Control system attack detection method, detection system, device and storage medium

Abstract

The present invention discloses a control system attack detection method, a detection system, a terminal device and a storage medium. The control system attack detection method includes the following steps: converting a real-time sensing signal emitted by the sensor based on the detection loop probe; determining a disturbance parameter based on the real-time sensing signal and a preset signal parameter; sending a data packet containing the real-time sensing signal, the preset signal parameter and the disturbance parameter to the controller; and calculating a residual parameter based on the controller for the real-time sensing signal and the preset signal parameter, comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked or tampered with. In this way, the present invention can accurately detect whether an industrial control system has been attacked based on changes in working conditions, and can avoid false warnings of attacks caused by changes in working conditions and disturbances, so as to meet the security protection requirements of the industrial control system to a greater extent.

Description

Technical Field

[0001] The present invention relates to the field of industrial production, and in particular to a control system attack detection method, a detection system, a device and a computer storage medium. Background Art

[0002] At present, enterprises usually use automated control to carry out industrial production. Once the control system used to realize automated control of industrial production is attacked, it will seriously affect the production process and production efficiency, causing huge losses to enterprises and society. Attacks in industrial processes generally act on the closed-loop control loop of the control system, thereby affecting the entire industrial production process. Among them, false data injection (FDI) attacks are currently the most common form of attack.

[0003] The existing methods for detecting false data injection are mainly based on threshold detection based on Kalman filtering. When the working conditions remain unchanged and there are no strong external disturbances in the industrial process control system, the above methods have good effects on attack detection in industrial processes. However, in actual industrial process production, the working conditions are not static, which makes the above attack detection methods based on Kalman filtering prone to false attack alarms due to changes in working conditions. In addition, external disturbances are also common in industrial process control systems, and the above attack detection methods based on Kalman filtering are difficult to distinguish between external disturbances of greater intensity and actual attacks. Therefore, disturbances and changes in working conditions make the false alarm rate of existing attack detection methods higher, which is limited in practical application in attack monitoring of industrial process control systems.

[0004] Therefore, how to accurately detect whether an industrial control system is under attack based on changes in operating conditions, and avoid false warnings of attacks caused by changes in operating conditions and disturbances, so as to meet the security protection requirements of industrial control systems to a greater extent, is a difficult problem that urgently needs to be solved in the field of industrial production. Summary of the invention

[0005] The main purpose of the present invention is to provide a control system attack detection method, device, equipment and computer storage medium, which aims to accurately detect whether the industrial control system is under attack based on changes in operating conditions, and to avoid false attack warnings caused by changes in operating conditions and disturbances, so as to meet the security protection requirements of the industrial control system to a greater extent. This is a difficult problem that urgently needs to be solved in the field of industrial production.

[0006] To achieve the above object, the present invention provides a control system attack detection method, which is applied to a detection system, wherein the detection system comprises: a detection loop probe, a sensor and a controller; the control system attack detection method comprises the following steps:

[0007] converting a real-time sensing signal emitted by the sensor based on the detection loop probe;

[0008] Determining disturbance parameters based on the real-time sensing signal and preset signal parameters;

[0009] Sending a data packet including the real-time sensing signal, the preset signal parameter and the disturbance parameter to the controller;

[0010] Based on the residual parameter calculated by the controller for the real-time sensing signal and the preset signal parameter, the residual parameter is compared with the disturbance parameter to determine whether the data packet is attacked and tampered with.

[0011] Furthermore, before the step of determining the disturbance parameter based on the real-time sensing signal and the preset signal parameter, it also includes:

[0012] Acquiring, based on the detection loop probe, a stable sensing signal emitted by the sensor and a stable control signal emitted by the controller under a stable operation condition of the industrial process control loop;

[0013] The preset signal parameter is determined based on the stable sensing signal and the stable control signal.

[0014] Furthermore, the step of determining the preset signal parameter based on the stable sensing signal and the stable control signal comprises:

[0015] Identifying a controlled object model based on the stable sensing signal and the stable control signal;

[0016] The preset signal parameters are determined based on the controlled object model.

[0017] Furthermore, the step of determining the preset signal parameters based on the controlled object model includes:

[0018] converting a real-time control signal issued by the controller based on the detection loop probe;

[0019] The preset signal parameter is determined based on the controlled object model and the real-time control signal.

[0020] Furthermore, the step of comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with comprises:

[0021] A difference is obtained by calculating the residual parameter and the disturbance parameter. If the difference is within a preset threshold range, it is determined that the data packet has not been attacked or tampered with.

