Nuclear Power Plant Deep Learning-Based Intelligent Network Packet Anomaly Detection System

Abstract

The nuclear power plant network packet anomaly detection system of the present invention comprises a learning preprocessing module that converts learning PCAP data obtained from a network of a nuclear power plant into learning data in JSON format, a labeling module that labels the learning data output from the preprocessing module as normal or abnormal, a learning module that generates a learning model based on the learning data labeled by the labeling module, an anomaly detection module having a classification model generated based on the learning model, and a classification preprocessing module that converts a target packet obtained from the network into target data in JSON format, wherein the anomaly detection module outputs whether the network is abnormal by using the target data received from the classification preprocessing module as input to the classification model.

Description

Technology Field

[0001] The present invention relates to a technology for determining whether network packets collected from a nuclear power plant are abnormal based on deep learning, and in particular, to a deep learning-based abnormal packet detection model. Background Technology

[0002] Cyber ​​threats targeting major infrastructure, including domestic and international nuclear power plants, are continuously increasing. Cyberattacks against Industrial Control Systems (ICS) are evolving into highly sophisticated and intelligent threats, often prepared over several years and continuously attempted. While operational and administrative security measures are applied to nuclear power plant cybersecurity, the application of technical security measures is very limited, making it difficult to detect and respond to intelligent cyberattacks.

[0003] Existing anomaly detection systems rely on rule-based systems like Snort or traffic statistics-based anomaly detection techniques. Since these methods operate based on predefined attack patterns or signatures, they can be effective against known attack types but have several limitations. Rule-based systems can only detect attacks that exactly match existing defined patterns, so they often fail to detect slightly modified attack techniques or attack patterns not found in existing signature databases. In particular, there is a limitation in that existing systems struggle to effectively detect attacks when sophisticated attackers use techniques designed to intentionally evade the rules of existing detection systems. Furthermore, the utility of existing signature-based detection methods is significantly reduced in the case of encrypted traffic because packet contents cannot be directly inspected.

[0004] Furthermore, existing protocol-based analysis methods require specialized personnel and significant time because they necessitate the direct analysis of protocols. Different analysis rules must be developed for each of the various protocols used in industrial control systems, and there is the additional burden of updating these rules whenever a protocol is updated or changed. Particularly in critical infrastructure such as nuclear power plants, where proprietary protocols or legacy systems are frequently used, securing and retaining experts for protocol analysis in such environments is an even more challenging task. The problem to be solved

[0005] The problem that the present invention aims to solve is, first, to provide a deep learning-based network packet anomaly detection system that takes into account the unique characteristics and operating environment of a nuclear power plant control network.

[0006] Second, the goal is to provide a network packet anomaly detection system that can more flexibly identify various network anomalies by overcoming the limitations of existing rule-based systems, and in particular, to provide a network packet anomaly detection system capable of detecting abnormal patterns that are not fully defined in advance, such as abnormal network activities that deviate from learned patterns or variants of existing attacks.

[0007] In addition, the problem that the present invention aims to solve is to provide a network packet anomaly detection system equipped with a deep learning model that can effectively detect anomalies without a complex manual feature extraction process by processing PCAP (Packet Capture) files through an automated preprocessing system and converting them into JSON format for use in training.

[0008] Furthermore, the problem that the present invention aims to solve is to provide a network packet anomaly detection system that simplifies the analysis process by automatically extracting and learning features from packet data in order to minimize the time and manpower consumption required for protocol analysis. means of solving the problem

[0009] The nuclear power plant network packet anomaly detection system of the present invention comprises a learning preprocessing module that converts learning PCAP data obtained from a network of a nuclear power plant into learning data in JSON format, a labeling module that labels the learning data output from the preprocessing module as normal or abnormal, a learning module that generates a learning model based on the learning data labeled by the labeling module, an anomaly detection module having a classification model generated based on the learning model, and a classification preprocessing module that converts a target packet obtained from the network into target data in JSON format, wherein the anomaly detection module outputs whether the network is abnormal by using the target data received from the classification preprocessing module as input to the classification model.

[0010] The above target packet may be obtained in real time from the above network.

[0011] The above system may further include a PCAP capturer that captures the target packet from the traffic of the network and generates target PCAP data, a data storage unit that stores the target PCAP data, and an input module that receives an anomaly detection command.

[0012] The above classification preprocessing module can convert the target PCAP data into JSON format data when the anomaly detection command is input through the above input module.

