to simulate the dynamic process of the attack incentive signal spreading from the top-level node to the bottom-level node along the inter-layer edges.

[0151] A graph propagation algorithm is employed, setting the initial excitation signal strength of the top-level node to 1. Iterative propagation occurs along inter-layer edges, and the excitation signal strength received by each bottom-level node is equal to the sum of the excitation signal strengths of all its incoming edge source nodes multiplied by the edge weights. The edge weights are determined based on the frequency and temporal correlation of anomalous behavior.

[0152] Step S660: After the graph topology propagation dynamics simulation processing reaches the steady-state convergence condition, extract the cumulative intensity value of the attack incentive signal of each bottom node in the cross-layer attack behavior association graph structure, mark the logical identifier of the industrial field controlled execution component corresponding to the bottom node whose cumulative intensity value of the attack incentive signal exceeds the preset signal strength response threshold as the target controlled execution component, extract the control permission jump path sequence of the target controlled execution component in the control permission jump dual relationship description of the controlled component, and identify the intermediate stepping board device functional role identifier sequence traversed during the abnormal transfer of control permission from the normal authorized device functional role to the target controlled execution component.

[0153] Steady state is reached when the change in excitation signal intensity of each node before and after iteration is less than the convergence threshold. Low-level nodes whose excitation signal intensity exceeds a preset threshold are selected, and their associated controlled execution components are marked as target controlled execution components. The complete path from the top-level node to the target controlled execution component is extracted from the controlled component control permission jump duality description, and the sequence of intermediate device function role identifiers along the path is recorded.

[0154] Step S670: Based on the deployment location relationship of each jump device functional role in the intermediate jump device functional role identifier sequence in the physical topology of the industrial control network, generate a set of jump device communication isolation instructions for blocking abnormal transmission paths of control permissions. The set of jump device communication isolation instructions includes virtual local area network reconfiguration parameters and access control list temporary blocking rule entries for each jump device in the intermediate jump device functional role identifier sequence.

[0155] For each intermediate jump device, generate VLAN reconfiguration parameters (isolate it to a separate VLAN) and access control list temporary blocking rule entries (block its communication with upstream and downstream devices).

[0156] Step S680: The communication isolation command set of the jump device is sent to the core layer aggregation switch of the industrial control network through the security configuration management protocol. The core layer aggregation switch parses the virtual LAN reconfiguration parameters and modifies the virtual LAN membership attributes of the corresponding ports. The core layer aggregation switch parses the access control list temporary blocking rule entries and writes the access control list temporary blocking rule entries into the hardware access control list lookup table of the switch dedicated integrated circuit chip.

[0157] The isolation command is sent to the core layer aggregation switching device via the security configuration management protocol. The switching device modifies the virtual LAN to which the port belongs based on the virtual LAN reconfiguration parameters, and adds filter entries to the hardware access control list lookup table according to the access control list temporary blocking rule entries.

[0158] Step S690: After completing the issuance and activation of the communication isolation command set of the jump device, continuously monitor the value change trend of the instruction operation value range field in the industrial control instruction opcode field payload corresponding to the target controlled execution component. When the value change trend of the instruction operation value range field returns to the preset safe operation value envelope interval, generate an attack cross-layer penetration blocking effect confirmation record.

[0159] After the isolation command takes effect, the numerical changes of the corresponding register address of the target controlled execution component are continuously monitored. When the mean and variance of the numerical sequence return to the statistical range of historical normal operation, the attack is determined to have been successfully blocked, and a blocking effect confirmation record is generated.

[0160] Step S710: After sending the set of linked defense instructions to the industrial control network switching device to trigger port shutdown operation and traffic mirroring analysis operation, continuously acquire the replicated network communication traffic data stream from the security analysis device associated with the traffic mirroring analysis operation, and cache the replicated network communication traffic data stream in the local persistent storage area to form an attack forensics traffic history archive file. Perform protocol deep parsing and reconstruction processing on each industrial communication protocol data frame unit contained in the attack forensics traffic history archive file, extract the transaction processing identifier field, protocol function code field and industrial control instruction operation code field payload carried by each industrial communication protocol data frame unit, and reassemble the scattered industrial communication protocol data frame units into a complete session interaction record sequence according to the consistency of the transaction processing identifier field.

