Anti-temperature interference industrial control system physical intrusion detection threshold estimation method and device

Abstract

The application discloses a temperature interference-resistant physical intrusion detection threshold estimation method and device for an industrial control system. The application controls the connection and disconnection of a physical intrusion device and the industrial control system in turn at different test temperatures, performs physical intrusion detection on the industrial control system, and obtains intrusion test signals and non-intrusion test signals at each test temperature. For the intrusion test signals and non-intrusion test signals at each test temperature, the intrusion test signals and non-intrusion test signals are compared with standard signals obtained in advance, respectively, and intrusion features and non-intrusion features are extracted from the difference signals. When the intrusion features and non-intrusion features at all test temperatures are obtained, the detection threshold at each test temperature is determined according to the intrusion features and non-intrusion features at each test temperature. The interference of the environmental temperature on the physical intrusion detection of the industrial control system can be considered, and the accuracy and success rate of the physical intrusion detection of the industrial control system at different environmental temperatures can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control system attack detection, and particularly relates to an anti-temperature interference industrial control system physical intrusion detection threshold estimation method and device. BACKGROUND

[0002] Industrial control systems mostly adopt field bus structure, and isolate the communication network from the Internet, so network intrusion attacks are relatively easy to resist, but since most devices of the industrial control system are deployed in remote unattended places, an attacker can easily access a physical intrusion device to control the entire industrial control system, so how to detect physical intrusion of the industrial control system has become a current research hotspot. However, the current research on the physical intrusion detection method lacks consideration of different temperature changes. In actual application, due to factors such as seasonal replacement, climate change, and heat generated by the operation of the device itself, the environmental temperature is not constant. When the environmental temperature changes, not only will the temperature of the device or the wire change, but also the impedance will change, making it difficult to accurately detect physical intrusion of the industrial control system, and even causing the physical intrusion detection method to fail. SUMMARY

[0003] In order to overcome the defects of the prior art, the present application provides an anti-temperature interference industrial control system physical intrusion detection threshold estimation method and device, which can consider the interference of environmental temperature on the physical intrusion detection of the industrial control system, and improve the accuracy and success rate of the physical intrusion detection of the industrial control system under different environmental temperatures.

[0004] In order to solve the above technical problems, in a first aspect, an embodiment of the present application provides an anti-temperature interference industrial control system physical intrusion detection threshold estimation method, comprising:

[0005] setting an environmental temperature range according to an actual working environment of the industrial control system, and selecting a plurality of different test temperatures from the environmental temperature range;

[0006] controlling a physical intrusion device to be connected with the industrial control system under each test temperature, detecting physical intrusion of the industrial control system to obtain an intrusion test signal under each test temperature, and controlling the physical intrusion device to be disconnected from the industrial control system, detecting physical intrusion of the industrial control system to obtain a non-intrusion test signal under each test temperature;

[0007] for the intrusion test signal and the non-intrusion test signal under each test temperature, differentiating and comparing the intrusion test signal with a standard signal obtained in advance to extract an intrusion feature from an obtained intrusion difference signal, and differentiating and comparing the non-intrusion test signal with the standard signal to extract a non-intrusion feature from an obtained non-intrusion difference signal;

[0008] When the intrusion features and non-intrusion features at all the test temperatures are obtained, a detection threshold at each of the test temperatures is determined according to the intrusion feature and the non-intrusion feature at each of the test temperatures.

[0009] Further, after the when the intrusion features and non-intrusion features at all the test temperatures are obtained, a detection threshold at each of the test temperatures is determined according to the intrusion feature and the non-intrusion feature at each of the test temperatures, the method further comprises:

[0010] Based on the least square method, a change curve of the detection threshold varying with temperature is fitted according to the detection thresholds at all the test temperatures, and an optimal detection threshold at each of the test temperatures is determined according to the change curve.

[0011] Further, the anti-temperature interference physical intrusion detection threshold estimation method of the industrial control system further comprises:

[0012] When the industrial control system is in an initial state at a standard room temperature, an intrusion detection signal is sent to the industrial control system, so that a response signal fed back by the industrial control system is taken as the standard signal.

[0013] Further, the in each of the test temperatures, the physical intrusion equipment is connected with the industrial control system, the physical intrusion detection of the industrial control system is controlled, the intrusion test signal at each of the test temperatures is obtained, and the physical intrusion equipment is disconnected with the industrial control system, the physical intrusion detection of the industrial control system is controlled, and the non-intrusion test signal at each of the test temperatures is obtained, specifically:

[0014] In the test temperature, the physical intrusion equipment is connected with the industrial control system, the intrusion detection signal is sent to the industrial control system, so that the response signal fed back by the industrial control system is taken as the intrusion test signal at the test temperature;

[0015] The physical intrusion equipment is continuously controlled to be disconnected with the industrial control system, the intrusion detection signal is sent to the industrial control system, so that the response signal fed back by the industrial control system is taken as the non-intrusion test signal at the test temperature.

