An industrial control abnormal equipment positioning method based on a multi-section dendritic network

Abstract

The application provides an industrial control abnormal equipment positioning method and system based on a multi-section dendritic network. The method collects physical layer equipment data in an abnormal time period of an industrial control system, then uses a front-section dendritic network to train an overall abnormal model of the industrial control system, extracts overall abnormal features of the industrial control system from the overall abnormal model of the industrial control system, uses the overall abnormal features of the industrial control system to reduce dimensions of the physical layer equipment data, puts the reduced data into middle and rear-section dendritic networks for learning, obtains an industrial control system risk area model and an industrial control system abnormal area model and extracts features, performs feature analysis to obtain an industrial control system abnormal area physical layer equipment relationship spectrum, and finally obtains abnormal equipment by using the industrial control system abnormal area physical layer equipment relationship spectrum. The system comprises a model training module, a feature extraction module, a feature analysis module, a data dimension reduction module and an equipment positioning module.

Description

Technical Field

[0001] This invention belongs to the fields of information security of industrial control systems and location of abnormal equipment in industrial control systems. Background Technology

[0002] Industrial control system information security is a branch of industrial information security and a rapidly developing technology in recent years. It is a new interdisciplinary field integrating information security technology and industrial automation control technology, encompassing national infrastructure security, defense security, and economic security, and profoundly impacting the development of my country's intelligent manufacturing industry, smart city construction, and public safety. Since the topic of industrial control system information security was first raised by industry professionals, the concept of industrial control system information security protection has undergone a series of developments and evolutions. From terminal security protection based on isolation, to boundary security protection based on defense in depth, it has gradually developed into a continuous defense system characterized by the inherent security of the industrial control system. This not only requires coverage of different defense layers and the coordinated use of multiple technologies, but also emphasizes the ability to discover hidden dangers, manage threats, predict threats, and proactively remediate them.

[0003] Key technologies for information security in industrial control systems mainly include industrial control system vulnerability mining and analysis technology, industrial control data acquisition and fusion analysis technology, industrial control system threat monitoring and early warning technology, and industrial control system attack forensics and tracing technology.

[0004] Anomaly location technology for industrial control systems (ICS) primarily refers to the location and identification of physical layer devices whose operating states have abnormally changed after an attack on the ICS. It is a crucial technical safeguard against catastrophic accidents after an attack on the ICS and an important technique for analyzing unknown attack behaviors. It is a vital component of ICS information security technology.

[0005] The technology for locating abnormal devices in industrial control systems is mainly helpful for threat monitoring and early warning technology of industrial control systems, as well as for forensic investigation and tracing technology of industrial control system attacks.

[0006] The main problems with current abnormal device location technology include: poor location effect, different methods for different industrial control systems, poor portability, difficulty in locating highly complex industrial control systems, and low location efficiency.

[0007] This invention enables rapid and accurate location of faulty devices and possesses strong portability, making it applicable to various industrial control systems. Compared to faulty device location methods based on dendritic networks, it solves the problems of inaccurate location, long location time, and dimensional explosion in complex industrial control systems caused by dendritic networks. Summary of the Invention

[0008] To improve the rapid response and handling capabilities of industrial control systems (ICS) after an attack, this invention provides a method for locating abnormal ICS devices based on a multi-segment dendritic network. It can quickly and accurately locate abnormal devices after an ICS attack, facilitating timely and appropriate responses from administrators to mitigate losses and prevent major security incidents. It also aids in the recovery of the ICS from the attack and provides crucial information for post-attack analysis. This method belongs to the category of location methods based on physical layer device and object state models. It then utilizes a multi-segment dendritic network to learn the attack states of individual devices and related devices, thereby locating physical layer devices exhibiting abnormal states.

[0009] A method for locating abnormal industrial control equipment based on multi-segment dendritic networks, the method comprising the following steps:

[0010] Step 1: Data collection and preprocessing;

[0011] Step 2: Input the data processed in Step 1 into the front-end dendritic network for training to obtain the trained model;

[0012] Step 3: Extract feature information from the trained model obtained in Step 2;

[0013] Step 4: Parse the feature information into a relation spectrum;

[0014] Step 5: Analyze the relation spectrum and perform dimensionality reduction on the preprocessed data;

[0015] Step 6: Input the processed data into the mid-section dendritic network for training, obtain the trained model, extract feature information, analyze the information features, and use them to further reduce the dimensionality of the data;

[0016] Step 7: Input the further processed data into the subsequent dendritic network for training, obtain the trained model, extract feature information, analyze the information features, and obtain the final abnormal device relationship spectrum;

[0017] Step 8: Analyze the abnormal device relationship spectrum to obtain the abnormal devices;

[0018] Furthermore, the specific process for step 1 is as follows: Real-time data acquisition and monitoring of the industrial control system's field equipment is collected using a Supervisory Control and Data Acquisition (SCADA) system. The data from each device is treated as a feature to obtain multi-dimensional time-series data. Simultaneously, to accelerate model convergence and avoid the influence of data dimensions, the data is normalized.