[0161] The security analysis equipment continuously receives and replicates network communication traffic data streams through the mirrored destination observation port, simultaneously writing these data streams to a local persistent storage area to form an attack forensics traffic history archive file. For each industrial communication protocol data frame unit in the archive file, the transaction processing identifier field, protocol function code field, and industrial control instruction opcode field payload are extracted. All data frame units with the same transaction processing identifier field value are grouped into the same session and arranged in timestamp order to form a complete session interaction record sequence. Each session interaction record contains complete information about the request frame and the corresponding response frame.

[0162] Step S720: In the session interaction record sequence, locate all session interaction record subsequences between the source device address identifier field corresponding to the location coordinates of the attack disturbance source during the attack period and the target device address identifier field affected by the attack. Analyze and process the temporal distribution characteristics of the protocol function code field in the session interaction record subsequence, extract the occurrence order pattern of the protocol function code field in the session interaction record subsequence and the time interval pattern between adjacent protocol function code fields, and generate a protocol function code temporal pattern signature that represents the fingerprint of the industrial communication protocol detection and scanning behavior used by the attacker during the attack.

[0163] From the session interaction record sequence, all records whose source device address identifier field equals the device address corresponding to the location coordinates of the attack disturbance source, and whose destination device address identifier field equals the address of the attacked device, are selected to form a session interaction record subsequence. Pattern mining is performed on the protocol function code field sequence in this subsequence: the sequential sequence of protocol function codes (e.g., 0x03, 0x03, 0x06, 0x10) is recorded, and the time interval sequence between adjacent protocol function codes is calculated. The occurrence order pattern and the time interval pattern are combined and encoded to generate a protocol function code timing pattern signature.

[0164] Step S730: Perform fine-grained parsing processing on the industrial control instruction opcode field payload in the session interaction record subsequence, extract the address jump step size pattern of the instruction operation object register address field and the numerical change gradient pattern of the instruction operation value range field in the industrial control instruction opcode field payload, generate a control instruction operation mode signature that represents the industrial control instruction injection behavior fingerprint used by the attacker during the attack, and perform feature concatenation and fusion processing on the protocol function code timing mode signature and the control instruction operation mode signature to generate an attacker behavior fingerprint feature vector that uniquely identifies the attacker behavior pattern in the corresponding attack event.

[0165] For each data frame in the session interaction record subsequence, the value of the instruction operation object register address field is extracted, and the address jump step size (the difference between the current address and the previous address) between adjacent instructions is calculated to form an address jump step size sequence. The value of the instruction operation value range field is extracted, and the magnitude of value change between adjacent instructions is calculated to form a value mutation gradient sequence. The statistical features (mean, variance) of the address jump step size sequence and the statistical features of the value mutation gradient sequence are combined to form a control instruction operation mode signature. The protocol function code timing mode signature and the control instruction operation mode signature are concatenated into a multi-dimensional feature vector, i.e., the attacker's behavior fingerprint feature vector.

[0166] Step S740: Perform cosine similarity comparison calculation between the attacker behavior fingerprint feature vector and the historical attacker behavior fingerprint feature vector entries stored in the attacker behavior fingerprint knowledge base of the industrial control network intrusion detection system. If the cosine similarity comparison calculation result exceeds the preset similarity judgment threshold, the current attack event and the historical attack event are attributed to the same attacker organization entity.

[0167] The attacker behavior fingerprint knowledge base stores attacker behavior fingerprint feature vectors extracted from historical attack events and their corresponding attacker organization entity identifiers. The cosine similarity between the current attacker behavior fingerprint feature vector and each historical feature vector in the knowledge base is calculated as: sim = (V_cur·V_hist) / (||V_cur||*||V_hist||). If sim exceeds a preset similarity threshold, the current attack event is attributed to the same attacker organization entity.

[0168] The attacker behavior fingerprint knowledge base is constructed as follows.

[0169] This attacker behavior fingerprint knowledge base stores attacker behavior fingerprint feature vectors extracted from historical attack events and their corresponding attacker organization entity identifiers. Each attacker behavior fingerprint feature vector is composed of a protocol function code timing pattern signature and a control instruction operation pattern signature, with a dimension of 128. The knowledge base is implemented using vector database technology and supports efficient cosine similarity retrieval.