[0016] Further, the for each of the test temperatures, the intrusion test signal and the non-intrusion test signal, the intrusion test signal is compared with the standard signal obtained in advance, the intrusion feature is extracted from the obtained intrusion difference signal, and the non-intrusion test signal is compared with the standard signal, and the non-intrusion feature is extracted from the obtained non-intrusion difference signal, specifically:

[0017] comparing the intrusion test signal with the standard signal to obtain an intrusion difference signal, and extracting a time domain feature from the intrusion difference signal as the intrusion feature based on a noise reduction technique and a weak signal detection technique;

[0018] comparing the non-intrusion test signal with the standard signal to obtain a non-intrusion difference signal, and extracting a time domain feature from the non-intrusion difference signal as the non-intrusion feature based on a noise reduction technique and a weak signal detection technique.

[0019] In a second aspect, an embodiment of the present application provides an anti-temperature interference physical intrusion detection threshold estimation device for an industrial control system, comprising:

[0020] a test temperature selection module configured to set an environmental temperature range according to an actual working environment of the industrial control system, and select a plurality of different test temperatures from the environmental temperature range;

[0021] a test signal acquisition module configured to, at each test temperature, control a physical intrusion device to connect with the industrial control system, perform physical intrusion detection on the industrial control system, and acquire an intrusion test signal at each test temperature, and control the physical intrusion device to disconnect with the industrial control system, perform physical intrusion detection on the industrial control system, and acquire a non-intrusion test signal at each test temperature;

[0022] a signal feature extraction module configured to, for the intrusion test signal and the non-intrusion test signal at each test temperature, compare the intrusion test signal with a standard signal acquired in advance to obtain an intrusion difference signal, and extract an intrusion feature from the intrusion difference signal, and compare the non-intrusion test signal with the standard signal to obtain a non-intrusion difference signal, and extract a non-intrusion feature from the non-intrusion difference signal;

[0023] a detection threshold estimation module configured to, when all the intrusion features and the non-intrusion features at all the test temperatures are obtained, determine a detection threshold at each test temperature according to the intrusion feature and the non-intrusion feature at each test temperature.

[0024] Further, the detection threshold estimation module is further configured to, after the detection threshold at each test temperature is determined according to the intrusion feature and the non-intrusion feature at each test temperature when all the intrusion features and the non-intrusion features at all the test temperatures are obtained, fit a change curve of the detection threshold with temperature change based on a least square method according to the detection thresholds at all the test temperatures, and determine an optimal detection threshold at each test temperature according to the change curve.

[0025] Further, the anti-temperature interference physical intrusion detection threshold estimation device for the industrial control system further comprises:

[0026] A standard signal acquisition module is configured to send an intrusion detection signal to the industrial control system at a standard room temperature when the industrial control system is in an initial state, and to take the response signal fed back by the industrial control system as the standard signal.

[0027] Further, at each test temperature, the physical intrusion device is connected to the industrial control system to perform physical intrusion detection on the industrial control system, and the physical intrusion device is disconnected from the industrial control system to perform physical intrusion detection on the industrial control system, thereby obtaining an intrusion test signal at each test temperature and an unintrusion test signal at each test temperature, and the specific steps are as follows.

[0028] At the test temperature, the physical intrusion device is connected to the industrial control system to send an intrusion detection signal to the industrial control system, and the response signal fed back by the industrial control system is taken as the intrusion test signal at the test temperature.

[0029] The physical intrusion device is continuously controlled to be disconnected from the industrial control system to send the intrusion detection signal to the industrial control system, and the response signal fed back by the industrial control system is taken as the unintrusion test signal at the test temperature.

[0030] Further, for the intrusion test signal and the unintrusion test signal at each test temperature, the intrusion test signal is compared with a standard signal obtained in advance to extract an intrusion feature from an intrusion difference signal obtained by the comparison, and the unintrusion test signal is compared with the standard signal to extract an unintrusion feature from an unintrusion difference signal obtained by the comparison, and the specific steps are as follows.

[0031] The intrusion test signal is compared with the standard signal to obtain the intrusion difference signal, and time domain features are extracted from the intrusion difference signal as the intrusion feature based on a noise reduction technology and a weak signal detection technology.

[0032] The unintrusion test signal is compared with the standard signal to obtain the unintrusion difference signal, and time domain features are extracted from the unintrusion difference signal as the unintrusion feature based on a noise reduction technology and a weak signal detection technology.

[0033] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0034] By selecting a plurality of different test temperatures from a pre-set ambient temperature range, at each test temperature, the physical intrusion device is connected and disconnected with the industrial control system in turn, the physical intrusion detection of the industrial control system is carried out, the intrusion test signals and the non-intrusion test signals at each test temperature are obtained, for the intrusion test signals and the non-intrusion test signals at each test temperature, the intrusion test signals and the non-intrusion test signals are respectively compared with the standard signals obtained in advance, the intrusion features and the non-intrusion features are extracted from the difference signals, when the intrusion features and the non-intrusion features at all test temperatures are obtained, the detection threshold at each test temperature is determined according to the intrusion features and the non-intrusion features at each test temperature, the interference of the ambient temperature on the physical intrusion detection of the industrial control system can be considered, and the accuracy and the success rate of the physical intrusion detection of the industrial control system under different ambient temperatures can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 It is a flowchart of the anti-temperature interference physical intrusion detection threshold estimation method of the industrial control system in the first embodiment of the present application.