[0019] Furthermore, the specific process for step 2 is as follows: A front-end dendritic network model is selected to process the operating status data of the field equipment in the industrial control system. The Adam optimizer and CrossEntropyLoss loss function are selected to train the model and obtain the abnormal operating modes of the industrial control system.

[0020] An industrial control anomaly equipment localization system based on a multi-segment dendritic network is disclosed. The system includes a model training module, a feature extraction module, a feature parsing module, a data dimensionality reduction module, and an equipment localization module.

[0021] Model training module: This module contains multiple dendritic networks. The first dendritic network collects raw state data of physical layer devices during abnormal periods of the industrial control system (ICS) and trains it to obtain an overall abnormal model of the ICS. The middle and later dendritic networks utilize the dimensionality-reduced, high-weight ICS physical layer device data to train a risk region model and an abnormal region model of the ICS.

[0022] Feature extraction module: The feature extraction module extracts feature information from the trained industrial control system model.

[0023] Feature parsing module: The feature parsing module parses the device feature information in the model and transforms it into a physical layer device relationship spectrum of the industrial control system.

[0024] Data Dimensionality Reduction Module: The data dimensionality reduction module uses the physical layer device relationship spectrum of the industrial control system obtained by the feature parsing module to extract the high-weight physical layer devices of the industrial control system, thereby reducing the dimensionality of the original data. This facilitates subsequent processing by highly complex back-end dendritic networks and prevents dimensionality explosion when processing highly complex industrial control systems.

[0025] Device location module: The device location module performs maximum and minimum value processing on the physical layer device relationship spectrum of the final abnormal area of ​​the industrial control system and maps it to abnormal physical devices of the industrial control system. This makes it convenient for administrators to quickly locate abnormal devices, take timely measures to stop losses and restore status, and perform attack analysis after being attacked. Attached Figure Description

[0026] Figure 1 A system for locating abnormal industrial control equipment based on a multi-segment dendritic network.

[0027] Figure 2 Basic dendritic network structure diagram.

[0028] Figure 3 Relationship spectrum. Detailed Implementation

[0029] The present invention will now be described in further detail with reference to the accompanying drawings.

[0030] Specific Implementation Method 1: This implementation method is illustrated with reference to the figures. Specifically, it is an industrial control anomaly equipment location system based on a multi-segment dendritic network. The method includes the following steps:

[0031] Step 1: Data collection and preprocessing;

[0032] Data collection originates from physical layer data during abnormal time periods marked by the industrial control system's safety monitoring system, specifically collected through the Supervisory Control and Data Acquisition (SCADA) system. Each physical layer device data point of the industrial control system is treated as a variable. To accelerate model convergence and avoid the influence of physical dimensions, the data across all dimensions is normalized using the min-max method, mapping it to the range [0,1]. The mapping formula is as follows.

[0033]

[0034] Where x is an attribute value in the original data, x min This represents the minimum value in the attribute, x. max This represents the maximum value in the attribute, x. after This represents the attribute value after normalization, and its value range is between [0,1].

[0035] Step 2: Input the data processed in Step 1 into the front-end dendritic network for training to obtain the trained model;

[0036] The front-end dendritic network structure diagram is as follows: Figure 2 As shown, the small dark spheres represent attribute values ​​after normalization, and the large dark spheres represent dendritic network neurons. The Adam optimizer and CrossEntropyLoss loss function are selected to train the model.

[0037] Step 3: Extract feature information from the trained model obtained in Step 2;

[0038] Extract the dendritic network weight matrix from the trained model. The number of matrices is equal to the number of network layers.

[0039] Step 4: Parse the feature information into a relation spectrum;

[0040] The physical layer devices are labeled x1, x2, x3, x4, ..., with the number of variables being the number of devices plus 1. This is then substituted into the mathematical expression of the dendritic network, as shown below (using a three-dimensional three-layer dendritic network as an example):

[0041]

[0042] Expand the mathematical expression, extract the coefficients, and plot the relation spectrum. The relation spectrum is then compared with... Figure 3 similar.

[0043] Step 5: Analyze the relation spectrum and perform dimensionality reduction on the preprocessed data;

[0044] The key equipment of the industrial control system is extracted from the relation spectrum, and the non-key equipment is removed, thereby achieving data dimensionality reduction.