[0170] The knowledge base's data sources include: historical alarm data from industrial control network intrusion detection systems, investigation and analysis reports from security incident response teams, and attacker behavior analysis reports provided by threat intelligence sharing platforms. Each knowledge base entry includes: attacker organization entity identifiers (e.g., "APT group X", "ransomware family Y"), attacker behavior fingerprint feature vectors, and historical attack strategy preference feature records (including commonly used vulnerability types, preferred register address ranges, and typical attack step sequence patterns). The knowledge base is continuously updated through manual annotation and verification by security analysts.

[0171] Step S750: After attributing the current attack event and the historical attack event to the same attacker organization, retrieve the historical attack strategy preference feature record associated with the attacker organization from the attacker behavior fingerprint knowledge base. The historical attack strategy preference feature record includes the industrial communication protocol vulnerability exploitation target type commonly used by the attacker organization, the preferred industrial control instruction injection target register address range, and typical multi-stage attack step sequence pattern.

[0172] Retrieve historical attack strategy preference records associated with this attacker's organization from the knowledge base. These records include the types of industrial communication protocol vulnerabilities that the organization commonly exploits (such as buffer overflow vulnerabilities with function code 0x06), the preferred instruction injection target register address ranges (such as Modbus addresses 0x40001-0x40010), and typical attack sequence steps (such as scan → probe → inject → spread).

[0173] Step S760: Based on the multi-stage attack step sequence pattern recorded in the historical attack strategy preference feature record, and on the basis of the currently completed attack steps, predict and infer the type of the next stage attack step that the attacker organization may launch in the subsequent preset observation period and the functional role type of the target industrial control network device targeted by the next stage attack step.

[0174] The currently observed attack step sequence is matched with the multi-stage attack step sequence pattern in the historical attack strategy preference feature record using the longest common subsequence. Based on the matched position, the types of subsequent attack steps that have not yet appeared and the target device functional roles targeted by these steps are predicted.

[0175] Step S770: Based on the type of the next stage attack step and the functional role type of the target industrial control network device targeted by the next stage attack step, generate a set of pre-defense configuration instructions for the predicted attack step. The set of pre-defense configuration instructions includes protocol function code whitelist filtering rules and control instruction operation value range threshold restriction rules for the industrial control network device corresponding to the functional role type of the target industrial control network device.

[0176] Construct a whitelist filtering rule for protocol function codes: only allow protocol function codes required for the normal operation of this device role to pass through, and discard data frames of other function codes. Construct a threshold limit rule for the numerical range of control instructions: only allow values ​​written to registers within a preset safe range, and automatically truncate values ​​outside the range to a safe default value.

[0177] Step S780: The pre-defense configuration instruction set is pre-issued to the management configuration interface of the industrial control network device corresponding to the functional role type of the target industrial control network device. The industrial control network device parses the protocol function code whitelist filtering rule and discards the data frames corresponding to non-whitelist protocol function codes. The industrial control network device parses the control command operation value range threshold limit rule and sets the control command operation value exceeding the security threshold range to the preset security default value. After completing the pre-issue and activation of the pre-defense configuration instruction set, the device continuously monitors the operation status log records of the industrial control network device corresponding to the functional role type of the target industrial control network device. If the protocol function code whitelist filtering rule or the control command operation value range threshold limit rule is detected to be triggered, a defense success event report is generated indicating that the attacker's next stage attack attempt has been pre-blocked.

[0178] The pre-defense configuration command set is distributed to the management configuration interface of the target industrial control network device via a security configuration management protocol. The device loads protocol function code whitelist filtering rules to filter received data frames; it also loads control command operation value range threshold restriction rules to perform value verification on write operations. The device's operational status log is continuously monitored, and a defense success event report is generated when a whitelist rule is triggered (non-whitelist function codes are discarded) or a value range rule is triggered (values ​​outside the range are truncated).

[0179] Based on the same inventive concept, please refer to Figure 2 This diagram illustrates a schematic block diagram of an intelligent detection and defense system against industrial control network attacks provided in an embodiment of this application. The system includes a central processing unit (CPU), a system memory comprising random access memory (RAM) and read-only memory (ROM), and a system bus connecting the system memory and the CPU. The intelligent detection and defense system against industrial control network attacks also includes a basic input / output system to facilitate information transfer between various devices within the computer, and a large-capacity storage device for storing the operating system, applications, and other program modules.

