An adaptive synchronous digital twin simulation system for SD-TSN information security analysis

Abstract

The application discloses a kind of adaptive synchronous digital twin simulation systems for SD-TSN information security analysis belongs to industrial control safety and digital twin field, this system includes physical entity layer, digital twin layer, synchronization management layer and application layer, digital twin layer is used for state mapping, behavior simulation and information security analysis, synchronization management layer as the core innovation point of the application, connect physical entity layer and digital twin layer, by real-time environmental state index dynamically selects and switches synchronization mode, application layer is based on the digital twin model after synchronization carries out end-to-end delay analysis, attack simulation and security policy verification, and analysis result is fed back to synchronization management layer and forms closed-loop optimization.The application introduces adaptive synchronous digital twin architecture, effectively solves the problem that synchronization mode is fixed in traditional simulation system, cannot adapt to dynamic network environment, can significantly improve the research efficiency and accuracy of SD-TSN data flow security resource scheduling and security algorithm real-time analysis.

Description

Technical Field

[0001] This invention belongs to the field of industrial control security and digital twins, and more specifically, relates to an adaptive synchronous digital twin simulation system for SD-TSN information security analysis. Background Technology

[0002] With the rapid development of the Industrial Internet, traditional closed industrial control systems are gradually evolving towards openness and networking, which exposes them to unprecedented cybersecurity threats. Cyberattacks can paralyze industrial control systems. Therefore, researching and implementing effective information security strategies to defend against cyberattacks and reduce potential losses has become a critical task in the field of industrial control systems.

[0003] The emergence of Time-Sensitive Networking (TSN) technology has brought new opportunities for the modernization of industrial control systems. Through a series of key protocols, such as IEEE 802.1AS (Time Synchronization Protocol) and IEEE 802.1Qbv (Time-Aware Scheduling Protocol), TSN can ensure deterministic latency for different service flows and achieve standardized and open data link layer forwarding functions. These characteristics help break down the barriers of traditional industrial networks and promote the upgrading and integration of industrial control systems.

[0004] In recent years, Software-Defined Networking (SDN) technology has provided new ideas for flexible network management and dynamic configuration. Combining SDN with Time-Sensitive Networking (TSN) forms Software-Defined Time-Sensitive Networking (SD-TSN), which can further enhance the flexibility and manageability of industrial control systems. SD-TSN achieves dynamic scheduling of global resources and precise traffic management through the separation of the control plane and data plane. However, existing research and simulation systems mostly focus on TSN traffic scheduling and data transmission performance, with relatively little research on the scheduling of transmission resources in SD-TSN industrial control systems and the impact of security services on system real-time performance. Existing simulation platforms, such as the NESTING framework in OMNeT++ simulation software, can simulate TSN data flow scheduling, but cannot effectively simulate the execution process of security tasks, making it difficult to meet the information security analysis needs of SD-TSN industrial control systems.

[0005] Meanwhile, digital twin technology, as a cutting-edge technology for merging the physical and digital worlds, has received widespread attention in the industrial sector in recent years. Digital twins, by constructing high-fidelity virtual copies of physical entities, enable real-time state mapping, behavioral simulation, predictive analytics, and closed-loop control, providing a new approach to intelligent management of industrial systems. In the field of industrial control security, digital twin technology can be used to simulate attack scenarios, verify security policies, and analyze the impact of security events on system real-time performance. However, existing digital twin systems have significant shortcomings in the synchronization mechanism between physical entities and virtual models. Most systems adopt fixed synchronization modes (such as periodic synchronization or simple event-triggered synchronization), which cannot adaptively adjust synchronization strategies according to dynamically changing network environments, data fluctuations, and task priorities. This fixed synchronization mode leads to the following problems: 1. Waste of resources: When network bandwidth is sufficient but data changes slowly, periodic synchronization will transmit a large amount of redundant data, resulting in a waste of bandwidth and computing resources; 2. Response delay: During network congestion or sudden traffic surges, fixed-period synchronization cannot reflect rapid changes in physical entities in a timely manner, causing the digital twin model to lag and affecting the accuracy of information security analysis; 3. Lack of intelligence: Existing systems cannot dynamically adjust the synchronization frequency and accuracy based on factors such as task urgency and model prediction uncertainty, making it difficult to meet the needs of complex and ever-changing application scenarios. Summary of the Invention

[0006] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides an adaptive synchronous digital twin simulation system for SD-TSN information security analysis. By introducing digital twin technology and an intelligent synchronization mechanism, it achieves efficient and adaptive synchronization between physical entities and virtual models, thereby improving the accuracy of information security analysis and resource utilization efficiency.