[0013] The above classification model may be a Convolutional Neural Network (CNN), a Recurrent Neural Network (RNN), a Long Short-Term Memory (LSTM), a Gated Recurrent Unit (GRU), a Transformer, an Autoencoder, or a combination of two or more of these.

[0014] The above learning model may include multiple learning models that have learned different characteristics from the above learning PCAP data, and the anomaly detection module may generate multiple classification models based on the above multiple learning models and ensemble the classification results of the above multiple classification models to output whether there is an anomaly in the network. Effects of the invention

[0015] The nuclear power plant network packet anomaly detection system of the present invention has the effect of simplifying the system implementation, operation, and model training processes by automatically preprocessing PCAP files and converting them into JSON format.

[0016] In addition, by applying a deep learning-based approach, the ability to detect variant attacks or unknown abnormal patterns that are difficult to detect with conventional rule-based systems is improved.

[0017] In addition, it is effective in preventing unnecessary emergency responses in nuclear power plant environments by minimizing false positive rates, and it is effective in improving detection performance in the long term by adapting to new attack patterns through continuous learning.

[0018] Furthermore, it is effective in detecting anomalies by analyzing header and sequence patterns even when the packet payload is encrypted, and it is effective in minimizing damage caused by cyber attacks by classifying the type of anomaly and suggesting countermeasures along with providing immediate notifications upon detection. Brief explanation of the drawing

[0019] FIG. 1 is a block diagram illustrating a nuclear power plant network to which a nuclear power plant network packet anomaly detection system according to one embodiment of the present invention is applied. FIG. 2 is a block diagram illustrating a model training engine of a nuclear power plant network packet anomaly detection system according to one embodiment of the present invention. FIG. 3 is a block diagram illustrating a Model Classification Engine of a nuclear power plant network packet anomaly detection system according to one embodiment of the present invention. FIG. 4 is a flowchart showing a method for detecting network packet anomalies in a nuclear power plant according to an embodiment of the present invention. FIG. 5 is a flowchart showing a method for detecting network packet anomalies in a nuclear power plant according to another embodiment of the present invention. Specific details for implementing the invention

[0020] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but may be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims. Throughout the specification, the same reference numerals refer to the same components.

[0021] FIG. 1 is a block diagram illustrating a nuclear power plant network to which a nuclear power plant network packet anomaly detection system according to one embodiment of the present invention is applied.

[0022] Referring to Fig. 1, the network of a nuclear power plant can be defined as a closed communication infrastructure designed to support the operation or control of reactor and turbine power generation facilities, radiation monitoring, facility status monitoring, alarm systems, and operation management, and has a structure in which safety systems and non-safety systems are separated.

[0023] The Safety-Critical Network can be connected to the Reactor Protection System (RPS), safety equipment operation control, and Emergency Core Cooling System (ECCS), and can be configured to ensure real-time performance and deterministic response using closed and proprietary communication such as IEC 60870 and dedicated protocols.

[0024] The Non-Safety Network is connected to power plant operation information networks, management and administrative networks, surveillance cameras (CCTV), and data collection networks; it utilizes some commercial technologies such as Industrial Ethernet and TCP / IP, and is physically and logically isolated from the safety system.

[0025] IDDS (10, Integrated Data Acquisition and Detection System) is an integrated data acquisition and detection system that comprehensively collects and analyzes the network and facility status of a nuclear power plant to detect anomalies. IDDS (10) may include at least one detection system capable of detecting threat elements occurring in safety systems and / or non-safety systems.

[0026] IDDS (10) may perform data acquisition by collecting operation and control data in real time from the power plant's control and instrumentation system, sensors, network packets, etc., and / or detection by analyzing network intrusions, abnormal control signals, and signs of equipment abnormalities in real time.

[0027] IDDS (10) can collect data from the nuclear power plant network sections such as DCN-I, DCN-C, DCN-T, and DCN-D. Here, DCN-I (Instrument Network) is a network that collects data generated from various instruments of the nuclear power plant, and enables real-time measurement of equipment conditions such as temperature, pressure, flow rate, and radiation dose.

[0028] DCN-C (Control Network) is a network that transmits and receives control commands and can be used to control the operation of critical devices such as turbines, reactor control rods, and cooling systems.

[0029] DCN-T (Turbine Network) is a network specialized for turbine generator systems, where turbine-related data such as power generation efficiency, rotational speed, and vibration can be collected.