[0022] Furthermore, the step of comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with further includes:

[0023] A difference is obtained by calculating the residual parameter and the disturbance parameter. If the difference exceeds a preset threshold range, it is determined that the data packet has been attacked and tampered with.

[0024] Further, after the step of determining that the data packet has been attacked and tampered with, the method further includes:

[0025] The preset alarm information is triggered based on the controller.

[0026] In addition, to achieve the above object, a detection system is provided, the detection system comprising:

[0027] A detection loop probe is used to convert a real-time sensing signal sent by a sensor; determine a disturbance parameter based on the real-time sensing signal and a preset signal parameter; and send a data packet including the real-time sensing signal, the preset signal parameter and the disturbance parameter to the controller;

[0028] The controller is used to calculate a residual parameter based on the real-time sensing signal and the preset signal parameter, and compare the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with.

[0029] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal device, which includes: a memory, a processor, and a control system attack detection program stored in the memory and executable on the processor, and the control system attack detection program, when executed by the processor, implements the steps of the control system attack detection method as described above.

[0030] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the control system attack detection method as described above are implemented.

[0031] In addition, an embodiment of the present invention further provides a computer program product, which includes a control system attack detection program. When the control system attack detection program is executed by a processor, the steps of the control system attack detection method described above are implemented.

[0032] Among them, the steps implemented when the control system attack detection program running on the processor is executed can refer to the various embodiments of the control system attack detection method of the present invention, and will not be repeated here.

[0033] The control system attack detection method proposed in the present invention converts the real-time sensing signal emitted by the sensor based on the detection loop probe; determines the disturbance parameter based on the real-time sensing signal and the preset signal parameter; sends a data packet including the real-time sensing signal, the preset signal parameter and the disturbance parameter to the controller; calculates the residual parameter based on the controller for the real-time sensing signal and the preset signal parameter, and compares the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with.

[0034] The present invention is a control system attack detection method proposed for false data injection (FDI) attacks, and the principle of false data injection attacks is to tamper with the data in the communication packet between the control loop sensor and the controller so that the controller cannot perceive the real state of the system, thereby affecting the normal operation of the control system. In the control system attack detection method provided by the present invention, the real-time sensing signal emitted by the sensor is first converted in real time by a detection loop probe, and then the real-time sensing signal and the preset signal parameters are calculated to determine the disturbance parameters corresponding to the disturbance of the sensing signal during the transmission process due to the change of working conditions, and then the detection loop probe sends a data packet containing the real-time sensing signal, the preset signal parameters and the disturbance parameters to the controller. If the industrial process control loop is attacked, the real-time sensing signal in the above data packet will change; the controller calculates the real-time sensing signal and the preset signal parameters in the received data packet to obtain the residual parameters, and compares the residual parameters with the disturbance parameters to obtain the comparison results, and can determine whether the data packet has been tampered with according to the comparison results, thereby determining whether the industrial process control loop has been attacked.

[0035] In this way, the control system attack detection method provided by the present invention can accurately detect whether the industrial control system is under attack based on changes in operating conditions, and can avoid false warnings of attacks caused by changes in operating conditions and disturbances, so as to meet the security protection requirements of the industrial control system to a greater extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of the structure of the hardware operating environment of the terminal device involved in the embodiment of the present invention;

[0037] Figure 2 It is a flow chart of an embodiment of a control system attack detection method of the present invention;

[0038] Figure 3 is an application principle diagram of a detection loop probe involved in one embodiment of the present invention;

[0039] Figure 4 is a structural principle diagram of a detection system involved in one embodiment of the present invention;

[0040] Figure 5 It is an application flow chart of an embodiment of a control system attack detection method of the present invention;

[0041] Figure 6 is a control loop disturbance detection effect diagram involved in an embodiment of the present invention;

[0042] Figure 7 This is a disturbance residual detection effect diagram of a control loop in a non-attack state according to an embodiment of the present invention;

[0043] Figure 8 It is a disturbance residual detection effect diagram of the control loop output data under attack according to an embodiment of the present invention;

[0044] Fig. 9 This is a Kalman filter detection effect diagram of a control loop in a non-attack state according to an embodiment of the present invention;

[0045] Fig.10 This is a Kalman filter detection effect diagram when the control loop output data involved in one embodiment of the present invention is attacked;

[0046] Fig.11 It is a schematic diagram of the module structure of a detection system of the present invention.

[0047] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0049] like Figure 1 As shown, Figure 1 It is a structural diagram of the hardware operating environment of the terminal device involved in the embodiment of the present invention.

[0050] It should be noted that Figure 1 The terminal device of the embodiment of the present invention may be a detection system for executing control system attack detection, a PC, a portable computer and other terminal devices.