[0036] Figure 2 It is a fitting change curve diagram in the second embodiment of the present application.

[0037] Figure 3 It is a flowchart of the experimental stage in the second embodiment of the present application.

[0038] Figure 4 It is a flowchart of the experimental stage and the actual use stage in the second embodiment of the present application.

[0039] Figure 5 It is a structural diagram of the anti-temperature interference physical intrusion detection threshold estimation device in the third embodiment of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in the present application will be clearly and completely described below with reference to the drawings in the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0041] It should be noted that the step numbers in the text are only for the convenience of explaining the specific embodiments, and do not limit the execution sequence of the steps. The method provided in the present embodiment can be executed by the related terminal device, and the processor is taken as an example for description hereinafter.

[0042] As Figure 1As shown, the first embodiment provides a temperature interference-resistant physical intrusion detection threshold estimation method for an industrial control system, comprising steps S1-S4:

[0043] S1, set an environmental temperature range according to the actual working environment of the industrial control system, and select a plurality of different test temperatures from the environmental temperature range;

[0044] S2, at each test temperature, control the physical intrusion device to connect with the industrial control system, perform physical intrusion detection on the industrial control system, obtain intrusion test signals at each test temperature, and control the physical intrusion device to disconnect with the industrial control system, perform physical intrusion detection on the industrial control system, and obtain non-intrusion test signals at each test temperature;

[0045] S3, for the intrusion test signals and non-intrusion test signals at each test temperature, differentially compare the intrusion test signals with the pre-acquired standard signals, extract intrusion features from the obtained intrusion difference signals, and differentially compare the non-intrusion test signals with the standard signals, extract non-intrusion features from the obtained non-intrusion difference signals;

[0046] S4, when the intrusion features and non-intrusion features at all test temperatures are obtained, determine the detection threshold at each test temperature according to the intrusion features and non-intrusion features at each test temperature.

[0047] In the RS485 bus network of the industrial control system, an attacker directly implants an external unauthorized device in the industrial control system through physical intrusion, uses the unauthorized device to obtain communication information and forge control instructions, and endangers the safety and stability of the industrial control system. Due to the change of the environmental temperature of the industrial control system, the detection of the unauthorized device by the physical intrusion detection method will have a high probability of false positives and false negatives, causing the failure of the physical intrusion detection method.

[0048] As an example, in step S1, according to the actual working environment of the industrial control system, the environmental temperature range of the test scene is set in advance, and a plurality of different test temperatures are selected from the environmental temperature range. For example, the environmental temperature range is set to 0-60℃, and a temperature point for collecting signals is set every 10℃, i.e. 0℃, 10℃, 20℃, 30℃, 40℃, 50℃, and 60℃ are selected as test temperatures from the environmental temperature range, and the total number of selected test temperatures P=7.

[0049] In step S2, the physical intrusion device used for terminal access test of the industrial control system is connected to simulate the intrusion action in the test scene. At each test temperature, the physical intrusion device is first connected to the industrial control system to perform physical intrusion detection, and the intrusion test signal at the test temperature is obtained. Then, the physical intrusion device is disconnected from the industrial control system to perform physical intrusion detection, and the non-intrusion test signal at the test temperature is obtained. Thus, the intrusion test signal and the non-intrusion test signal at all test temperatures are obtained.

[0050] In step S3, for the intrusion test signal and the non-intrusion test signal at each test temperature, the intrusion test signal is compared with the standard signal obtained in advance to obtain an intrusion difference signal, and the intrusion feature is extracted from the intrusion difference signal. Meanwhile, the non-intrusion test signal is compared with the standard signal to obtain a non-intrusion difference signal, and the non-intrusion feature is extracted from the non-intrusion difference signal. Thus, the intrusion feature and the non-intrusion feature at all test temperatures are obtained. The standard signal can be obtained by performing physical intrusion detection on the industrial control system at a standard temperature when the industrial control system is in an initial state.

[0051] In step S4, when the intrusion feature and the non-intrusion feature at all test temperatures are obtained, the average feature value of the intrusion feature and the non-intrusion feature is taken as the detection threshold at each test temperature according to the intrusion feature and the non-intrusion feature at each test temperature. Thus, the detection threshold at all test temperatures is obtained. When the industrial control system is physically intruded in an actual scene, the corresponding detection threshold can be selected according to the current environmental temperature, and the accuracy and success rate of the physical intrusion detection of the industrial control system at different environmental temperatures are improved.

[0052] In this embodiment, a plurality of different test temperatures are selected from a pre-set environmental temperature range. At each test temperature, the physical intrusion device is connected to and disconnected from the industrial control system in sequence to perform physical intrusion detection on the industrial control system, and the intrusion test signal and the non-intrusion test signal at each test temperature are obtained. For the intrusion test signal and the non-intrusion test signal at each test temperature, the intrusion test signal and the non-intrusion test signal are compared with the standard signal obtained in advance, respectively, and the intrusion feature and the non-intrusion feature are extracted from the difference signals. When the intrusion feature and the non-intrusion feature at all test temperatures are obtained, the detection threshold at each test temperature is determined according to the intrusion feature and the non-intrusion feature at each test temperature. The interference of the environmental temperature on the physical intrusion detection of the industrial control system can be considered, and the accuracy and success rate of the physical intrusion detection of the industrial control system at different environmental temperatures are improved.