[0007] To achieve the above objectives, according to a first aspect of the present invention, an adaptive synchronous digital twin simulation system for SD-TSN information security analysis is provided, comprising: The physical entity layer includes the physical devices of the SD-TSN industrial control system; The physical devices include an SDN controller, a TSN switch, a traffic analyzer, and a terminal, and each physical device is equipped with a data acquisition unit. The digital twin layer includes a virtual model library, a data fusion unit, and a simulation engine; The virtual model library includes virtual models corresponding to each physical device; the data fusion unit is used to receive synchronization data from the synchronization management layer and fuse it with historical data to update the state of the virtual model; the simulation engine is used to predict the behavior and network state of each physical device based on the updated virtual model and calculate the prediction uncertainty, and feed the prediction uncertainty back to the environment perception module of the synchronization management layer. The synchronization management layer includes an environment perception module, a synchronization pattern library, a decision engine, and a synchronization execution module. The environmental perception module is used to send real-time acquired environmental status indicators to the decision engine; the environmental status indicators include bandwidth utilization, data change rate of the physical entity layer, task priority, current synchronization quality, and prediction uncertainty. The decision engine is used to select the optimal synchronization mode from the synchronization mode library based on the environmental status indicators and through preset rules, form a synchronization instruction, and send it to the synchronization execution module. The synchronization execution module is used to configure the data transmission mechanism between the physical entity layer and the digital twin layer according to the synchronization instruction, perform synchronization operations, calculate the current synchronization quality based on the result of the synchronization operation, and feed it back to the environment perception module; wherein, the synchronization quality is represented by the age of the digital twin. The application layer is used for information security analysis and security policy verification based on the synchronized virtual model.

[0008] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: This invention provides an adaptive synchronous digital twin simulation system for SD-TSN information security analysis, used to study the scheduling of security resources and the impact of security services on the real-time performance of SD-TSN industrial control systems. This system has significant theoretical and practical implications. The simulation system needs to be able to simulate global clock synchronization, traffic priority scheduling, and data flow security service processes in SD-TSN industrial control systems, and perform detailed analysis of the simulation results, providing strong support for the formulation of information security strategies for industrial control systems. Specifically, this system has the following advantages: (1) By introducing digital twin and intelligent synchronization technologies, a high-fidelity virtual mapping environment is constructed. Through environmental perception and multi-mode adaptive switching, a dynamic balance between synchronization accuracy and resource consumption is achieved, which can effectively solve the problems of resource waste and response delay in the traditional fixed synchronization mode.

[0009] (2) Integrating cutting-edge AI technologies such as reinforcement learning, semantic compression and uncertainty perception, the system achieves online optimization of synchronization strategies, efficient transmission under bandwidth-constrained environments and adaptive calibration of models, significantly improving the robustness and accuracy of the analysis.

[0010] (3) The system supports edge-cloud layered collaborative architecture and closed-loop optimization mechanism to achieve collaborative work of local real-time response and global analysis, and continuously optimizes synchronization strategy based on historical operation data, which is suitable for large-scale industrial deployment scenarios.

[0011] In summary, the system provided by this invention can accurately simulate the comprehensive scheduling process of security resources and transmission resources in industrial control systems. Through an intelligent synchronization mechanism, it significantly improves simulation efficiency and analysis accuracy, providing powerful tool support for the formulation of information security strategies. Attached Figure Description

[0012] Figure 1 This is one of the overall layered architecture diagrams of the adaptive synchronous digital twin simulation system for SD-TSN information security analysis provided in this embodiment of the invention; Figure 2 This is the second of the overall layered architecture diagrams of the adaptive synchronous digital twin simulation system for SD-TSN information security analysis provided in this embodiment of the invention; Figure 3 This is a flowchart of the mode selection process for the synchronous management layer decision engine provided in this embodiment of the invention. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0014] This invention provides an adaptive synchronous digital twin simulation system for SD-TSN information security analysis, such as... Figures 1-2 As shown, a layered architecture is adopted, including a physical entity layer, a digital twin layer, a synchronization management layer, and an application layer. Each layer is described below.

[0015] (1) Physical entity layer, including the physical devices of the SD-TSN industrial control system; The physical devices include an SDN controller, a TSN switch, a traffic analyzer, and a terminal. This layer is equipped with sensors and a data acquisition unit. The sensors are used to collect the operating status of the physical devices in real time for communication and normal operation between physical entities.

[0016] The construction process of the physical entity layer includes: (1.1) The control plane and data plane of the SD-TSN industrial control system are divided. The control plane is responsible for global decision-making and dynamic scheduling to ensure deterministic transmission of time-sensitive streams, while the data plane is responsible for efficiently executing control plane instructions to ensure accurate forwarding and time determinism of data frames.

[0017] (1.2) The equipment of the SD-TSN industrial control system is divided into two parts: the SDN controller and the flow analyzer are located in the control plane, and the TSN switch and the terminal are located in the data plane.

[0018] (1.3) Configure data acquisition units for each device, wherein: For the terminal: The terminal's data acquisition unit is used to add task priority, synchronization sensitivity label, and timestamp to the new business data stream generated by the terminal's data stream sending module, forming a business data stream to be synchronized, which is then sent to the synchronization execution module through the terminal's data stream sending module; wherein, the synchronization sensitivity label includes the maximum allowed digital twin age.