[0051] like Figure 1As shown, the terminal device includes: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 includes a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 also includes a standard wired interface and a wireless interface. The network interface 1004 optionally includes a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 can be a high-speed RAM memory, or it can be a stable memory (non-volatile memory), such as a disk memory. The memory 1005 can also be a storage device independent of the aforementioned processor 1001.

[0052] Those skilled in the art will understand that Figure 1 The terminal device structure shown in the figure does not constitute a limitation on the terminal device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0053] like Figure 1 As shown, the memory 1005 as a computer storage medium includes an operating system, a network communication module, a user interface module and a distributed task processing program. Among them, the operating system is a program that manages and controls the hardware and software resources of the sample terminal device, and supports the operation of the distributed task processing program and other software or programs.

[0054] exist Figure 1 In the terminal device shown, the user interface 1003 is mainly used to communicate data with each terminal; the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; and the processor 1001 can be used to call the control system attack detection program stored in the memory 1005 and perform the following operations:

[0055] converting a real-time sensing signal emitted by the sensor based on the detection loop probe;

[0056] Determining disturbance parameters based on the real-time sensing signal and preset signal parameters;

[0057] Sending a data packet including the real-time sensing signal, the preset signal parameter and the disturbance parameter to the controller;

[0058] Based on the residual parameter calculated by the controller for the real-time sensing signal and the preset signal parameter, the residual parameter is compared with the disturbance parameter to determine whether the data packet is attacked and tampered with.

[0059] Further, before the step of determining the disturbance parameter based on the real-time sensing signal and the preset signal parameter, the processor 1001 may call the control system attack detection program stored in the memory 1005, and further perform the following operations:

[0060] Acquiring, based on the detection loop probe, a stable sensing signal emitted by the sensor and a stable control signal emitted by the controller under a stable operation condition of the industrial process control loop;

[0061] The preset signal parameter is determined based on the stable sensing signal and the stable control signal.

[0062] Further, the processor 1001 may call the control system attack detection program stored in the memory 1005, and further perform the following operations:

[0063] Identifying a controlled object model based on the stable sensing signal and the stable control signal;

[0064] The preset signal parameters are determined based on the controlled object model.

[0065] Further, the processor 1001 may call the control system attack detection program stored in the memory 1005, and further perform the following operations:

[0066] converting a real-time control signal issued by the controller based on the detection loop probe;

[0067] The preset signal parameter is determined based on the controlled object model and the real-time control signal.

[0068] Further, the processor 1001 may call the control system attack detection program stored in the memory 1005, and further perform the following operations:

[0069] A difference is obtained by calculating the residual parameter and the disturbance parameter. If the difference is within a preset threshold range, it is determined that the data packet has not been attacked or tampered with.

[0070] Further, the processor 1001 may call the control system attack detection program stored in the memory 1005, and further perform the following operations:

[0071] A difference is obtained by calculating the residual parameter and the disturbance parameter. If the difference exceeds a preset threshold range, it is determined that the data packet has been attacked and tampered with.

[0072] Further, after the step of determining that the data packet is attacked and tampered, the processor 1001 may call the control system attack detection program stored in the memory 1005, and further perform the following operations:

[0073] The preset alarm information is triggered based on the controller.

[0074] Based on the above structure, various embodiments of the control system attack detection method of the present invention are proposed.

[0075] It should be noted that attacks in industrial processes generally act on the closed-loop control loop of the control system, thereby affecting the entire industrial production process. Among them, false data injection (FDI) attacks are currently the most common form of attack.

[0076] The existing methods for detecting false data injection are mainly based on threshold detection based on Kalman filtering. When the working conditions remain unchanged and there are no strong external disturbances in the industrial process control system, the above methods have good effects on attack detection in industrial processes. However, in actual industrial process production, the working conditions are not static, which makes the above attack detection methods based on Kalman filtering prone to false alarms due to changes in working conditions. In addition, external disturbances are also common in industrial process control systems, and the above attack detection methods based on Kalman filtering are difficult to distinguish between external disturbances of greater intensity and actual attacks. Therefore, disturbances and changes in working conditions make the false alarm rate of existing attack detection methods higher, which is limited in practical application in attack monitoring of industrial process control systems.

[0077] Therefore, how to accurately detect whether an industrial control system is under attack based on changes in operating conditions, and avoid false warnings of attacks caused by changes in operating conditions and disturbances, so as to meet the security protection requirements of industrial control systems to a greater extent, is a difficult problem that urgently needs to be solved in the field of industrial production.