[0053] In the preferred embodiment, the anti-temperature interference physical intrusion detection threshold estimation method of the industrial control system further comprises: sending an intrusion detection signal to the industrial control system when the industrial control system is in an initial state at a standard room temperature, and taking the response signal fed back by the industrial control system as a standard signal.

[0054] For example, at the standard room temperature, when the industrial control system is in the initial state, the monitoring device sends an intrusion detection signal to the industrial control system, specifically, the monitoring device sends an intrusion detection signal to the bus of the industrial control system through the gateway device, and stores the signal collected by the monitoring device, i.e. the response signal fed back by the industrial control system, in the database as a standard signal.

[0055] Suppose that the standard room temperature when the industrial control system is in the initial state is T0, and the device at the mth position in the industrial control system is the monitoring device, then under the condition that the gateway device sends an intrusion detection signal x(t), the standard signal collected by the monitoring device is:

[0056] y0(t)=ρ m (Z0,T0)·x(t)+n(t) (1);

[0057] In formula (1), Z0 represents the network impedance when the industrial control system is in the initial state, ρ m (·) represents the voltage distribution coefficient at the monitoring device under the influence of the network impedance and the environmental temperature, and n(t) represents the environmental noise during the collection of the standard signal.

[0058] In the preferred embodiment, the method further comprises: connecting the physical intrusion device to the industrial control system at each test temperature, performing physical intrusion detection on the industrial control system, obtaining an intrusion test signal at each test temperature, and disconnecting the physical intrusion device from the industrial control system, performing physical intrusion detection on the industrial control system, and obtaining an unintruded test signal at each test temperature, specifically: connecting the physical intrusion device to the industrial control system at the test temperature, sending an intrusion detection signal to the industrial control system, and taking the response signal fed back by the industrial control system as an intrusion test signal at the test temperature; and continuing to disconnect the physical intrusion device from the industrial control system, sending an intrusion detection signal to the industrial control system, and taking the response signal fed back by the industrial control system as an unintruded test signal at the test temperature.

[0059] As an example, at the test temperature, first control the physical intrusion device to be connected with the industrial control system, send the intrusion detection signal to the industrial control system through the monitoring device, specifically, the monitoring device sends the intrusion detection signal to the bus of the industrial control system through the gateway device, so as to take the signal collected by the monitoring device, that is, the response signal fed back by the industrial control system, as the intrusion test signal at the test temperature, then control the physical intrusion device to be disconnected with the industrial control system, send the intrusion detection signal to the industrial control system through the monitoring device, specifically, the monitoring device sends the intrusion detection signal to the bus of the industrial control system through the gateway device, so as to take the signal collected by the monitoring device, that is, the response signal fed back by the industrial control system, as the non-intrusion test signal at the test temperature.

[0060] Suppose the test temperature is T, if the physical intrusion device is connected, under the condition that the gateway device sends the same intrusion detection signal x(t), the intrusion test signal collected by the monitoring device is:

[0061] y test (t)=ρ m (Z',T)·x(t)+υ(t) (2);

[0062] In formula (2), Z' represents the network impedance of the industrial control system under the intrusion scene, ρ m (·) represents the voltage distribution coefficient at the monitoring device under the influence of the network impedance and the environmental temperature, and υ(t) represents the environmental noise during the collection of the intrusion test signal.

[0063] If the physical intrusion device is disconnected, under the condition that the gateway device sends the same intrusion detection signal x(t), the non-intrusion test signal collected by the monitoring device is:

[0064] y test (t)=ρ m (Z0,T)·x(t)+υ(t) (3);

[0065] In formula (3), Z0 represents the network impedance when the industrial control system is in the initial state, ρ m (·) represents the voltage distribution coefficient at the monitoring device under the influence of the network impedance and the environmental temperature, and υ(t) represents the environmental noise during the collection of the non-intrusion test signal.

[0066] In the preferred embodiment, the intrusion test signal and the non-intrusion test signal at each test temperature are compared with the pre-acquired standard signal, the intrusion feature is extracted from the obtained intrusion difference signal, and the non-intrusion feature is extracted from the obtained non-intrusion difference signal, specifically: the intrusion test signal is compared with the standard signal to obtain an intrusion difference signal, and the time domain feature is extracted from the intrusion difference signal as the intrusion feature based on the noise reduction technology and the weak signal detection technology; the non-intrusion test signal is compared with the standard signal to obtain a non-intrusion difference signal, and the time domain feature is extracted from the non-intrusion difference signal as the non-intrusion feature based on the noise reduction technology and the weak signal detection technology.