[0019] Specifically, the terminal has encryption and decryption, digital signature authentication, and data stream transmission and reception functions. Correspondingly, the terminal's built-in functional modules include: a data stream sending module, a data stream receiving module, and a security algorithm execution module; the data acquisition unit configured for the terminal includes a first local clock module and a first processing module. The data stream receiving module is used to receive service data streams from other terminals or switches in the network; The data stream sending module is used to generate new business data streams; The first local clock module is used to add a transmission timestamp to the generated service data stream, and the first processing module is used to add task priority and synchronization sensitivity tags to the generated service data stream. The service data stream information with added task priority, synchronization sensitivity tags and timestamps is uploaded to the synchronization execution module of the synchronization management layer through the data stream sending module; the data stream sending module then sends the timestamped service data stream to the network.

[0020] For TSN switches: The data acquisition unit of the TSN switch is used to add task priority, synchronization sensitivity tag and timestamp to the service data stream forwarded by the data stream sending module of the TSN switch to form a service data stream to be synchronized, and send it to the synchronization execution module through the data stream sending module of the TSN switch.

[0021] Specifically, the TSN switch has traffic filtering and traffic scheduling functions. Accordingly, the functional modules built into the TSN switch include: a data stream sending module, a data stream receiving module, a traffic scheduling module, and a traffic filtering module; the data acquisition unit configured for the TSN switch includes the second local clock module and the second processing module. The data stream receiving module is used to receive service data streams from other terminals or switches in the network; The data stream sending module is used to forward service data streams; The second local clock module is used to add a forwarding timestamp to the forwarded service data stream; The second processing module is used to upload the corresponding business data stream information with added timestamps to the synchronization execution module of the synchronization management layer through the data stream sending module; the data stream sending module is used to add task priority and synchronization sensitivity tags to the business data stream information, and then forward the business data stream with added task priority, synchronization sensitivity tags and timestamps to the network.

[0022] For SDN controllers: The data acquisition unit of the SDN controller is used to add timestamps to the control policies generated by the control message transceiver module of the SDN controller, and then send them to the synchronization management layer through the control message transceiver module.

[0023] Specifically, the SDN controller has the functions of dynamic topology update, global resource scheduling, global clock synchronization and security policy configuration. Accordingly, the functional modules built into the SDN controller include: control message sending and receiving module, topology update module, global resource scheduling module, global clock synchronization module and security policy configuration module; the data acquisition unit configured for the SDN controller includes a third local clock module and a third processing module.

[0024] The control message sending and receiving module is used to send control policies, which include security policies, flow table rules, and gating scheduling lists. The third local clock module is used to add control message timestamps to the issued control strategies; The third processing module is used to upload the timestamped control policy to the synchronization management layer through the control message sending and receiving module, so as to update the control logic state of the SDN controller virtual model through the synchronization management layer.

[0025] For flow analyzers: The data acquisition unit of the traffic analyzer is used to add timestamps to the network bandwidth utilization, end-to-end latency, latency jitter and packet loss rate calculated by the real-time traffic analysis module of the traffic analyzer, and then upload the timestamped bandwidth to the environment perception module through the data transceiver module of the traffic analyzer, and upload the timestamped end-to-end latency, latency jitter and packet loss rate to the application layer.

[0026] Specifically, the traffic analyzer has the function of monitoring indicators such as end-to-end latency, latency jitter, and packet loss rate of network traffic. Correspondingly, the functional modules built into the traffic analyzer include: a data transceiver module and a real-time traffic analysis module. The data acquisition unit configured for the flow analyzer includes a fourth local clock module and a fourth processing module; The data transceiver module is used to receive data frames in the network and timestamp information uploaded by each device. The real-time traffic analysis module is used to calculate bandwidth utilization, end-to-end latency, latency jitter, and packet loss rate based on the received information, i.e., real-time network status indicators. The fourth local clock module is used to add timestamps to real-time network status indicators. The fourth processing module uses the data transceiver module to upload the timestamped bandwidth utilization rate to the environment perception module, and uploads the timestamped end-to-end latency, latency jitter, and packet loss rate to the application layer; the data transceiver module also uploads the original timestamp information uploaded by each device to the synchronization management layer for time synchronization verification by the digital twin layer.

[0027] (2) Digital twin layer, including virtual model library, data fusion unit and simulation engine, used for state mapping, behavior simulation and information security analysis.

[0028] The virtual model library includes virtual models corresponding to each physical device; the data fusion unit is used to receive synchronization data from the synchronization management layer and fuse it with historical data to update the state of the virtual model; the simulation engine is used to predict the behavior and network state of each physical device based on the updated virtual model and calculate the prediction uncertainty, and feed the prediction uncertainty back to the environment perception module of the synchronization management layer.

[0029] Specifically, the process of building a digital twin layer includes: (2.1) Based on the physical entity layer, the device function analysis is carried out, and corresponding virtual models are constructed for the SDN controller, TSN switch, terminal and traffic analyzer respectively. The virtual model library includes at least the logical function modules of the device, the communication protocol stack and the security algorithm library. During the construction of the virtual model, the logical function modules of each device need to expose their adjustable parameter interfaces, including the time complexity factor of the security algorithm, the strictness of the filtering rules and the time window of the gate list, so as to support the digital twin layer to perform "hypothesis analysis" and parameter optimization. That is, the virtual model includes the logical function modules of the device, the communication protocol stack and the security algorithm library, and exposes the adjustable parameter interfaces. (2.2) The function of the data fusion unit is defined as: receiving synchronization data from the synchronization management layer, fusion it with historical data, and updating the state of the virtual model; (2.3) The function of the simulation engine is defined as follows: based on the updated virtual model, run the "hypothesis analysis" scenario, predict the device behavior and network status, and calculate the prediction uncertainty; the prediction uncertainty refers to the credibility of the simulation engine's prediction of the current status (its calculation method includes, but is not limited to: calculating the variance of the prediction error based on the deviation distribution between historical prediction values ​​and actual observation values, or based on the confidence interval width of the model output, or based on the information entropy of the model prediction results); the prediction uncertainty is fed back to the environment perception module of the synchronization management layer for triggering the uncertainty perception synchronization mode.