[0180] A basic input / output system includes a display for showing information and input devices such as a mouse and keyboard for user input. Both the display and the input devices are connected to the central processing unit via an input / output controller connected to the system bus. The basic input / output system may also include an input / output controller for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller also provides output to a display screen, printer, or other types of output devices.

[0181] Mass storage devices are connected to the central processing unit via a mass storage controller connected to the system bus. The mass storage devices and their associated computer-readable media provide non-volatile storage for intelligent detection and defense against attacks on industrial control networks. Without loss of generality, computer-readable media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. According to various embodiments of this application, intelligent detection and defense against attacks on industrial control networks can also be implemented via a network connection to a remote computer on the network, such as the Internet. That is, intelligent detection and defense against attacks on industrial control networks can be connected to a network via a network interface unit connected to the system bus, or the network interface unit can be used to connect to other types of networks or remote computer systems.

[0182] In addition, in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0183] The above are merely exemplary embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application shall be included within the protection scope of this application.

Claims

1. A method for intelligent detection and defense against attacks on industrial control networks, characterized in that, The method includes: The raw network communication data stream transmitted in the industrial control network communication link is collected, and the raw network communication data stream is divided into multiple data frame units with continuous time sequence markers. The data frame unit includes the industrial communication protocol header field payload and the industrial control instruction opcode field payload. Extract the protocol state transition identifier sequence of the industrial communication protocol header field payload and the control instruction semantic identifier sequence of the industrial control instruction opcode field payload from the data frame unit. Construct a protocol state transition topology path based on the protocol state transition identifier sequence and a control instruction semantic association path based on the control instruction semantic identifier sequence. The protocol state transition topology path is compared with the preset industrial communication protocol baseline state transition topology path to generate a first deviation distribution description. The control command semantic association path is compared with the preset set of legal control command semantic association paths to generate a second deviation distribution description. Spatiotemporal coupling perturbation localization processing is performed on the first deviation distribution description and the second deviation distribution description to generate the location coordinates of the attack perturbation source and the vector description of the attack perturbation propagation path; Based on the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path, a set of linked defense instructions containing port blocking instructions and traffic bypass redirection instructions is generated. The set of linked defense instructions is sent to the industrial control network switching equipment to trigger port shutdown operation and traffic mirroring analysis operation. The step of separating and extracting the protocol state transition identifier sequence of the industrial communication protocol header field payload and the control instruction semantic identifier sequence of the industrial control instruction opcode field payload from the data frame unit, constructing a protocol state transition topology path based on the protocol state transition identifier sequence, and constructing a control instruction semantic association path based on the control instruction semantic identifier sequence includes: For each data frame unit with a continuous time series marker, the specific encoded value of the protocol function code field in the industrial communication protocol header field payload is parsed, and the specific encoded value of the protocol function code field is mapped to the corresponding protocol interaction behavior type descriptor. Extract the source device address identifier field and the destination device address identifier field from the payload of the industrial communication protocol header. Combine the source device address identifier field and the destination device address identifier field to form a communication endpoint dual identifier. Perform triple concatenation processing on the communication endpoint dual identifier and the protocol interaction behavior type descriptor to generate a protocol state transition identifier atomic unit containing a communication initiator address identifier, a communication receiver address identifier, and a protocol interaction behavior type descriptor. According to the increasing order of the continuous time series markers, the multiple protocol state transition marker atomic units corresponding to the dual identifier of the same communication endpoint are arranged end to end to generate a protocol state transition marker sequence representing the stage transition relationship of the industrial communication protocol interaction process. Using each protocol state transition identifier atomic unit in the protocol state transition identifier sequence as a topology node, and the temporal adjacency relationship between two adjacent protocol state transition identifier atomic units as a topology directed edge, a protocol state transition topology path consisting of a set of topology nodes and a set of topology directed edges is constructed. For each data frame unit with a continuous time series marker, the specific encoding value of the instruction operation type encoding field in the industrial control instruction opcode field payload is parsed, and the specific encoding value of the instruction operation type encoding field is mapped to the corresponding control instruction action type descriptor. Extract the address offset of the instruction operation object register address field in the load of the industrial control instruction opcode field, map the address offset to the corresponding logical identifier of the industrial field controlled execution component, and perform binary concatenation processing on the control instruction action type descriptor and the logical identifier of the industrial field controlled execution component to generate a control instruction semantic identifier atomic unit that represents the execution of a specific control action on a specific industrial field controlled execution component. According to the increasing order of the continuous time series markers, multiple control instruction semantic identifier atomic units that act on the logical identifiers of controlled execution components in the same industrial site are arranged end to end to generate a control instruction semantic identifier sequence representing the evolution process of the industrial control instruction operation intent. Each control instruction semantic identifier atomic unit in the control instruction semantic identifier sequence is used as a semantic node, and the control intent transition relationship between two adjacent control instruction semantic identifier atomic units is used as a semantic association edge to construct a control instruction semantic association path composed of a set of semantic nodes and a set of semantic association edges.