[0067] As an example, the standard signal is extracted from the database, the intrusion test signal is compared with the standard signal to obtain an intrusion difference signal, and the time domain feature is extracted from the intrusion difference signal as the intrusion feature based on the noise reduction technology and the weak signal detection technology, while the non-intrusion test signal is compared with the standard signal to obtain a non-intrusion difference signal, and the time domain feature is extracted from the non-intrusion difference signal as the non-intrusion feature based on the noise reduction technology and the weak signal detection technology.

[0068] Wherein, the difference signals Δy(t) obtained by comparing the intrusion test signal and the standard signal, and the non-intrusion test signal and the standard signal respectively should be:

[0069]

[0070] As can be seen from formula (4), when the test temperature T = T0, the voltage distribution coefficient ρ of the difference signal under the non-intrusion scene m (Z0,T)-ρ m (Z0,T0) = 0, while the voltage distribution coefficient ρ of the difference signal under the intrusion scene m (Z',T)-ρ m (Z0,T0) ≠ 0, according to the physical intrusion detection method, the intrusion scene and the non-intrusion scene can be effectively identified; when the test temperature T ≠ T0, the voltage distribution coefficient of the difference signal under the non-intrusion scene and the voltage distribution coefficient of the difference signal under the intrusion scene are not equal to 0, at this time, according to the physical intrusion detection method, the intrusion scene and the non-intrusion scene cannot be accurately identified, therefore, the existing physical intrusion detection method is greatly affected by the interference of temperature change.

[0071] Therefore, after obtaining the intrusion difference signal and the non-intrusion difference signal at the test temperature, the feature extraction of the intrusion difference signal and the non-intrusion difference signal is continued, and the difference signal feature R Δy,y0 (τ) should be:

[0072]

[0073] In formula (5), μ' (0, ΔT) and μ (0, ΔT) represent the cross-correlation amplitude coefficients under the intrusion scenario and the non-intrusion scenario respectively, ΔZ = Z' - Z0 represents the change of the network impedance of the industrial control system under the intrusion scenario compared with the network impedance of the industrial control system under the initial state, ΔT = T - T0 represents the change of the test temperature under the intrusion scenario / non-intrusion scenario compared with the test temperature under the initial state, R m (τ) is the autocorrelation structure of the intrusion detection signal x(t), R m (τ) represents the cross-correlation result of the intrusion detection signal x(t) and the environmental noise υ(t) collected when the intrusion test signal / non-intrusion test signal is collected, R xx (τ) represents the cross-correlation result of the intrusion detection signal x(t) and the environmental noise n(t) collected when the standard signal is collected. υx (τ) represents the cross-correlation result of the intrusion detection signal x(t) and the environmental noise υ(t) collected when the intrusion test signal / non-intrusion test signal is collected, R nx (τ) represents the cross-correlation result of the intrusion detection signal x(t) and the environmental noise n(t) collected when the standard signal is collected.

[0074] Since the network impedance of the industrial control system under the non-intrusion scenario is the same as the network impedance of the industrial control system under the initial state, the cross-correlation amplitude coefficients must satisfy μ' (0, ΔT) ≠ μ (0, ΔT). m Therefore, the difference signal feature extracted from the cross-correlation result must satisfy F m ≠ F

[0075] And since the difference signal and the standard signal have the same period, when the offset of the two signals is τ = 0, the amplitude of the cross-correlation result reaches the maximum value. The amplitude of the difference signal at the time of the offset 0 is used as the difference signal feature, the intrusion feature is denoted as F attack , and the non-intrusion feature is denoted as F normal , and the average feature value of the intrusion feature and the non-intrusion feature is used as the detection threshold for identifying the intrusion scenario and the non-intrusion scenario at the test temperature T, and the detection threshold η T is:

[0076] η T = (F attack +F normal ) / 2 (6).

[0077] Within the preset environmental temperature range of 0-60℃, all selected test temperatures are traversed in turn starting from 0℃ with an increment of 10℃, and the test signal acquisition and the difference signal feature extraction operations are performed at each test temperature, m groups of intrusion features and m groups of non-intrusion features are extracted, until all test temperatures are traversed, the detection threshold at each test temperature is determined according to the intrusion feature and the non-intrusion feature at each test temperature, and thus the detection thresholds at all test temperatures are obtained.

[0078] Based on the first embodiment, the second embodiment provides a method for estimating the physical intrusion detection threshold of an industrial control system that is resistant to temperature interference.

[0079] In this embodiment, after determining the detection threshold for each test temperature based on the intrusion and non-intrusion characteristics obtained at all test temperatures, the method further includes: fitting a curve of the detection threshold changing with temperature based on the detection threshold at all test temperatures using the least squares method, and determining the optimal detection threshold for each test temperature based on the curve.

[0080] As an example, after obtaining the detection thresholds at all test temperatures, the least squares method is used to fit the curve of the detection threshold changing with temperature. Based on the curve, the optimal detection threshold at each test temperature is determined, and a temperature-threshold table is generated. The temperature-threshold table is stored in a database, so that when performing physical intrusion detection on industrial control systems in real-world scenarios, the temperature-threshold table can be retrieved from the database, and the corresponding optimal detection threshold can be selected according to the current ambient temperature, further improving the accuracy and success rate of physical intrusion detection on industrial control systems under different ambient temperatures.