[0030] The simulation engine runs a "what-if analysis" scenario, including: 1) Simulate the impact of different security algorithms on the real-time performance of data streams; 2) Simulate system behavior under network topology changes or equipment failures; 3) Simulate attack scenarios and evaluate the effectiveness of security strategies; 4) Use the simulation results to optimize the resource allocation and security strategies of the physical entity layer.

[0031] (3) Synchronization management layer, including environment perception module, synchronization mode library, decision engine and synchronization execution module, connects the physical entity layer and digital twin layer, and is responsible for dynamically selecting and switching data synchronization modes.

[0032] The environmental perception module is used to send real-time acquired environmental status indicators to the decision engine. The environmental status indicators include bandwidth utilization, data change rate of the physical entity layer (which can be calculated by the environmental perception module itself), task priority, current synchronization quality, and prediction uncertainty. The synchronization mode library includes the following synchronization modes, suitable for stable states with high bandwidth and low rate of change: Time-driven synchronization mode: with a fixed synchronization period Synchronize all data; Event-triggered synchronization mode: Synchronization is triggered when the rate of change of service data streams or the rate of change of physical device status on the terminal or TSN switch exceeds the corresponding rate of change threshold. Only the changed service data streams or physical device status data are synchronized, which is suitable for detecting sudden traffic and abnormal events. Semantic triggering synchronization mode: Through feature extraction algorithms (such as autoencoders or convolutional neural networks), the business data stream to be synchronized is used to extract key semantic information related to the task, so as to compress the business data stream to be synchronized and synchronize only the key semantic information. This mode is suitable for bandwidth-constrained environments. Uncertainty-aware synchronization mode: Synchronization is triggered when the prediction uncertainty exceeds the uncertainty threshold. All data is synchronized, and the data fusion unit updates the virtual model based on the newly synchronized data to reduce prediction error and achieve model calibration. Reinforcement learning scheduling synchronization mode: A deep reinforcement learning agent is used, which takes environmental state indicators as input and outputs the optimal synchronization mode and synchronization parameters; the reward function is the negative of the sum of weighted resource consumption and synchronization error.

[0033] The operation process of the reinforcement learning scheduling and synchronization mode includes: 1) Constructing the state space ,in For bandwidth utilization, For the rate of change of data, For the current age of digital twins, As a task priority, To predict uncertainty; 2) Constructing the action space ,in For selecting a synchronization mode, the available modes include time-driven synchronization mode, event-triggered synchronization mode, semantic-triggered synchronization mode, and uncertainty-aware synchronization mode. Adjustable parameters for the corresponding synchronization mode (including synchronization period) (e.g., rate of change threshold, compression ratio, uncertainty threshold). 3) Design the reward function ,in, For bandwidth utilization, For energy consumption, For synchronization delay, All are weighting coefficients; 4) Employ deep Q-networks or near-end policy optimization algorithms, pre-trained in a simulation environment or learned online during system operation, to achieve adaptive optimization of the optimal synchronization mode and synchronization parameters.

[0034] The decision engine is used to select the optimal synchronization mode from the synchronization mode library based on the environmental status indicators and through preset rules, form a synchronization instruction, and send it to the synchronization execution module.

[0035] Understandably, the synchronization sensitivity label of a business data stream is used to provide the decision engine of the synchronization management layer with the constraints on the synchronization quality requirements of that business data stream. Based on this label, and combined with real-time environmental awareness information (including network bandwidth, current digital twin age, data change rate, prediction uncertainty, etc.), the decision engine selects the most suitable synchronization mode from the synchronization mode library to ensure that the actual synchronization quality of the data stream meets the constraints defined by the label, while minimizing resource consumption. The synchronization sensitivity label is a metadata field that, in addition to including the maximum allowed digital twin age, may also include at least one of the following: minimum synchronization frequency, synchronization mode preference, or sensitivity level.

[0036] The specific selection mechanism of the decision engine is as follows: First, the synchronization sensitivity labels of each data stream are parsed to extract the synchronization quality constraints (such as the maximum allowed digital twin age), and the minimum performance requirements that the synchronization mode must meet are determined accordingly; then, combined with the current environmental perception information (bandwidth, data change rate, prediction uncertainty, etc.), the synchronization mode with the lowest resource consumption is selected first, provided that the constraints are met; if the environmental complexity exceeds the environmental complexity threshold, the reinforcement learning scheduling synchronization mode is directly selected for dynamic optimization.