[0078] Based on the above phenomenon, various embodiments of the control system attack detection method of the present invention are proposed. It should be noted that although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than here.

[0079] First embodiment: Please refer to Figure 2 and Figure 4 , Figure 2 This is a flow chart of the first embodiment of the control system attack detection method of the present invention. Figure 4 The control system attack detection method provided by the present invention is applied to a detection system, and the detection system includes: a detection loop probe, a sensor and a controller, and includes the following steps:

[0080] Step S100, converting the real-time sensing signal emitted by the sensor based on the detection loop probe.

[0081] The converter of the detection loop probe installed in the industrial process control loop converts the real-time sensing signal sent by the sensor in real time to determine the initial content of the real-time sensing signal before the sensor transmits data to the controller.

[0082] Specifically, for example, see Figure 3 , based on the A / D converter in the detection loop probe, the sensing signal y(s) emitted by the sensor is converted in real time to obtain the corresponding discrete sensing signal y(k).

[0083] Step S200, determining disturbance parameters based on the real-time sensing signal and preset signal parameters.

[0084] The detection loop probe compares the real-time sensing signal obtained by real-time conversion with the preset signal parameters of interference under the stable operation of the industrial process control loop, and uses the difference obtained by the calculation as the disturbance parameter corresponding to the interference caused by the change in operating conditions.

[0085] Specifically, for example, see Figure 6 , the microprocessor in the detection loop probe calculates the discrete sensing signal y(k) and the preset signal parameter y m (k) and compare the disturbance parameters to obtain d(k) = y(k) - y m (k).

[0086] Step S300, sending a data packet including the real-time sensing signal, the preset signal parameters and the disturbance parameters to the controller.

[0087] The detection loop probe sends the data packet containing the real-time sensing signal, preset signal parameters and disturbance parameters stored in the storage module to the controller through the communication module for the controller to perform calculation and verification.

[0088] Step S400: Based on the controller calculating the residual parameter for the real-time sensing signal and the preset signal parameter, the residual parameter is compared with the disturbance parameter to determine whether the data packet is attacked and tampered with.

[0089] In the process of the detection loop probe sending the data packet to the controller, if the industrial process control loop is attacked, the data packet will be tampered with, thereby changing the real-time sensor signal in the data packet. After receiving the data packet, the controller calculates the real-time sensor signal in the data packet and the preset signal parameters to obtain the residual parameters, and then compares the residual parameters with the disturbance parameters to determine whether the gap between the real-time sensor signal and the preset signal parameters is caused by interference caused by changes in operating conditions or by an attack on the industrial process control loop.

[0090] Specifically, for example, a data packet containing interference parameter d(k) and real-time sensing parameter y(k) is sent to the controller through the detection loop probe. Considering that the real-time sensing parameter y(k) may be attacked by false data injection a(k) during this process, the system output data reaching the controller is recorded as y a (k) = y(k) + a(k); after receiving the data packet, the controller detects the real-time sensor signal y in the data packet. a (k) and the preset signal parameter y m (k) is calculated to obtain the residual parameter z(k), and then the residual parameter z(k) is compared with the disturbance parameter d(k) to determine whether the real-time sensor signal y(k) is consistent with the preset signal parameter y m Is the difference in (k) caused by interference caused by changes in operating conditions or by attacks on the industrial process control loop?

[0091] In this embodiment, a real-time sensing signal emitted by a sensor is converted in real time by a converter installed in a detection loop probe of an industrial process control loop to determine the initial content of the real-time sensing signal before the sensor transmits data to the controller; the detection loop probe compares the real-time sensing signal obtained by the real-time conversion with the preset signal parameters of interference under the stable operation of the industrial process control loop, and uses the difference obtained by the calculation as the disturbance parameter corresponding to the interference caused by the change in working conditions; the detection loop probe sends the data packet containing the real-time sensing signal, the preset signal parameter and the disturbance parameter stored in the storage module to the controller through the communication module for the controller to perform calculation and verification; in the process of the detection loop probe sending the data packet to the controller, if the industrial process control loop is attacked, the data packet will be tampered with, so that the real-time sensing signal in the data packet will be changed. After receiving the data packet, the controller calculates the real-time sensing signal and the preset signal parameter in the data packet to obtain the residual parameter, and then compares the residual parameter with the disturbance parameter to determine whether the difference between the real-time sensing signal and the preset signal parameter is caused by the interference caused by the change in working conditions or by the attack on the industrial process control loop.

[0092] In this way, the control system attack detection method provided by the present invention in this embodiment can accurately detect whether the industrial control system is under attack based on changes in operating conditions, and can avoid false warnings of attacks caused by changes in operating conditions and disturbances, so as to meet the security protection requirements of the industrial control system to a greater extent.