2. The intelligent detection and defense method for industrial control network attacks according to claim 1, characterized in that, The raw network communication data stream transmitted in the industrial control network communication link is collected, and the raw network communication data stream is divided into multiple data frame units with continuous time series markers, including: The physical layer electrical signal waveform sequence flowing through the mirror port of the industrial control network switching equipment is captured, the physical layer electrical signal waveform sequence is converted into a binary bit stream sequence, the preamble synchronization header field of the industrial communication protocol is identified from the start offset position of the binary bit stream sequence, and the binary bit stream sequence is subjected to frame start delimiting processing based on the boundary delimiter of the preamble synchronization header field. After completing the frame start delimiting process, the binary values ​​of the length indicator field after the frame start delimiter are sequentially read from the binary bit stream sequence. Based on the binary values ​​of the length indicator field, a continuous bit sequence segment is extracted from the starting position of the current frame start delimiter to the specified length offset position. Cyclic redundancy check (CRC) code calculation is performed on the extracted continuous bit sequence segment. The calculated CRC code result is matched with the CRC code field carried at the end of the continuous bit sequence segment for numerical consistency matching. After the numerical consistency matching passes, the continuous bit sequence segment is marked as a valid data frame unit. Locate the starting offset position of the industrial communication protocol header field in the effective data frame unit, and extract the source device address identifier field, destination device address identifier field, protocol function code field and transaction processing identifier field as the industrial communication protocol header field payload starting from the starting offset position of the industrial communication protocol header field. Locate the starting offset position of the industrial control instruction opcode field in the effective data frame unit, and extract the instruction operation type encoding field, instruction operation object register address field, and instruction operation value range field as the payload of the industrial control instruction opcode field starting from the starting offset position of the industrial control instruction opcode field. Multiple valid data frame units belonging to the same continuous communication session are grouped and aggregated according to the consistency of the transaction processing identifier field to generate a session group aggregation cluster. The valid data frame units contained in each session group aggregation cluster are timestamped according to the order in which the frames arrive at the mirror port, and a monotonically increasing continuous time series marker is attached to each valid data frame unit. The valid data frame units with the attached continuous time series markers are stored in a circular buffer storage area. The circular buffer storage area is used to maintain a snapshot of historical data frame units within a preset time window. The valid data frame units with attached continuous time series markers stored in the circular buffer storage area are output as a whole as multiple data frame units with continuous time series markers.