[0037] As an example, the preset rule is: The weighted sum of the normalized variance of bandwidth utilization, data change rate, and prediction uncertainty is calculated and used as the environmental complexity C. If it exceeds the environmental complexity threshold C_complex, a reinforcement learning synchronization mode is adopted; otherwise, it is determined whether the digital twin age of any business data stream to be synchronized has exceeded its maximum allowable digital twin age. If so, a time-driven synchronization mode is adopted when the bandwidth utilization is lower than the utilization threshold, and a semantic triggering synchronization mode is adopted when the bandwidth utilization is higher than the utilization threshold. Otherwise, a time-driven synchronization mode is adopted when the data change rate at the physical entity layer is lower than the change rate threshold and the bandwidth utilization is lower than the utilization threshold, an event-triggered synchronization mode is adopted when the data change rate at the physical entity layer is higher than the change rate threshold, a semantic triggering synchronization mode is adopted when the bandwidth utilization is higher than the utilization threshold, and an uncertainty-aware synchronization mode is adopted when the prediction uncertainty is higher than the uncertainty threshold.

[0038] It is worth noting that if there are multiple business data streams and their synchronization sensitivity label constraints conflict with each other, such as when the prediction uncertainty is higher than the uncertainty threshold but the bandwidth utilization does not support the synchronization of the full data, or when the synchronization mode preference in the synchronization sensitivity label is set to "reinforcement learning priority", then the reinforcement learning scheduling synchronization mode is adopted, and the deep reinforcement learning agent outputs the synchronization strategy.

[0039] The synchronization execution module is used to configure the data transmission mechanism between the physical entity layer and the digital twin layer according to the synchronization instruction, perform synchronization operation, calculate the current synchronization quality according to the result of the synchronization operation, and feed it back to the environment perception module; wherein, the synchronization quality is represented by the age of the digital twin.

[0040] Specifically, the synchronization execution module calculates the synchronization quality (i.e., digital twin age) based on the results of the synchronization operation, which is the time elapsed since the last successful synchronization. This indicator serves as an important input to the synchronization management layer's environment awareness module.

[0041] Understandably, the data generated by the traffic analyzer and the SDN controller also needs to be synchronized. For control information such as security policies and instructions generated by the SDN controller and network analysis results generated by the traffic analyzer, a simplified method without adding synchronization sensitivity tags is used for synchronization. Specifically, after the synchronization management layer receives the control information such as security policies and instructions generated by the SDN controller and the network analysis results generated by the traffic analyzer, the synchronization requirements of these data are handled independently by the synchronization management layer according to the message type and preset priority: high-priority control information (such as emergency security policy updates) is synchronized immediately using an event-triggered synchronization mode; regular control information is synchronized periodically using a time-driven synchronization mode; and the synchronization of network analysis results, as derived data, depends on the synchronization status of the original timestamp data and is automatically triggered by the data fusion unit when updating the virtual model.

[0042] (4) Application layer, used for information security analysis and security policy verification based on the synchronized virtual model.

[0043] The workflow of the application layer is as follows: (4.1) Obtain the end-to-end delay, delay jitter and packet loss rate analysis results uploaded by the data acquisition unit of the flow analyzer, as well as the state of the twin model after synchronization of the digital twin layer; (4.2) Using the "hypothesis analysis" function of the digital twin layer simulation engine, simulate the state of the twin model under different synchronization modes, compare the impact of different synchronization modes on the accuracy of information security analysis, and realize information security analysis; (4.3) Using the "hypothesis analysis" function of the digital twin layer simulation engine, attack simulation scenarios (including denial-of-service attacks, data tampering, and replay attacks) are run based on the digital twin model to verify the effectiveness of the security policies issued by the SDN controller. The verification results are then fed back to the SDN controller so that the SDN controller can dynamically adjust the security policies and realize security policy verification.

[0044] The comparison results and environmental complexity C can be further fed back to the decision engine of the synchronization management layer to optimize the selection of synchronization mode and parameter configuration.

[0045] Preferably, when the decision engine selects an event-triggered synchronization mode or a semantic-triggered synchronization mode, the digital twin is performed at the edge; otherwise, the digital twin is performed in the cloud.

[0046] Specifically, the digital twin system supports a layered synchronization architecture: a lightweight digital twin is deployed at the edge, using event-triggered or semantic-triggered modes to achieve local real-time response; a high-fidelity digital twin is deployed in the cloud, using time-driven or reinforcement learning scheduling modes for global analysis and long-term optimization; through the coordination mechanism of the synchronization management layer, the edge periodically uploads state summaries to the cloud, and the cloud sends model update parameters to the edge to maintain global consistency.

[0047] The following example further illustrates the construction and workflow of the adaptive synchronous digital twin simulation system for SD-TSN information security analysis provided in this embodiment of the invention.

[0048] Step 1: Determine the network topology. For example, the network topology may include one SDN controller, two TSN switches supporting gating scheduling and frame preemption, and four terminal nodes capable of data stream generation, encryption signing, and reception. Connect the devices using a logical network topology diagram, linking the ingress and egress queues between devices.

[0049] Step 2: Complete the configuration of the data acquisition units of each physical device in the physical entity layer.