[0093] Furthermore, based on the above-mentioned first embodiment of the control system attack detection method, a second embodiment of the control system attack detection method of the present invention is proposed.

[0094] In the second embodiment of the control system attack detection method of the present invention, before the above step S200, it also includes:

[0095] Step A1, obtaining, based on the detection loop probe, a stable sensing signal emitted by the sensor and a stable control signal emitted by the controller under a stable operation condition of the industrial process control loop;

[0096] Step A2: determining the preset signal parameter based on the stable sensing signal and the stable control signal.

[0097] Please refer to Figure 5 The detection loop probe obtains historical data under the stable operation condition of the industrial process control loop, that is, the stable sensing signal emitted by the sensor and the stable control signal emitted by the controller, so as to determine the preset signal parameters representing the industrial process control loop when it is not attacked based on the stable sensing signal and the stable control signal, so as to serve as the standard parameters for comparing the real-time sensing signal during attack detection.

[0098] Furthermore, in a feasible embodiment, the above step A2 includes:

[0099] Step A21, identifying a controlled object model based on the stable sensing signal and the stable control signal.

[0100] Step A22: determining the preset signal parameters based on the controlled object model.

[0101] Please refer to Figure 5 After acquiring the historical data of the industrial process control loop under stable operation conditions, namely, stable sensing signals and stable control signals, the detection loop probe generates a controlled object model corresponding to the industrial process control loop based on the principle of converting analog quantities into digital quantities by computer operation, according to the stable sensing signals and stable control signals, and then determines the preset signal parameters representing the industrial process control loop when it is not attacked based on the controlled object model.

[0102] Furthermore, in a feasible embodiment, the above step A22 includes:

[0103] Step A221, converting the real-time control signal issued by the controller based on the detection loop probe.

[0104] Please refer to Figure 5 The converter of the detection loop probe installed in the industrial process control loop converts the real-time control signal sent by the controller in real time, so that the microprocessor of the detection loop probe can determine the preset signal parameters according to the real-time control signal.

[0105] Step A222: determining the preset signal parameters based on the controlled object model and the real-time control signal.

[0106] Please refer to Figure 5 After the detection loop probe obtains the real-time control signal through conversion, it calculates the real-time control signal and the controlled object model pre-stored in the memory, thereby determining the preset signal parameters representing the industrial process control loop when it is not attacked.

[0107] Specifically, for example, see Figure 5 The A / D converter in the detection loop probe converts the control signal u(s) and sensor signal y(s) under the stable operation of the industrial process control loop to obtain the corresponding discrete signals u(k) and y(k). Based on u(k) and y(k), the controlled object model G is identified offline. m (s), and then the controlled object model G m (s) parameter is converted to G m (z), convert the time series u(k) output by the controller into u(z), and then calculate the time series u(z) output by the controller and the controlled object model G m (z) Calculate the model output:

[0108] y m (z)=u(z)*G m (z);

[0109] Finally, y m (z) is converted into a time series y m (k), and transform the time series y m (k) As preset signal parameters representing an industrial process control loop when it is not attacked.

[0110] In this embodiment, the detection loop probe obtains historical data of the industrial process control loop under stable operation conditions, that is, the stable sensing signal emitted by the sensor and the stable control signal emitted by the controller, and based on the principle of converting analog quantities into digital quantities by computer operation, a controlled object model corresponding to the industrial process control loop is identified and generated according to the stable sensing signal and the stable control signal; then the detection loop probe obtains a real-time control signal after conversion, and performs calculations based on the real-time control signal and the controlled object model pre-stored in the memory, thereby determining preset signal parameters used to represent the industrial process control loop when it is not attacked.

[0111] In this way, the present embodiment provides steps for generating preset signal parameters representing an industrial process control loop when it is not attacked, so as to serve as standard parameters for comparing real-time sensor signals during attack detection. The operation principle involved is simple and the operation cost is low, thereby improving the practicality of the control system attack detection method of the present invention.

[0112] Furthermore, based on the above-mentioned first embodiment of the control system attack detection method, a third embodiment of the control system attack detection method of the present invention is proposed.

[0113] In the third embodiment of the control system attack detection method of the present invention, in the above step S400, the step of comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with includes:

[0114] Step S401, calculating the difference between the residual parameter and the disturbance parameter, and if the difference is within a preset threshold range, determining that the data packet has not been attacked or tampered with.