[0045] Steps 6, 7, and 8 are similar to steps 2, 3, 4, and 5, and will not be repeated here.

[0046] Specific Implementation Method Two: Combining Figure 1 This embodiment describes a system for locating abnormal industrial control equipment based on a multi-segment dendritic network. The system includes a model training module, a feature extraction module, a feature parsing module, a data dimensionality reduction module, and an equipment location module.

[0047] Model training module: This module contains multiple dendritic networks. The first dendritic network collects raw state data of physical layer devices during abnormal periods of the industrial control system (ICS) and trains it to obtain an overall abnormal model of the ICS. The middle and later dendritic networks utilize the dimensionality-reduced, high-weight ICS physical layer device data to train a risk region model and an abnormal region model of the ICS.

[0048] Feature extraction module: The feature extraction module extracts feature information from the trained industrial control system model. It also extracts the weights from the model.

[0049] Feature parsing module: The feature parsing module parses the device feature information in the model, substitutes it into the dendritic network expression, performs factor expansion and merging, and transforms it into the physical layer device relationship spectrum of the industrial control system.

[0050] Data Dimensionality Reduction Module: The data dimensionality reduction module uses the physical layer device relationship spectrum of the industrial control system obtained by the feature parsing module to extract the high-weight physical layer devices of the industrial control system, thereby reducing the dimensionality of the original data. This facilitates subsequent processing by highly complex back-end dendritic networks and prevents dimensionality explosion when processing highly complex industrial control systems.

[0051] Equipment Location Module: The equipment location module performs maximum / minimum value processing on the physical layer equipment relationship spectrum of the final obtained abnormal area of ​​the industrial control system and maps it to abnormal physical devices in the industrial control system. The above description is merely a preferred embodiment of the present invention. These specific embodiments are different implementations based on the overall concept of the present invention, and the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A system for locating abnormal industrial control equipment based on a multi-segment dendritic network, characterized in that, The system comprises five modules: Model training module: The model training module contains multiple dendritic networks of different types. The first dendritic network collects the original state data of the physical layer devices during the abnormal time period of the industrial control system and trains the overall abnormal model of the industrial control system. The middle and last dendritic networks use the dimensionality-reduced high-weight physical layer device data of the industrial control system to train the risk area model and the abnormal area model of the industrial control system. Feature extraction module: The feature extraction module uses a front-end dendritic network to train and obtain an overall anomaly model of the industrial control system to extract feature information, i.e., the weights in the model; Feature parsing module: The feature parsing module parses the device feature information in the model, substitutes it into the dendritic expression of the dendritic network, performs factor expansion and merging, extracts coefficients, and transforms it into the physical layer device relationship spectrum of the industrial control system; Data Dimensionality Reduction Module: The data dimensionality reduction module uses the physical layer device relationship spectrum of the industrial control system obtained by the feature parsing module to extract the high-weight physical layer devices of the industrial control system, thereby reducing the dimensionality of the original data, which facilitates the subsequent processing of highly complex back-end dendritic networks and prevents dimensionality explosion when processing highly complex industrial control systems. Equipment location module: The equipment location module performs maximum and minimum value processing on the physical layer equipment relationship spectrum of the final abnormal area of ​​the industrial control system, and maps it to the abnormal physical equipment of the industrial control system.

2. The industrial control anomaly equipment location system based on a multi-segment dendritic network according to claim 1, characterized in that: A multi-segment dendritic network, where each segment of the dendritic network has two characteristics: the network dimension n and the number of network layers m; where the network dimension is the same for each layer of the dendritic network.

3. The industrial control anomaly equipment location system based on a multi-segment dendritic network according to claim 1, characterized in that: The physical layer devices of the industrial control system are mapped as symbolic variables, and according to the weights, they are substituted into the mathematical expression of the multi-segment network and expanded into a multidimensional Taylor series. Then, the relationship spectrum of the physical layer devices of the industrial control system is drawn according to the coefficients of the multidimensional Taylor series.

4. The industrial control anomaly equipment location system based on a multi-segment dendritic network according to claim 1, characterized in that: The maximum and minimum values ​​of the physical layer device relationship spectrum in the abnormal region of the industrial control system are processed to obtain its corresponding polynomial. Based on the weight, it is then back-mapped to the specific abnormal physical device in the industrial control system.

5. The industrial control anomaly equipment location system based on a multi-segment dendritic network according to claim 2, characterized in that: The original industrial control system is dimensionality reduced using mid-stage dendritic networks, and multidimensional Taylor simulation of the industrial control system is performed using rear-stage dendritic networks.

Images