[0081] At the same test temperature T, the N sets of intrusion characteristics obtained by connecting physical intrusion devices are represented as follows: The N sets of non-intrusion characteristics obtained by disconnecting the physical intrusion device are represented as follows: The average of intrusion and non-intrusion features at a random test temperature T is taken and considered as the detection threshold for identifying intrusion and non-intrusion scenarios at that test temperature T. Finally, N detection thresholds for distinguishing between intrusion and non-intrusion scenarios at each test temperature are obtained.

[0082] Among them, the test temperature T is generated. p The k-th detection threshold can be expressed as:

[0083]

[0084] The least squares method is used to adaptively fit the curve of the threshold change with temperature, and the fitting coefficient of the curve is obtained. The least squares curve fitting process is as follows:

[0085] η θ (T)=θ0+θ1T+θ2T 2 (8);

[0086]

[0087] In equation (8), η θ(T) is a threshold value fitted by using the least square method at the test temperature T, and θ0, θ1, θ2 are curve coefficients to be fitted. When the initial temperature is 20℃, a temperature point for collecting a signal is set every 10℃ from 0-60℃, the difference signal characteristics are obtained by using the LTSpice simulation data, the θ is solved by using the gradient descent method, and the change curve of the detection threshold value with the temperature change is fitted by using the MATLAB, as shown in Figure 2 Further, the optimal detection threshold value at each test temperature is determined, and the optimal detection threshold value and the test temperature are saved as a temperature-threshold table. Figure 2 Further, the optimal detection threshold value at each test temperature is determined, and the optimal detection threshold value and the test temperature are saved as a temperature-threshold table.

[0088] For example, the following table is the optimal test threshold value corresponding to every 5℃ of temperature obtained by using the temperature-threshold table:

[0089] Temperature / °C 0 5 10 15 20 25 30 35 40 Threshold -17.1 -14.8 -12.6 -10.5 -8.5 -6.5 -4.7 -3.0 -1.4

[0090] Figure 2 The change curve of the detection threshold value with the temperature change fitted by using the MATLAB is the change curve of the detection threshold value of the intrusion scene and the non-intrusion scene with the temperature change, that is, the threshold fitting curve, and it can be seen that the fitted change curve can identify the intrusion scene and the non-intrusion scene.

[0091] The embodiment can more accurately estimate the detection threshold value at each test temperature by fitting the change curve of the detection threshold value with the temperature change according to the detection threshold values at all test temperatures based on the least square method, determining the optimal detection threshold value at each test temperature according to the change curve, thereby further improving the accuracy and success rate of the physical intrusion detection of the industrial control system under different environmental temperatures.

[0092] In order to more clearly illustrate the embodiment, as Figures 3-4 shown in the figure, when the industrial control system is put into use, in combination with Figure 4 , the use of the database is specifically explained:

[0093] In the experimental stage, the standard signal is generated at the standard temperature and stored in the standard signal database, and in the actual use stage, the standard signal in the standard signal database can be used for difference comparison.

[0094] In the experimental stage, the change curve of the detection threshold value with the temperature change is fitted, and the obtained temperature-threshold table is stored in the threshold temperature database, and in the actual use stage, the temperature-threshold table in the threshold-temperature database can be directly called to adjust the threshold value in the physical intrusion detection process.

[0095] Based on the same inventive concept as the second embodiment, the third embodiment provides as Figure 5The physical intrusion detection threshold estimation device of the temperature interference resistant industrial control system shown comprises: a test temperature selection module 21 configured to set an environmental temperature range according to an actual working environment of the industrial control system and select a plurality of different test temperatures from the environmental temperature range; a test signal acquisition module 22 configured to, at each test temperature, control a physical intrusion device to connect with the industrial control system, perform physical intrusion detection on the industrial control system, acquire an intrusion test signal at each test temperature, control the physical intrusion device to disconnect with the industrial control system, perform physical intrusion detection on the industrial control system, and acquire a non-intrusion test signal at each test temperature; a signal feature extraction module 23 configured to, for the intrusion test signal and the non-intrusion test signal at each test temperature, perform differential comparison between the intrusion test signal and a standard signal acquired in advance to extract an intrusion feature from an obtained intrusion difference signal, and perform differential comparison between the non-intrusion test signal and the standard signal to extract a non-intrusion feature from an obtained non-intrusion difference signal; and a detection threshold estimation module 24 configured to, when the intrusion features and the non-intrusion features at all test temperatures are obtained, determine a detection threshold at each test temperature according to the intrusion feature and the non-intrusion feature at each test temperature.

[0096] In a preferred embodiment, the detection threshold estimation module 24 is further configured to, after the detection threshold at each test temperature is determined according to the intrusion feature and the non-intrusion feature at each test temperature when the intrusion features and the non-intrusion features at all test temperatures are obtained, fit a change curve of the detection threshold with temperature change based on a least square method according to the detection thresholds at all test temperatures, and determine an optimal detection threshold at each test temperature according to the change curve.