[0115] It should be noted that, in this embodiment, the preset threshold range is a numerical range subjectively set by the user according to the actual situation of the industrial process control loop, and can be expressed as a percentage of the peak value of the real-time sensor signal, where the real-time sensor signal can be temperature, pressure, flow, liquid level or concentration, etc., and no specific restrictions are made here.

[0116] After receiving the data packet sent by the detection loop probe, the controller calculates the residual parameters based on the real-time sensor signal and preset signal parameters in the data packet, and then calculates the difference between the residual parameters and the disturbance parameters. If the difference is within the numerical range subjectively set by the user based on the actual situation of the industrial process control loop, it is determined that the data packet has not been attacked or tampered with.

[0117] Specifically, for example, see Figure 7 , assuming the preset threshold range d th is 20% of the peak value of the real-time sensor signal. After receiving the data packet, the controller detects the real-time sensor signal y in the data packet. a (k) and the preset signal parameter y m (k) is calculated to obtain the residual parameter z(k), and then the residual parameter z(k) and the disturbance parameter d(k) are calculated to obtain the difference d(u). If the difference d(u) is less than or equal to 20% of the peak value of the real-time sensor signal, the difference d(u) is within the preset threshold range d th， It is determined that the data packet has not been attacked or tampered with, thereby determining that the industrial process control loop has not been attacked.

[0118] Further, in a feasible embodiment, in the above step S400, the step of comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with further includes:

[0119] Step S402: Calculate the residual parameter and the disturbance parameter to obtain a difference. If the difference exceeds a preset threshold range, it is determined that the data packet has been attacked and tampered with.

[0120] After receiving the data packet sent by the detection loop probe, the controller calculates the residual parameters based on the real-time sensor signal and preset signal parameters in the data packet, and then calculates the difference between the residual parameters and the disturbance parameters. If the difference exceeds the numerical range subjectively set by the user based on the actual situation of the industrial process control loop, it is determined that the data packet has been attacked and tampered with.

[0121] Specifically, for example, see Figure 8 , assuming the preset threshold range d th， is 20% of the peak value of the real-time sensor signal. After receiving the data packet, the controller detects the real-time sensor signal y in the data packet. a (k) and the preset signal parameter y m (k) is calculated to obtain the residual parameter z(k), and then the residual parameter z(k) and the disturbance parameter d(k) are calculated to obtain the difference d(u). If the difference d(u) exceeds 20% of the peak value of the real-time sensor signal, the difference d(u) exceeds the preset threshold range d th , it is determined that the data packet has been attacked and tampered, thereby determining that the industrial process control loop has been attacked.

[0122] Furthermore, in a feasible embodiment, after the above step S402, the following is further included:

[0123] Step S403: triggering preset alarm information based on the controller.

[0124] When the difference between the real-time sensor signal and the disturbance parameter calculated exceeds the preset threshold range and the controller determines that the industrial process control loop has been attacked, it triggers a preset alarm message to remind the user to deal with it in time; the preset alarm message includes sending an alarm message to the user terminal or making a sound alarm, and no specific restrictions are made here.

[0125] In this embodiment, after receiving the data packet sent by the detection loop probe, the controller calculates the residual parameters for the real-time sensor signal and the preset signal parameters in the data packet, and then calculates the difference between the residual parameters and the disturbance parameters. If the difference is within the numerical range subjectively set by the user according to the actual situation of the industrial process control loop, it is determined that the data packet has not been attacked or tampered with; if the difference exceeds the numerical range subjectively set by the user according to the actual situation of the industrial process control loop, it is determined that the data packet has been attacked and tampered with. After determining that the industrial process control loop has been attacked, the preset alarm information is triggered to remind the user to deal with it in time; wherein, the preset alarm information includes sending an alarm information to the user terminal or making a sound alarm, and no specific restrictions are made here.

[0126] Thus, this embodiment provides specific steps for comparing residual parameters with disturbance parameters to determine whether a data packet has been attacked and tampered with, thereby determining whether an industrial process control loop has been attacked, thereby improving the practicality of the control system attack detection method of the present invention.

[0127] In addition, for the convenience of comparative analysis, an example is given for Kalman filtering: Kalman filtering is used to detect attacks on systems in non-attacked / attacked states under changing working conditions. The residual threshold in the Kalman filter attack detection method is set to 0.1. If the absolute value of the residual exceeds the threshold, the system is considered to be attacked, such as Fig. 9 is the result of attack detection by Kalman filtering when the system is not attacked, such as Fig.10 This is the result of attack detection performed by Kalman filtering when the system is under attack. Fig. 9 It can be seen that at 100s, 150s and 200s, the residual exceeds the threshold. The attack detection method based on Kalman filtering issues attack warnings at these moments, but these warnings are actually caused by disturbances or changes in working conditions, and all of them are false warnings. Fig.10 In the attack detection based on Kalman filtering, the attack was effectively detected at 300s, but there were also Fig. 9 In contrast, the control system attack detection method performed by the detection loop probe of the present invention effectively avoids the false warning existing in the attack detection method based on Kalman filtering.