[0030] DCN-D (Diagnostic Network) is a network for equipment diagnosis and maintenance that can be utilized for equipment failure prediction, diagnostic data analysis, and preventive maintenance planning.

[0031] Meanwhile, IDDS (10) can perform anomaly detection by analyzing network intrusions, abnormal control signals, and signs of equipment abnormalities based on data collected from the network. This anomaly detection may classify traffic as normal or abnormal through pattern analysis based on deep learning or machine learning, and this will be described in more detail later.

[0032] IDDS (10) may include at least one anomaly detection module. For example, IDDS (10) may include DEN (21), DEP-N (22), and DEP-S (23). These anomaly detection modules (21, 22, 23) may be installed on a server (12).

[0033] The anomaly detection module (21, 22, 23) can be mounted on the server (12) in various forms. For example, the anomaly detection module (21, 22, 23) can be implemented in the form of a chipset or circuit board embedded in the main board of the server (12), or provided in the form of a card module coupled to the expansion slot of the server. Additionally, the anomaly detection module (21, 22, 23) can be connected to an external device through the interface port of the server (12), and furthermore, can be implemented as a software module or firmware code running on the server (12). These forms of implementation can be selected according to the functional requirements of each of the DEN (21), DEP-N (22), and DEP-S (23).

[0034] The DEN (21, Detection Engine for Nuclear) detects abnormal signs by analyzing data collected from a nuclear power plant network or system, and can perform real-time packet analysis, log analysis, and anomaly detection. Typically, it performs network traffic-based anomaly detection and can be configured to be linked with DEP-N (22) and / or DEP-S (23).

[0035] DEP-N(22, Detection & Evaluation Platform - Non Safety) monitors non-safety systems (e.g., general control networks, non-classified data networks, operation support systems) and can be configured to not only detect signs of abnormality but also to quantify or evaluate the degree of abnormality.

[0036] DEP-S (23, Detection & Evaluation Platform - Safety) performs data analysis and anomaly evaluation related to safety systems and typically must comply with strict safety regulatory standards such as IEC, IEEE, and KEPIC.

[0037] The OWS (Operator Work Station, 34) may be a Human-Machine Interface (HMI) terminal that allows a user to monitor and control the system status. The OWS (34) may be equipped with a display (not shown) that displays various measurement and control signals, and an interface for a user to input various control commands or to check various alarms and event logs.

[0039] A DCS (Distributed Control System, 31) is an automatic control system for the entire power plant and is built with a distributed architecture to prevent the suspension of overall operation even if a failure occurs in one area. For example, control functions may be distributed to multiple distributed controllers (PLC / RTU) and connected to a network for integrated monitoring and control.

[0040] The DCS (31) can be configured to receive sensor inputs and perform logic (PID, sequence control, etc.) or transmit commands to valves, pumps, turbine controllers, etc.

[0041] The user can monitor and control the status of the DCS (31) through the OWS (34).

[0042] A PLC (Programmable Logic Controller, 33) is a controller that directly controls actual field devices such as valves, pumps, and motors, and may operate at a lower level of the DCS (31).

[0043] When a user inputs a command to the DCS (31) through the OWS (34), the DCS (31) can be configured to control the equipment at the site through the PLC (33).

[0044] FIG. 2 is a block diagram illustrating a model training engine of a nuclear power plant network packet anomaly detection system according to an embodiment of the present invention. FIG. 3 is a block diagram illustrating a model classification engine of a nuclear power plant network packet anomaly detection system according to an embodiment of the present invention. Referring to FIG. 2 and FIG. 3, a nuclear power plant network packet anomaly detection system (100) according to an embodiment of the present invention may include a model training engine (110) and a model classification engine (120).

[0045] The model learning engine (110) may include a learning preprocessing module (111) that converts learning PCAP data obtained from a network of nuclear power plants into learning data in JSON format, a labeling module (112) that labels the learning data output from the learning preprocessing module (111) as normal or abnormal, and a learning module (113) that generates a learning model based on the learning data labeled by the labeling module (112).

[0046] Additionally, the model learning engine (110) may further include a model performance optimization module (not shown) that operates in conjunction with the learning module (113). The model performance optimization module may be configured to evaluate the performance of the learned deep learning model using various indicators and automatically adjust the model parameters according to the results to maximize detection performance.