[0050] Step 3: Construct the Digital Twin Layer. Based on the device configuration of the physical entity layer, construct corresponding virtual models for the SDN controller, TSN switch, terminal, and traffic analyzer. Each virtual model includes at least the device's logical function modules, communication protocol stack, and security algorithm library, and exposes adjustable parameter interfaces to support subsequent "what-if analysis" and parameter optimization. The simulation engine is used to run "what-if analysis" scenarios based on the updated virtual models, predict device behavior and network status, calculate prediction uncertainties, and feed the prediction results and uncertainties back to the environment awareness module of the synchronization management layer.

[0051] Step 4: Configure the synchronization management layer. For example... Figure 1 As shown, the following modules are deployed in the synchronization manager: Environment Awareness Module: Acquires environmental monitoring parameters such as network bandwidth and data change rate. These parameters are provided in real-time by the data acquisition unit of the physical entity layer and are used to evaluate the current network status and synchronization quality; Synchronization Mode Library: Predefines five synchronization modes (time-driven, event-triggered, semantic-triggered, uncertainty-aware, and reinforcement learning scheduling) and sets initial parameters for each mode; Decision Engine: Initializes preset rules; Synchronization Execution Module: Configures the data transmission mechanism, establishes connections with the physical entity layer and the digital twin layer, and feeds back the synchronization effect to the decision engine and the environment awareness module.

[0052] Step 5: Configure the SDN controller. Specify the global master clock source and set the clock synchronization period through the controller; issue a gating schedule list according to the IEEE 802.1Qbv standard; at the same time, configure corresponding security processing tasks for each terminal node according to the preset policy, for example: specify that a certain terminal needs to perform AES algorithm encryption and RSA algorithm digital signature.

[0053] Step 6: Configure Terminal Nodes. Each terminal generates periodic or bursty data streams according to the experimental parameters, and appends a source ID, destination ID, timestamp, security algorithm identifier, and synchronization sensitivity tag to the data frame header. This tag is a metadata field that contains at least one or a combination of the following information: maximum allowed digital twin age, minimum synchronization frequency, synchronization mode preference, or sensitivity level. It is used to provide the synchronization management layer's decision engine with the data stream's required synchronization quality constraints. This tag is reported to the synchronization management layer along with the business data stream. The decision engine parses the constraints in the tag and selects a synchronization mode based on real-time environmental awareness information. The security service module performs corresponding encryption, signing, and other processing on the data frames according to the controller policy and records the timestamps before and after processing.

[0054] Step 7: Configure TSN switches. Each switch receives the flow table and gating schedule list issued by the controller and enables frame preemption mechanism (compliant with 802.1Qbu and 802.3br standards); at the same time, configure whitelist-based traffic filtering rules, such as: rejecting unsigned data frames or traffic from illegal IP ranges.

[0055] Next, data stream transmission and security services will be implemented. The execution process is as follows: Step 8: Environmental Awareness and Synchronization Mode Selection. The environmental awareness module obtains real-time network bandwidth, task priority, and current digital twin age (AoDT) from the data acquisition unit at the physical entity layer. The decision engine first parses the synchronization sensitivity tags carried by each data stream, extracting synchronization quality constraints, such as the maximum allowable digital twin age (AoDT_max); then, combined with the current environmental awareness information, it determines whether the current actual AoDT is close to or exceeds AoDT_max, as well as the status of bandwidth, rate of change, prediction uncertainty, etc.

[0056] like Figure 3 As shown, the decision engine selects the mode according to the following process: Calculate the environment complexity C (the weighted sum of the normalized variances of bandwidth utilization, data change rate, and prediction uncertainty). If C is greater than C_complex, then select the reinforcement learning synchronous mode. Otherwise, if the actual AoDT of any data stream exceeds its maximum allowed value AoDT_max, then the time-driven synchronization mode (if bandwidth is sufficient) or the semantic-triggered synchronization mode (if bandwidth is limited) is forcibly triggered to immediately synchronize the full or critical states to meet the timeliness constraints. Otherwise, select according to the rules based on the environmental conditions: If bandwidth is sufficient and data changes are gradual (data change rate is below the low threshold R_low, and bandwidth utilization is below B_low), select time-driven synchronization mode to synchronize all data at a fixed period T.

[0057] If a sudden surge in traffic or an abnormal event (data change rate exceeding the high threshold R_high within a short period of time) is detected, select the event-triggered synchronization mode. When the amount of data change exceeds the preset threshold Δ, synchronization is triggered, and only the changed data portion is synchronized.

[0058] If bandwidth is limited (bandwidth utilization exceeds B_high), select semantic trigger synchronization mode, compress the original data through autoencoder or convolutional neural network, and transmit only the key semantic information related to the task.

[0059] If the uncertainty of the digital twin model prediction exceeds the threshold U_high, the uncertainty-aware synchronization mode is selected. The synchronization execution module transmits the latest full state data of the physical entity layer to the digital twin layer, and the data fusion unit updates the virtual model to reduce the prediction error.

[0060] All selection results must be recorded and fed back to the decision engine for subsequent online learning and optimization of rules or models.

[0061] Step 9: Data Stream Generation and Transmission. Each terminal generates a data stream according to the defined transmission period, sends it to an independent transmission queue, and records the timestamp and current AoDT value when the data frame is transmitted.