[0128] In addition, please refer to Fig.11 The embodiment of the present invention further provides a detection system, the detection system of the present invention comprises:

[0129] A detection loop probe is used to convert a real-time sensing signal sent by a sensor; determine a disturbance parameter based on the real-time sensing signal and a preset signal parameter; and send a data packet including the real-time sensing signal, the preset signal parameter and the disturbance parameter to the controller;

[0130] The controller is used to calculate a residual parameter based on the real-time sensing signal and the preset signal parameter, and compare the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with.

[0131] Preferably, the detection loop probe comprises:

[0132] An acquisition module, used for acquiring, based on the detection loop probe, a stable sensing signal emitted by the sensor and a stable control signal emitted by the controller under a stable operation condition of the industrial process control loop;

[0133] A parameter determination module is used to determine the preset signal parameter based on the stable sensing signal and the stable control signal.

[0134] Preferably, the parameter determination module includes:

[0135] A model identification unit is used to identify a controlled object model based on the stable sensing signal and the stable control signal; and to determine the preset signal parameters based on the controlled object model.

[0136] Preferably, the model identification unit comprises:

[0137] A parameter determination unit is used to convert the real-time control signal issued by the controller based on the detection loop probe; and determine the preset signal parameter based on the controlled object model and the real-time control signal.

[0138] In addition, an embodiment of the present invention also proposes a terminal device, which includes: a memory, a processor, and a control system attack detection program stored in the memory and executable on the processor, and when the control system attack detection program is executed by the processor, the steps of the control system attack detection method as described above are implemented.

[0139] Among them, the steps implemented when the control system attack detection program running on the processor is executed can refer to the various embodiments of the control system attack detection method of the present invention, and will not be repeated here.

[0140] In addition, an embodiment of the present invention also proposes a storage medium, which is applied to a computer. The storage medium can be a non-volatile computer-readable storage medium, which stores a control system attack detection program. When the control system attack detection program is executed by a processor, the steps of the control system attack detection method as described above are implemented.

[0141] Among them, the steps implemented when the control system attack detection program running on the processor is executed can refer to the various embodiments of the control system attack detection method of the present invention, and will not be repeated here.

[0142] In addition, an embodiment of the present invention further provides a computer program product, which includes a control system attack detection program. When the control system attack detection program is executed by a processor, the steps of the control system attack detection method described above are implemented.

[0143] Among them, the steps implemented when the control system attack detection program running on the processor is executed can refer to the various embodiments of the control system attack detection method of the present invention, and will not be repeated here.

[0144] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0145] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a detection system for executing a control system attack detection method to execute the methods described in each embodiment of the present invention.

[0147] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A control system attack detection method, characterized in that: The control system attack detection method is applied to a detection system, the detection system comprising: a detection loop probe, a sensor and a controller; the control system attack detection method comprises the following steps: converting a real-time sensing signal emitted by the sensor based on the detection loop probe; Determining disturbance parameters based on the real-time sensing signal and preset signal parameters; Based on the detection loop probe, a data packet including the real-time sensing signal, the preset signal parameter and the disturbance parameter is sent to the controller through a communication module; Based on the residual parameter calculated by the controller for the real-time sensing signal and the preset signal parameter, the residual parameter is compared with the disturbance parameter to determine whether the data packet is attacked and tampered; Before the step of determining the disturbance parameter based on the real-time sensing signal and the preset signal parameter, the method further includes: Based on the detection loop probe, a stable sensing signal emitted by the sensor and a stable control signal emitted by the controller are obtained under the condition that the industrial process control loop is in a stable operation state, wherein the stable operation state refers to the condition that the industrial process control loop is in a stable operation state, there is interference and no attack; Identifying a controlled object model based on the stable sensing signal and the stable control signal; Determining the preset signal parameters based on the controlled object model; The detection loop probe includes an A / D converter, and the step of obtaining the stable sensing signal emitted by the sensor and the stable control signal emitted by the controller under the stable operation condition of the industrial process control loop based on the detection loop probe includes: According to the A / D converter in the detection loop probe, the control signal u(s) and the sensor signal y(s) under the stable operation condition of the industrial process control loop are converted to obtain corresponding discrete signals u(k) and y(k), wherein the discrete signal u(k) is the stable control signal and the discrete signal y(k) is the stable sensor signal; The controlled object model is a controlled object model Gm(s), and the step of determining the preset signal parameter based on the controlled object model includes: Convert the controlled object model Gm(s) parameters into Gm(z), and convert the discrete signal u(k) into the controller output time series u(z); The model output is calculated according to the time series u(z) output by the controller and the controlled object model Gm(z) according to the following formula to obtain ym(z): ym(z)=u(z)*Gm(z); Converting the ym(z) into a time series ym(k), wherein the time series ym(k) serves as a preset signal parameter representing an industrial process control loop when it is not attacked; Wherein, the detection loop probe includes a microprocessor, the real-time sensing signal is a discrete sensing signal y(k), and the step of determining the disturbance parameter based on the real-time sensing signal and the preset signal parameter includes: In the microprocessor in the detection loop probe, a comparison operation is performed on the discrete sensing signal y(k) and the preset signal parameter ym(k) to obtain a disturbance parameter d(k)=y(k)-ym(k).