3. The intelligent detection and defense method for industrial control network attacks according to claim 1, characterized in that, The process of comparing the protocol state transition topology path with a preset industrial communication protocol baseline state transition topology path to generate a first deviation distribution description, and comparing the control command semantic association path with a preset set of legal control command semantic association paths to generate a second deviation distribution description, includes: Obtain the industrial communication protocol baseline state transition topology path template pre-installed in the industrial control network intrusion detection system. The industrial communication protocol baseline state transition topology path template defines the legal protocol state transition topology node sequence and legal topology directed edge connection relationship allowed in the normal communication process of the industrial control network. The set of topology nodes contained in the protocol state transition topology path is compared with the set of legal topology nodes contained in the industrial communication protocol baseline state transition topology path template to identify abnormal topology node entities that exist only in the protocol state transition topology path but not in the set of legal topology nodes. The set of directed edges in the protocol state transition topology path is compared with the set of legal directed edges in the industrial communication protocol benchmark state transition topology path template to identify abnormal directed edge entities whose connection relationship between the source topology node and the destination topology node does not conform to the definition specification of the legal directed edge set. Calculate the frequency of occurrence of the abnormal topology node entity in the protocol state transition topology path and record it as the abnormal node occurrence frequency parameter; calculate the frequency of occurrence of the abnormal topology directed edge entity in the protocol state transition topology path and record it as the abnormal directed edge occurrence frequency parameter. Mark the node position coordinates of the abnormal topology node entity and the directed edge path trajectory of the abnormal topology directed edge entity on the topology structure diagram of the protocol state transition topology path, and generate a protocol state transition topology path deviation diagram description with deviation position annotation. The frequency parameters of the occurrence of abnormal nodes, the frequency parameters of the occurrence of abnormal directed edges, and the description of the deviation diagram of the protocol state transition topology path with deviation position annotation are combined and encapsulated to generate a first deviation distribution description. Obtain a template of a set of legal semantic association paths for control commands pre-installed in an industrial control network intrusion detection system. The template defines a set of semantic node sequences and a set of legal semantic association edge connections for legal control command semantic association paths allowed in the normal production process of the industrial control network. The semantic node sequence contained in the semantic association path of the control instruction is compared with the semantic node sequence of each legal semantic association path of the control instruction in the template of the legal semantic association path of the control instruction, and the number of sequence editing operation steps is calculated as the sequence semantic deviation parameter. The semantic association edges in the control instruction semantic association path are compared with the legal semantic association edges in the control instruction legal semantic association path set template. Abnormal semantic association edge entities whose source semantic node and destination semantic node jump relationship does not conform to the legal control instruction operation logic specification are identified. The sequence semantic deviation parameter is recorded, and the position information of the abnormal semantic association edge entities in the control instruction semantic association path is extracted to generate an abnormal semantic association edge position list. The sequence semantic deviation parameter and the abnormal semantic association edge position list are combined and encapsulated to generate a second deviation distribution description.

4. The intelligent detection and defense method for industrial control network attacks according to claim 1, characterized in that, The step of performing spatiotemporal coupling perturbation localization processing on the first deviation distribution description and the second deviation distribution description to generate the location coordinates of the attack perturbation source and the vector description of the attack perturbation propagation path includes: The node position coordinates of the abnormal topological node entity and the continuous time series label range corresponding to the abnormal topological node entity are parsed from the first deviation distribution description. The directed edge path trajectory of the abnormal topological directed edge entity and the continuous time series label range corresponding to the abnormal topological directed edge entity are parsed from the first deviation distribution description. The position index sequence of the abnormal semantic associated edge entity and the continuous time series label range corresponding to the abnormal semantic associated edge entity are parsed from the second deviation distribution description; The continuous time series label range corresponding to the abnormal topological node entity and the continuous time series label range corresponding to the abnormal semantic associated edge entity are time axis aligned and covered. The time overlap region sequence in which the two overlap on the time axis is extracted. For each time overlap region in the time overlap region sequence, the composite abnormal event concurrent fragment in the time overlap region that simultaneously contains abnormal topological node entity, abnormal topological directed edge entity and abnormal semantic associated edge entity is extracted. For the concurrent fragments of the composite abnormal events, the source device address identifier field carried by the earliest abnormal topology node entity is extracted, the source device address identifier field is mapped to the corresponding physical network access port logical identifier, and the physical network access port logical identifier is used as the coordinate for locating the source of the attack disturbance. For the concurrent fragments of the composite abnormal events, the destination device address identifier field sequence of the directed edge entity of the abnormal topology is extracted sequentially in ascending order of the continuous time series markers to generate the subsequent infected device address identifier transition chain sequence starting from the location coordinates of the attack disturbance source. Based on the physical network topology deployment location corresponding to each device address identifier in the subsequent infected device address identifier transition chain sequence, draw directional line segments and line segment length ratios from the location coordinates of the attack disturbance source to each subsequent infected device address identifier on the industrial control network physical topology diagram, and convert the directional line segments and line segment length ratios into an attack disturbance propagation path vector description that includes spatial direction angle parameters and propagation distance step size parameters. The coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path are associated and bound together to generate a dataset of attack disturbance spatiotemporal location and propagation description used to describe the spatiotemporal spread process of the attack in the network.