[0097] In a preferred embodiment, the physical intrusion detection threshold estimation device of the temperature interference resistant industrial control system further comprises a standard signal acquisition module configured to, when the industrial control system is in an initial state at a standard room temperature, send an intrusion detection signal to the industrial control system to take a response signal fed back by the industrial control system as a standard signal.

[0098] In a preferred embodiment, the control of the physical intrusion device to connect with the industrial control system, the physical intrusion detection on the industrial control system, the acquisition of the intrusion test signal at each test temperature, the control of the physical intrusion device to disconnect with the industrial control system, the physical intrusion detection on the industrial control system, and the acquisition of the non-intrusion test signal at each test temperature at each test temperature are specifically: at the test temperature, the control of the physical intrusion device to connect with the industrial control system, the sending of the intrusion detection signal to the industrial control system, and the taking of a response signal fed back by the industrial control system as the intrusion test signal at the test temperature; and the continued control of the physical intrusion device to disconnect with the industrial control system, the sending of the intrusion detection signal to the industrial control system, and the taking of a response signal fed back by the industrial control system as the non-intrusion test signal at the test temperature.

[0099] In the preferred embodiments, for the intrusion test signal and the non-intrusion test signal at each test temperature, the intrusion test signal is compared with the pre-acquired standard signal, the intrusion feature is extracted from the obtained intrusion difference signal, and the non-intrusion test signal is compared with the standard signal, the non-intrusion feature is extracted from the obtained non-intrusion difference signal, specifically: the intrusion test signal is compared with the standard signal to obtain an intrusion difference signal, and based on noise reduction technology and weak signal detection technology, time domain features are extracted from the intrusion difference signal as intrusion features; the non-intrusion test signal is compared with the standard signal to obtain a non-intrusion difference signal, and based on noise reduction technology and weak signal detection technology, time domain features are extracted from the non-intrusion difference signal as non-intrusion features.

[0100] In summary, the embodiments of the present application have the following beneficial effects:

[0101] By selecting a plurality of different test temperatures from a pre-set environmental temperature range, at each test temperature, the physical intrusion device is sequentially connected and disconnected with the industrial control system, the physical intrusion detection of the industrial control system is performed, the intrusion test signal and the non-intrusion test signal at each test temperature are acquired, for the intrusion test signal and the non-intrusion test signal at each test temperature, the intrusion test signal and the non-intrusion test signal are compared with the pre-acquired standard signal, respectively, the intrusion feature and the non-intrusion feature are extracted from the obtained difference signal, when the intrusion features and the non-intrusion features at all test temperatures are obtained, the detection threshold at each test temperature is determined according to the intrusion features and the non-intrusion features at each test temperature, the interference of the environmental temperature on the physical intrusion detection of the industrial control system can be considered, and the accuracy and the success rate of the physical intrusion detection of the industrial control system under different environmental temperatures can be improved.

[0102] The above describes the preferred embodiments of the present application, and it should be noted that those skilled in the art can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements are also considered within the protection scope of the present application.

[0103] Those skilled in the art can understand that all or part of the processes in the above embodiments can be completed by a computer program instructing related hardware, and the program can be stored in a computer readable storage medium, and when the program is executed, the processes of the above embodiments can be included. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM) or a random access memory (RAM), etc.

Claims

1. A method for estimating the physical intrusion detection threshold in an industrial control system that is resistant to temperature interference, characterized in that, include: The ambient temperature range is set according to the actual working environment of the industrial control system, and multiple different test temperatures are selected from the ambient temperature range. At each of the test temperatures, the physical intrusion device is controlled to connect to the industrial control system to perform physical intrusion detection on the industrial control system and obtain the intrusion test signal at each of the test temperatures; and the physical intrusion device is controlled to disconnect from the industrial control system to perform physical intrusion detection on the industrial control system and obtain the non-intrusion test signal at each of the test temperatures. For each intrusion test signal and non-intrusion test signal at each test temperature, the intrusion test signal is differentially compared with a pre-acquired standard signal, and intrusion features are extracted from the obtained intrusion difference signal; and the non-intrusion test signal is differentially compared with the standard signal, and non-intrusion features are extracted from the obtained non-intrusion difference signal. When the intrusion and non-intrusion characteristics at all the test temperatures are obtained, a detection threshold at each test temperature is determined based on the intrusion and non-intrusion characteristics at each test temperature. For each intrusion test signal and non-intrusion test signal at each test temperature, the intrusion test signal is differentially compared with a pre-acquired standard signal to extract intrusion features from the obtained intrusion difference signal; and the non-intrusion test signal is differentially compared with the standard signal to extract non-intrusion features from the obtained non-intrusion difference signal. Specifically: The intrusion test signal is differentially compared with the standard signal to obtain the intrusion difference signal, and based on noise reduction technology and weak signal detection technology, time-domain features are extracted from the intrusion difference signal as the intrusion feature; The non-intrusion test signal is differentially compared with the standard signal to obtain the non-intrusion difference signal. Based on noise reduction technology and weak signal detection technology, time-domain features are extracted from the non-intrusion difference signal as the non-intrusion feature.