2. The control system attack detection method according to claim 1, characterized in that: The step of comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with comprises: A difference is obtained by calculating the residual parameter and the disturbance parameter. If the difference is within a preset threshold range, it is determined that the data packet has not been attacked or tampered with.

3. The control system attack detection method according to claim 1, characterized in that: The step of comparing the residual parameter with the disturbance parameter to determine whether the data packet has been attacked and tampered with also includes: A difference is obtained by calculating the residual parameter and the disturbance parameter. If the difference exceeds a preset threshold range, it is determined that the data packet has been attacked and tampered with.

4. The control system attack detection method according to claim 3, characterized in that: After the step of determining that the data packet has been attacked and tampered with, the method further includes: Preset alarm information is triggered based on the controller.

5. A detection system, characterized in that: The detection system comprises: A detection loop probe is used to convert a real-time sensing signal sent by a sensor; determine a disturbance parameter based on the real-time sensing signal and a preset signal parameter; based on the detection loop probe, send a data packet containing the real-time sensing signal, the preset signal parameter and the disturbance parameter to a controller through a communication module; A controller, configured to obtain a residual parameter based on the calculation of the controller for the real-time sensing signal and the preset signal parameter, and compare the residual parameter with the disturbance parameter to determine whether the data packet has been tampered with by an attack; The detection loop probe is further used to obtain, based on the detection loop probe, a stable sensing signal emitted by the sensor and a stable control signal emitted by the controller under a stable operation condition of the industrial process control loop, wherein the stable operation condition refers to a situation where the industrial process control loop operates smoothly, has interference and is not attacked; Identifying a controlled object model based on the stable sensing signal and the stable control signal; Determining the preset signal parameters based on the controlled object model; The detection loop probe includes an A / D converter, and the step of obtaining the stable sensing signal emitted by the sensor and the stable control signal emitted by the controller under the stable operation condition of the industrial process control loop based on the detection loop probe includes: According to the A / D converter in the detection loop probe, the control signal u(s) and the sensor signal y(s) under the stable operation condition of the industrial process control loop are converted to obtain corresponding discrete signals u(k) and y(k), wherein the discrete signal u(k) is the stable control signal and the discrete signal y(k) is the stable sensor signal; The controlled object model is a controlled object model Gm(s), and the step of determining the preset signal parameter based on the controlled object model includes: Convert the controlled object model Gm(s) parameters into Gm(z), and convert the discrete signal u(k) into the controller output time series u(z); The model output is calculated according to the time series u(z) output by the controller and the controlled object model Gm(z) according to the following formula to obtain ym(z): ym(z)=u(z)*Gm(z); Converting the ym(z) into a time series ym(k), wherein the time series ym(k) serves as a preset signal parameter representing an industrial process control loop when it is not attacked; Wherein, the detection loop probe includes a microprocessor, the real-time sensing signal is a discrete sensing signal y(k), and the step of determining the disturbance parameter based on the real-time sensing signal and the preset signal parameter includes: In the microprocessor in the detection loop probe, a comparison operation is performed on the discrete sensing signal y(k) and the preset signal parameter ym(k) to obtain a disturbance parameter d(k)=y(k)-ym(k).

6. A terminal device, characterized in that: The terminal device includes: a memory, a processor, and a control system attack detection program stored in the memory and executable on the processor. When the control system attack detection program is executed by the processor, the steps of the control system attack detection method as described in any one of claims 1 to 4 are implemented.

7. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the control system attack detection method according to any one of claims 1 to 4 are implemented.

Images