[0062] Step 10: Data flow transmission in the network. The TSN switch schedules data frames into and out of the queues based on the scheduling window and flow priority. When a high-priority frame needs to be transmitted, the system temporarily stores the low-priority frame and inserts the high-priority frame first. The enqueue and dequeue times of each forward are recorded to support subsequent latency statistical analysis.

[0063] Step 11: Execute security services. The receiving terminal performs security operations such as decryption and signature verification on the received data according to the policy issued by the controller. To simulate the processing latency of security tasks, the simulation system introduces an adjustable processing latency based on the preset algorithm complexity and frame size. After processing, the data frame is sent to the receive buffer queue.

[0064] When the SDN controller discovers a new device (terminal and / or TSN switch) through LLDP messages, the SDN controller and the TSN switch, as well as the TSN switch and the terminal, are connected through virtual links.

[0065] To achieve closed-loop control and scheduling optimization, the system further includes the following processes: Step 12: Business Data Analysis and Information Security Verification. The traffic analyzer at the physical entity layer collects timestamps uploaded by all receiving devices, calculates key performance indicators for each data stream, including end-to-end latency, latency jitter, and packet loss rate, and uploads the analysis results to the application layer. The application layer receives the end-to-end latency, latency jitter, and packet loss rate analysis results uploaded by the traffic analyzer at the physical entity layer, and receives the state of the twin model after synchronization with the digital twin layer. Using the "hypothesis analysis" function of the digital twin layer simulation engine, it simulates the state of the twin model under different synchronization modes, compares the impact of different synchronization modes on the accuracy of information security analysis, and feeds the comparison results back to the decision engine of the synchronization management layer for optimizing the selection of synchronization modes and parameter configuration. Simultaneously, the application layer runs attack simulation scenarios based on the digital twin model, including denial-of-service attacks, data tampering, and replay attacks, to verify the effectiveness of the security policies issued by the SDN controller, and feeds the verification results back to the SDN controller for dynamic adjustment of security policies.

[0066] Step 13: Synchronization Effect Feedback and Closed-Loop Optimization. The synchronization execution module of the synchronization management layer feeds back the synchronization effect metrics (including digital twin age, synchronization latency, and bandwidth consumption) to the decision engine and environment perception module; the data fusion unit of the digital twin layer feeds back the synchronization error to the decision engine. The decision engine integrates the above feedback and combines it with the real-time network status metrics (end-to-end latency, latency jitter, and packet loss rate) provided by the traffic analyzer to optimize the selection of subsequent synchronization modes and parameter configurations, and then distributes the optimized synchronization strategy to the synchronization execution module.

[0067] Step 14: Support a layered synchronization architecture. In large-scale deployment scenarios, lightweight digital twins can be deployed at the edge, using event-triggered or semantic-triggered modes to achieve local real-time response; high-fidelity digital twins can be deployed in the cloud, using time-driven or reinforcement learning scheduling modes for global analysis and long-term optimization. Through the coordination mechanism of the synchronization management layer, the edge periodically uploads state summaries to the cloud, and the cloud distributes model update parameters to the edge, maintaining global consistency.

[0068] This simulation system allows users to flexibly simulate the impact of different network states and security policies on the real-time performance of industrial control systems. It supports performance comparison and analysis under various scheduling mechanisms and provides technical support for the collaborative optimization of security services and scheduling resources. Compared to existing simulation systems, this invention adds an adaptive synchronous digital twin architecture. It achieves dynamic switching of synchronization modes through an intelligent synchronization management layer, introduces digital twin age (AoDT) as a quantitative indicator of synchronization quality, and integrates cutting-edge AI technologies such as reinforcement learning, semantic compression, and uncertainty perception, enabling higher-precision assessment of industrial network security and real-time performance.

[0069] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An adaptive synchronous digital twin simulation system for SD-TSN information security analysis, characterized in that, include: The physical entity layer includes the physical devices of the SD-TSN industrial control system; The physical devices include an SDN controller, a TSN switch, a traffic analyzer, and a terminal, and each physical device is equipped with a data acquisition unit. The digital twin layer includes a virtual model library, a data fusion unit, and a simulation engine; The virtual model library includes virtual models corresponding to each physical device; the data fusion unit is used to receive synchronization data from the synchronization management layer and fuse it with historical data to update the state of the virtual model; the simulation engine is used to predict the behavior and network state of each physical device based on the updated virtual model and calculate the prediction uncertainty, and feed the prediction uncertainty back to the environment perception module of the synchronization management layer. The synchronization management layer includes an environment perception module, a synchronization pattern library, a decision engine, and a synchronization execution module. The environmental perception module is used to send real-time acquired environmental status indicators to the decision engine; the environmental status indicators include bandwidth utilization, data change rate of the physical entity layer, task priority, current synchronization quality, and prediction uncertainty. The decision engine is used to select the optimal synchronization mode from the synchronization mode library based on the environmental status indicators and through preset rules, form a synchronization instruction, and send it to the synchronization execution module. The synchronization execution module is used to configure the data transmission mechanism between the physical entity layer and the digital twin layer according to the synchronization instruction, perform synchronization operations, calculate the current synchronization quality based on the result of the synchronization operation, and feed it back to the environment perception module; wherein, the synchronization quality is represented by the age of the digital twin. The application layer is used for information security analysis and security policy verification based on the synchronized virtual model.