5. The intelligent detection and defense method for industrial control network attacks according to claim 1, characterized in that, The process involves generating a set of coordinated defense commands, including port blocking commands and traffic bypass redirection commands, based on the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path. This set of coordinated defense commands is then sent to the industrial control network switching equipment to trigger port shutdown and traffic mirroring analysis operations. Based on the logical identifier of the physical network access port corresponding to the location coordinates of the attack disturbance source, the corresponding switching device management Internet Protocol address and physical port index number are searched in the preset industrial control network switching device port configuration mapping table. Generate a port management configuration instruction data packet for the management Internet Protocol address and physical port index number of the switching device. The payload of the port management configuration instruction data packet includes a port management status field and the port management status field is set to a port closed status code value. Based on the subsequent infected device address identifier transition chain sequence in the attack disturbance propagation path vector description, the switching device management Internet Protocol address and physical port index number corresponding to the subsequent infected device address identifier are extracted hop by hop. For each infected device address identifier in the subsequent infected device address identifier transition chain sequence, a corresponding traffic mirroring configuration instruction data packet is generated. The payload of the traffic mirroring configuration instruction data packet includes a source port index field to be mirrored and a destination observation port index field. The port management configuration instruction data packet and the traffic mirroring configuration instruction data packet are sorted and combined according to the instruction execution priority, wherein the instruction execution priority of the port management configuration instruction data packet is set to the highest priority level, and the instruction execution priority of the traffic mirroring configuration instruction data packet is set to the second-highest priority level. The port management configuration instruction data packet and the traffic mirroring configuration instruction data packet, after sorting and combining, are encapsulated into a set of linked defense instructions containing attack source shutdown instruction fields and attack path mirroring instruction fields. The set of linked defense instructions is sent to the Simplified Network Management Protocol (SMMP) proxy process of the industrial control network switching device corresponding to the attack disturbance source location coordinates through a Simple Network Management Protocol (SMMP) message write operation. The port management configuration instruction data packet is parsed, and the physical layer link status register value of the corresponding physical port index number is modified to perform a port shutdown operation. The traffic mirroring configuration instruction data packet is also parsed, and the access control list rule entries of the switching chip are configured to perform a traffic replication and forwarding operation from the source port index to be mirrored to the observation port index of the mirroring destination. The system receives replicated network communication traffic data forwarded by the security analysis device connected to the mirror destination observation port index, and performs deep packet analysis on the replicated network communication traffic data to extract attack payload signatures.

6. The intelligent detection and defense method for industrial control network attacks according to claim 1, characterized in that, The method further includes: After generating the location coordinates of the attack disturbance source and the vector description of the attack disturbance propagation path, the total topology path deviation parameter in the first deviation distribution description is extracted, and the sequence semantic deviation parameter in the second deviation distribution description is extracted. The total topology path deviation parameter is matched with the preset deviation level judgment threshold set to determine the deviation severity level segment in which the total topology path deviation parameter is located. The sequence semantic deviation parameter is matched with a preset set of semantic deviation grading thresholds to determine the semantic deviation severity level segment in which the sequence semantic deviation parameter is located. Logical disjunction and combination operations are performed on the deviation severity level segment and the semantic deviation severity level segment to generate a threat situation comprehensive evaluation level identifier that represents the current overall attack threat situation. Acquire an attack scenario feature knowledge base pre-installed in an industrial control network intrusion detection system. The attack scenario feature knowledge base stores a set of combined pattern rules of protocol state transition path deviation distribution feature patterns and control command semantic path deviation distribution feature patterns corresponding to historical attack events. The combined features of the abnormal topological node entity set and the abnormal topological directed edge entity set in the first deviation distribution description, and the combined features of the abnormal semantic association edge entity set in the second deviation distribution description, are used for pattern matching and reasoning with the combined pattern rule set in the attack scenario feature knowledge base. If the matching confidence output by the pattern matching inference processing exceeds the preset matching confidence baseline, the corresponding attack type nominal descriptor and attack intent target type descriptor are extracted from the attack scenario feature knowledge base. The threat situation comprehensive evaluation level identifier, the attack type nominal descriptor, and the attack intent target type descriptor are combined to generate an attack behavior semantic interpretation report description structure. This attack behavior semantic interpretation report description structure is then attached to the extended instruction payload field of the coordinated defense instruction set and sent along with the coordinated defense instruction set to the upper-level security operation management console of the industrial control network switching equipment. This allows the upper-level security operation management console to parse the attack behavior semantic interpretation report description structure and render and display a visual situational awareness view containing the threat situation comprehensive evaluation level identifier, attack type nominal descriptor, and attack intent target type descriptor on the human-machine interface.