2. The method for estimating the physical intrusion detection threshold of an industrial control system with resistance to temperature interference as described in claim 1, characterized in that, After determining the detection threshold for each test temperature based on the intrusion and non-intrusion characteristics obtained at all test temperatures, the method further includes: Based on the least squares method, the detection threshold is fitted with a temperature change curve according to the detection threshold at all the test temperatures, and the optimal detection threshold at each of the test temperatures is determined based on the change curve.

3. The method for estimating the physical intrusion detection threshold of an industrial control system resistant to temperature interference as described in claim 1 or 2, characterized in that, Also includes: At standard room temperature, when the industrial control system is in its initial state, an intrusion detection signal is sent to the industrial control system, and the response signal fed back by the industrial control system is used as the standard signal.

4. The method for estimating the physical intrusion detection threshold of an industrial control system resistant to temperature interference as described in claim 1 or 2, characterized in that, The steps include: at each test temperature, controlling the physical intrusion device to connect to the industrial control system, performing physical intrusion detection on the industrial control system, and obtaining an intrusion test signal at each test temperature; and controlling the physical intrusion device to disconnect from the industrial control system, performing physical intrusion detection on the industrial control system, and obtaining a non-intrusion test signal at each test temperature. Specifically: At the test temperature, the physical intrusion device is connected to the industrial control system and an intrusion detection signal is sent to the industrial control system, so that the response signal fed back by the industrial control system is used as the intrusion test signal at the test temperature; Continue to control the physical intrusion device to disconnect from the industrial control system, and send the intrusion detection signal to the industrial control system, so as to use the response signal fed back by the industrial control system as the non-intrusion test signal at the test temperature.

5. A threshold estimation device for physical intrusion detection in an industrial control system that is resistant to temperature interference, characterized in that, include: The test temperature selection module is used to set the ambient temperature range according to the actual working environment of the industrial control system, and to select multiple different test temperatures from the ambient temperature range. The test signal acquisition module is used to control the physical intrusion device to connect with the industrial control system at each test temperature, perform physical intrusion detection on the industrial control system, acquire intrusion test signals at each test temperature, and control the physical intrusion device to disconnect from the industrial control system, perform physical intrusion detection on the industrial control system, and acquire non-intrusion test signals at each test temperature. The signal feature extraction module is used to perform differential comparison between the intrusion test signal and the pre-acquired standard signal for each intrusion test signal and non-intrusion test signal at each test temperature, and extract intrusion features from the obtained intrusion difference signal; and to perform differential comparison between the non-intrusion test signal and the standard signal, and extract non-intrusion features from the obtained non-intrusion difference signal. The detection threshold estimation module is used to determine the detection threshold for each test temperature based on the intrusion and non-intrusion characteristics at each test temperature when all the intrusion and non-intrusion characteristics at all the test temperatures are obtained. For each intrusion test signal and non-intrusion test signal at each test temperature, the intrusion test signal is differentially compared with a pre-acquired standard signal to extract intrusion features from the obtained intrusion difference signal; and the non-intrusion test signal is differentially compared with the standard signal to extract non-intrusion features from the obtained non-intrusion difference signal. Specifically: The intrusion test signal is differentially compared with the standard signal to obtain the intrusion difference signal, and based on noise reduction technology and weak signal detection technology, time-domain features are extracted from the intrusion difference signal as the intrusion feature; The non-intrusion test signal is differentially compared with the standard signal to obtain the non-intrusion difference signal. Based on noise reduction technology and weak signal detection technology, time-domain features are extracted from the non-intrusion difference signal as the non-intrusion feature.

6. The temperature-resistant physical intrusion detection threshold estimation device for industrial control systems as described in claim 5, characterized in that, The detection threshold estimation module is further configured to, after determining the detection threshold for each test temperature based on the intrusion and non-intrusion characteristics at all test temperatures when the intrusion and non-intrusion characteristics at all test temperatures are obtained, fit the detection threshold variation curve with temperature based on the least squares method, and determine the optimal detection threshold for each test temperature based on the variation curve.

7. The temperature-resistant physical intrusion detection threshold estimation device for industrial control systems as described in claim 5 or 6, characterized in that, Also includes: A standard signal acquisition module is used to send an intrusion detection signal to the industrial control system when the industrial control system is in its initial state at a standard room temperature, so as to use the response signal fed back by the industrial control system as the standard signal.

8. The temperature-resistant physical intrusion detection threshold estimation device for industrial control systems as described in claim 5 or 6, characterized in that, The steps include: at each test temperature, controlling the physical intrusion device to connect to the industrial control system, performing physical intrusion detection on the industrial control system, and obtaining an intrusion test signal at each test temperature; and controlling the physical intrusion device to disconnect from the industrial control system, performing physical intrusion detection on the industrial control system, and obtaining a non-intrusion test signal at each test temperature. Specifically: At the test temperature, the physical intrusion device is connected to the industrial control system and an intrusion detection signal is sent to the industrial control system, so that the response signal fed back by the industrial control system is used as the intrusion test signal at the test temperature; Continue to control the physical intrusion device to disconnect from the industrial control system, and send the intrusion detection signal to the industrial control system, so as to use the response signal fed back by the industrial control system as the non-intrusion test signal at the test temperature.

Images