2. The system as described in claim 1, characterized in that, The terminal's data acquisition unit is used to add task priority, synchronization sensitivity tag, and timestamp to the new business data stream generated by the terminal's data stream sending module, forming a business data stream to be synchronized, which is then sent to the synchronization execution module through the terminal's data stream sending module; wherein, the synchronization sensitivity tag includes the maximum allowed digital twin age; The data acquisition unit of the TSN switch is used to add task priority, synchronization sensitivity tag and timestamp to the service data stream forwarded by the data stream sending module of the TSN switch to form a service data stream to be synchronized, and send it to the synchronization execution module through the data stream sending module of the TSN switch. The data acquisition unit of the SDN controller is used to add a timestamp to the control policy generated by the control message transceiver module of the SDN controller, and then send it to the synchronization management layer through the control message transceiver module. The data acquisition unit of the traffic analyzer is used to add timestamps to the network bandwidth utilization, end-to-end latency, latency jitter and packet loss rate calculated by the real-time traffic analysis module of the traffic analyzer. Then, the timestamped bandwidth utilization is uploaded to the environment perception module through the data transceiver module of the traffic analyzer, and the timestamped end-to-end latency, latency jitter and packet loss rate are uploaded to the application layer.

3. The system as described in claim 2, characterized in that, The synchronization mode library includes the following synchronization modes: Time-driven synchronization mode: Synchronizes all data at a fixed synchronization period; Event-triggered synchronization mode: Synchronization is triggered when the rate of change of service data stream of terminal or TSN switch, or the rate of change of physical device status exceeds the corresponding rate of change threshold. Only the changed service data stream or physical device status data is synchronized. Semantic trigger synchronization mode: Feature extraction is performed on the business data stream to be synchronized to obtain key semantic information related to the task, and only the key semantic information is synchronized; Uncertainty-aware synchronization mode: Synchronization is triggered when the prediction uncertainty exceeds the uncertainty threshold, synchronizing all data. Reinforcement learning scheduling synchronization mode: A deep reinforcement learning agent is used, which takes environmental state indicators as input and outputs the optimal synchronization mode and synchronization parameters; the reward function is the negative of the sum of weighted resource consumption and synchronization error.

4. The system as described in claim 3, characterized in that, The preset rule is as follows: The weighted sum of bandwidth utilization, data change rate, and the normalized variance of prediction uncertainty is calculated and used as the environmental complexity. If it exceeds the environmental complexity threshold, a reinforcement learning synchronization mode is adopted; otherwise, it is determined whether the digital twin age of any business data stream to be synchronized has exceeded its maximum allowable digital twin age. If so, a time-driven synchronization mode is adopted when the bandwidth utilization is lower than the utilization threshold, and a semantic triggering synchronization mode is adopted when the bandwidth utilization is higher than the utilization threshold. Otherwise, a time-driven synchronization mode is adopted when the data change rate at the physical entity layer is lower than the change rate threshold and the bandwidth utilization is lower than the utilization threshold, an event-triggered synchronization mode is adopted when the data change rate at the physical entity layer is higher than the change rate threshold, a semantic triggering synchronization mode is adopted when the bandwidth utilization is higher than the utilization threshold, and an uncertainty-aware synchronization mode is adopted when the prediction uncertainty is higher than the uncertainty threshold.

5. The system as described in claim 3, characterized in that, The operation process of the reinforcement learning scheduling and synchronization mode includes: Constructing the state space ,in For bandwidth utilization, For the rate of change of data, For the current age of digital twins, As a task priority, To predict uncertainty; Constructing Action Space ,in For selecting a synchronization mode, the available modes include time-driven synchronization mode, event-triggered synchronization mode, semantic-triggered synchronization mode, and uncertainty-aware synchronization mode. These are adjustable parameters corresponding to the synchronization mode; Design reward function ,in, For bandwidth utilization, For energy consumption, For synchronization delay, All are weighting coefficients; By employing deep Q-networks or proximal policy optimization algorithms, pre-training in a simulation environment or online learning during system operation, adaptive optimization of the optimal synchronization mode and synchronization parameters can be achieved.

6. The system as described in claim 2, characterized in that, The workflow of the application layer is as follows: Acquire the end-to-end latency, latency jitter, and packet loss rate analysis results uploaded by the data acquisition unit of the traffic analyzer, as well as the state of the twin model after synchronization of the digital twin layer; Simulate the twin model states under different synchronization modes, compare the impact of different synchronization modes on the accuracy of information security analysis, and realize information security analysis; By running attack simulation scenarios based on the digital twin model, the effectiveness of the security policies issued by the SDN controller is verified, and the verification results are fed back to the SDN controller so that the SDN controller can dynamically adjust the security policies and realize security policy verification.

7. The system as described in claim 2, characterized in that, When using event-triggered or semantic-triggered synchronization mode, digital twins are created at the edge; otherwise, they are created in the cloud.

Images