[0047] Specifically, the validity of the model can be determined by calculating values ​​such as detection accuracy, true positive rate, false positive rate, false negative rate, and AUC (Area Under Curve).

[0048] Since the characteristics of nuclear power plant control networks require a low false positive rate and high detection sensitivity, the aforementioned model performance optimization module can generate an optimized model by utilizing parameter tuning, learning rate adjustment, loss function selection, application of data augmentation techniques, handling of class imbalance (SMOTE, weight correction, etc.), and early stopping techniques. By minimizing unnecessary alerts in the nuclear power plant environment while simultaneously increasing detection accuracy against various attack variants, this enables stable and reliable cybersecurity response.

[0049] The model classification engine (120) may include a PCAP capturer (121) that captures PCAP data transmitted from a nuclear power plant network, a classification preprocessing module (122) that converts the data captured by the PCAP capturer (121) into target data in JSON format, and an anomaly detection module (123) that takes the target data in JSON format received from the classification preprocessing module (122) as input to a classification model and outputs whether there is an anomaly in the network.

[0050] Here, the classification model is constructed based on a learning model generated by a learning module (113). For example, the classification model can be generated not only by simple replication of the learning model but also by various methods such as transfer learning, fine-tuning, ensemble, and knowledge distillation.

[0051] Meanwhile, an anomaly detection system (100) according to one embodiment of the present invention can determine whether there is an anomaly based on the temporal and structural patterns of traffic, even if the payload of the packet is encrypted, through the configuration of the learning module and classification model described above. In particular, by learning abnormal values ​​and anomaly patterns that may occur in proprietary protocols or legacy protocols used in the distributed control system (DCS) of a nuclear power plant, traffic sequences that differ from normal operation can be identified in real time, and through this, signs of anomalies such as cyber attacks or equipment malfunctions can be detected early.

[0052] FIG. 4 is a flowchart showing a method for detecting network packet anomalies in a nuclear power plant according to an embodiment of the present invention.

[0053] Referring to FIG. 4, an anomaly detection method according to one embodiment of the present invention may include steps S1 to S5.

[0054] S1 is a stage in which traffic is captured, and packet data (PCAP data) transmitted from the nuclear power plant network can be captured by a PCAP capturer (121). This capture of packet data can be performed in real time.

[0055] Step S2 may be a step in which packet data captured in Step S1 is parsed to extract features necessary for analysis. The features necessary for analysis may include headers, length, time intervals, directionality, etc. Data parsing may be performed by a classification preprocessing module (122).

[0056] Step S3 is a step of converting the feature data extracted in Step S2 into target data in JSON format, and can be performed by a classification preprocessing module (122).

[0057] In step S4, data converted into JSON format (hereinafter referred to as target data) is input into the anomaly detection module (123). As described above, the anomaly detection module (123) is equipped with a classification model generated based on the learning model of the learning module (113), and the target data is input into the classification model.

[0058] Step S5 may be a step in which the normal or abnormal status of a packet is determined by an anomaly detection module (123). Based on the input target data, the classification model can determine whether the packet is normal or abnormal. An alert unit (not shown) that outputs the result regarding whether the packet is normal or abnormal so that an administrator can recognize it may be further provided.

[0059] FIG. 5 is a flowchart showing a method for detecting network packet anomalies in a nuclear power plant according to another embodiment of the present invention.

[0060] Referring to FIG. 5, an anomaly detection method according to another embodiment of the present invention may include steps S11 to S17.

[0061] Step S11 is a step in which traffic is captured, and packet data (PCAP data) transmitted from the nuclear power plant network can be captured by a PCAP capturer (121). This capture of packet data can be performed in real time.

[0062] Step S12 is a step in which packet data captured in Step S11 is stored. The anomaly detection system (100) may include a data storage unit (not shown) in which the packet data is stored. The packet data may be stored as a PCAP file.

[0063] Step S13 may be a step for determining whether there is a request for anomaly detection. This determination may be made by a control unit (not shown) of the anomaly detection system (100).

[0064] The above control unit manages the flow of packet data collected from the network and can control data transfer between the learning module (113), the classification preprocessing module (122), and the anomaly detection module (123).

[0065] In addition, the control unit can switch the system operation mode by interpreting anomaly detection commands or configuration values ​​received from the administrator through the input module. For example, the control unit can control the system to immediately analyze traffic captured in real-time mode, or to load PCAP files accumulated in storage mode to perform batch analysis. Furthermore, the control unit can be linked with the model performance optimization module to determine the timing for retraining the learned model and whether to update parameters, and can control the system to transmit anomaly detection results to the notification unit and the operator interface so that a response can be taken.