7. The intelligent detection and defense method for industrial control network attacks according to claim 1, characterized in that, The method further includes: After sending the set of coordinated defense instructions to the industrial control network switching device to trigger the port shutdown operation, the system receives the port shutdown operation execution status receipt message from the industrial control network switching device, parses the message payload field of the port shutdown operation execution status receipt message, and extracts the operation result status code field indicating whether the port shutdown operation was successfully executed. If the operation result status code field indicates that the port shutdown operation failed, the fault cause code value for the port shutdown operation failure is extracted from the extended error cause code field of the port shutdown operation execution status receipt message, and the fault cause code value is mapped to the corresponding physical link fault type descriptor or device configuration conflict type descriptor. Based on the physical link failure type descriptor or the device configuration conflict type descriptor, a backup link blocking remediation strategy instruction is generated for port shutdown operation failure. The backup link blocking remediation strategy instruction includes cascaded port shutdown configuration parameters for the upstream aggregation switching device of the attack disturbance source location coordinates. The backup link blocking remedy policy instruction is sent to the command line management interface process of the upstream aggregation switching device at the location coordinate of the attack disturbance source through the Secure Shell Protocol communication channel. The command line management interface process of the upstream aggregation switching device parses the cascading port shutdown configuration parameters in the backup link blocking remedy policy instruction and executes the port shutdown configuration command on the specified physical port of the upstream aggregation switching device. After receiving a successful confirmation of the cascade port shutdown configuration command from the upstream aggregation and switching device, the link connectivity status data record in the industrial control network topology connection diagram is updated, and the link branches affected by the attack are marked as physically isolated. Based on the physically isolated status markers in the updated industrial control network topology connection diagram, the control command issuance path for the industrial production process is re-routed, generating backup control command issuance path routing table entries that bypass physically isolated link branches, and then sending them to the routing information database of the routing switching equipment in the industrial control network.

8. The intelligent detection and defense method for industrial control network attacks according to claim 5, characterized in that, The method further includes: The replicated network communication traffic data forwarded by the security analysis device connected to the mirror destination observation port index is obtained as an attack traffic sample data set. Each attack traffic data packet in the attack traffic sample data set is subjected to deep parsing of the transport layer payload to extract the content of the industrial communication protocol application data unit field in the transport layer payload. The content of the application data unit field of the industrial communication protocol is processed by variable-length byte sequence sliding window segmentation to generate a set of overlapping byte sequence segments with fixed window length and fixed sliding step size. The information entropy value of each overlapping byte sequence segment in the set of overlapping byte sequence segments is calculated, and overlapping byte sequence segments with information entropy values ​​exceeding a preset information entropy threshold are marked as high random load segments. The offset position and segment length of the high random payload fragment in the field content of the industrial communication protocol application data unit are used as feature extraction boundary parameters. The attack feature code candidate string sequence is extracted from the field content of the industrial communication protocol application data unit. The attack feature code candidate string sequence is matched with the known attack feature library pre-installed in the industrial control network intrusion detection system. Redundant attack feature code candidate string sequences with similarity to existing feature entries in the known attack feature library exceeding the preset similarity tolerance are eliminated. The candidate string sequence of attack signature codes after removing redundancy is processed by regular expression syntax transformation to generate attack signature code regular expression rule entries that describe the structural pattern of the candidate string sequence of attack signature codes. The attack signature code regular expression rule entries are written into the rule base file of the industrial control network intrusion detection system, and the rule base file is loaded into the feature matching engine memory structure of the industrial control network intrusion detection system. After the feature matching engine memory structure of the industrial control network intrusion detection system completes the rule base file reload operation, the attack feature code regular expression rule entries are applied to the real-time deep packet inspection and filtering process of the subsequently received industrial control network communication data stream. When a data frame unit that matches the attack signature regular expression rule entry is found in the real-time deep packet inspection and filtering process, a discard operation is immediately triggered for the data frame unit and an alarm log record containing the matching rule number and the matching timestamp is generated.

9. An intelligent detection and defense system for industrial control network attacks, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the intelligent detection and defense method against industrial control network attacks as described in any one of claims 1 to 8 by executing the machine-executable instructions.

Images