[0066] When an administrator inputs an anomaly detection command through a separate input module (not shown), such command can be transmitted to an anomaly detection system (100) via a network. If it is determined by the control unit that an anomaly detection command has occurred, step S14 can be performed.

[0067] Step S14 may be a step in which features necessary for analysis are extracted by parsing the PCAP file saved in Step S12. The features necessary for analysis may include headers, length, time intervals, directionality, etc. Data parsing may be performed by a classification preprocessing module (122).

[0068] Step S15 is a step of converting the feature data extracted in Step S14 into target data in JSON format, and can be performed by a classification preprocessing module (122).

[0069] In step S16, data converted into JSON format (hereinafter referred to as target data) is input into the anomaly detection module (123). As described above, the anomaly detection module (123) is equipped with a classification model generated based on the learning model of the learning module (113), and the target data is input into the classification model.

[0070] Step S17 may be a step in which the normal or abnormal status of a packet is determined by an anomaly detection module (123). Based on the input target data, the classification model can determine whether the packet is normal or abnormal. At this time, the result regarding whether the packet is normal or abnormal may be output by the notification unit.

[0071] Meanwhile, the learning model provided in the aforementioned learning module (113) and / or the classification model provided in the anomaly detection module (123) may be implemented by a single neural network structure, or by a hybrid or ensemble structure in which different neural network structures are combined.

[0072] For example, the neural network structure described above includes: (i) a 1D Convolutional Neural Network (1D-CNN) and a Convolutional Neural Network (CNN) variant structure with various depths and filter configurations for learning the temporal characteristics and byte sequence patterns of packets; (ii) a Recurrent Neural Network (RNN) family structure such as Long Short-Term Memory (LSTM) for learning long-term packet sequence patterns, a Gated Recurrent Unit (GRU) that balances computational efficiency and pattern recognition performance, and a Bidirectional Recurrent Neural Network (Bidirectional RNN) that considers the bidirectional context of packet sequences; (iii) a Transformer-based structure including a Self-Attention mechanism and a Multi-Head Attention structure; (iv) an Autoencoder family structure such as an Autoencoder that performs anomaly detection through the reconstruction of normal packet patterns, a Variant Autoencoder (VAE) that utilizes probabilistic latent representations, and an Adversarial Autoencoder that utilizes adversarial learning; and (v) a Hybrid structure such as CNN-LSTM, CNN-GRU, and CNN-Transformer. It may include one or more of the multi-model ensemble structures.

Claims

Claim 1 A learning preprocessing module that converts training PCAP data acquired from a nuclear power plant network into training data in JSON format; a labeling module that labels the training data output from the preprocessing module as normal or abnormal; a learning module that generates a learning model based on the training data labeled by the labeling module; an anomaly detection module having a classification model generated based on the learning model; a PCAP capturer that generates target PCAP data by capturing target packets with encrypted payloads in real time from the traffic of the network; a data storage unit that stores the target PCAP data; and an input module that receives an anomaly detection command. A nuclear power plant network packet anomaly detection system comprising: a classification preprocessing module that converts the target PCAP data into target data in JSON format when the anomaly detection command is input through the input module; wherein the anomaly detection module outputs whether there is an anomaly in the network by using the target data received from the classification preprocessing module as input to the classification model; wherein the classification preprocessing module parses the target PCAP data to extract features necessary for analyzing the temporal and structural patterns of traffic based on at least one of the packet header, length, time interval, and directionality, and converts the extracted features into target data in JSON format. Claim 2 delete Claim 3 delete Claim 4 In claim 1, the classification model is a nuclear power plant network packet anomaly detection system in which the classification model is a convolutional neural network (CNN), a recurrent neural network (RNN), a long short-term memory (LSTM), a gated recurrent unit (GRU), a transformer, an autoencoder, or a combination of two or more of these. Claim 5 A nuclear power plant network packet anomaly detection system according to claim 1, wherein the learning model includes a plurality of learning models that have learned different characteristics from the learning PCAP data, and the anomaly detection module generates a plurality of classification models based on the plurality of learning models and outputs whether there is an anomaly in the network by ensembling the classification results of the plurality of classification models.

Images