A threat detection method and device for an industrial control network

Abstract

The application discloses a kind of threat detection method and device of industrial control network.The method comprises: obtaining a plurality of target characteristic parameters in industrial control network, determining the feature mutual information value between every two target characteristic parameters, according to a plurality of feature mutual information values, determine state fusion index, utilize pre-trained threat detection model to the state fusion index is threat detection.So, by a plurality of feature mutual information values determine state fusion index, i.e. using state fusion index reflects the state of industrial control network, without again establishing threat feature database, then using threat detection model to the state fusion index is threat detection, realize the automation detection industrial control network.And once threat occurs, it can be detected, avoids the hysteresis of threat detection, improves the efficiency of threat detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a threat detection method and device for industrial control network. BACKGROUND

[0002] With the development of network technology, the industrial control network of city water affairs, transportation, power and the like becomes more and more intelligent and convenient. However, with the informatization and networking of the industrial control network, threats such as attacks on the industrial control network are generated.

[0003] In the prior art, in order to detect the threats existing in the industrial control network, a method of establishing a threat feature library is adopted, that is, all known industrial control network threats are established corresponding threat feature portraits, and the threat feature portraits are stored in the threat feature library. The industrial control network is detected, and once an event conforming to the threat feature portrait in the threat feature library is found, it is considered that a threat occurs. However, this method of establishing a threat feature library can only detect the threats whose threat feature portraits exist in the threat feature library, and can only detect the threats whose threat feature portraits exist in the threat feature library when the threats completely occur or completely conform to the threat feature portraits. The threat detection has a lag, and the detection efficiency is low.

[0004] Therefore, the threat detection of the industrial control network has a lag and low detection efficiency, which is a technical problem to be solved by those skilled in the art. SUMMARY

[0005] In view of the above problems, the present application provides a threat detection method and device for industrial control network to solve the problems of lag and low detection efficiency of threat detection.

[0006] The embodiments of the present application disclose the following technical solutions:

[0007] In a first aspect, the embodiments of the present application provide a threat detection method for industrial control network, comprising:

[0008] obtaining a plurality of target feature parameters in the industrial control network;

[0009] determining a feature mutual information value between each two target feature parameters;

[0010] determining a state fusion index according to a plurality of feature mutual information values;

[0011] performing threat detection on the state fusion index by using a pre-trained threat detection model.

[0012] Optionally, the plurality of target feature parameters in the industrial control network are obtained by the following steps:

[0013] obtaining a plurality of feature parameters in the industrial control network;

[0014] determining an importance evaluation factor between two adjacent feature parameters, to obtain a plurality of importance evaluation factors;

[0015] constructing a judgment matrix according to the plurality of importance evaluation factors;

[0016] determining a consistency index of the judgment matrix according to a maximum eigenvalue of the judgment matrix;

[0017] judging whether the consistency index meets a preset consistency index range;

[0018] If yes, performing importance ranking on the plurality of feature parameters according to an eigenvector of the maximum eigenvalue of the judgment matrix;

[0019] determining a preset number of feature parameters as a plurality of target feature parameters according to the importance ranking result.

[0020] Optionally, the determining of the feature mutual information value between each two target feature parameters comprises:

[0021] determining information entropy and conditional entropy between each two target feature parameters;

[0022] obtaining the feature mutual information value between each two target feature parameters by using the information entropy and the conditional entropy.

[0023] Optionally, the determining of the state fusion index according to the plurality of feature mutual information values comprises:

[0024] determining a label mutual information value between each target feature parameter and a preset class label, to obtain a plurality of label mutual information values;

[0025] determining the state fusion index according to the plurality of target feature parameters, the plurality of label mutual information values, the plurality of feature mutual information values and the preset class label.

[0026] Optionally, the pre-trained threat detection model is obtained by training in the following manner:

[0027] obtaining a training state fusion index and a label set corresponding to the training state fusion index;

[0028] dividing the training state fusion index and the label set into two parts according to a preset proportion, one part as a training set and the other part as a verification set;

[0029] inputting the training set into a to-be-trained threat detection model;

[0030] performing threat detection on the training set by using the to-be-trained threat detection model, and obtaining a training detection result;

[0031] verify the training detection result by using the verification set; if the verification result accords with a preset verification result, training of the to-be-trained threat detection model is completed; if the verification result does not accord with the preset verification result, parameters of the to-be-trained threat detection model are adjusted, and the to-be-trained threat detection model is trained by using a new training state fusion index.

[0032] In a second aspect, the embodiments of the present application provide a threat detection device for an industrial control network, which comprises a target feature parameter acquisition module, a feature mutual information value determination module, a state fusion index determination module and a threat detection module.

[0033] The target feature parameter acquisition module is configured to acquire a plurality of target feature parameters in the industrial control network.

[0034] The feature mutual information value determination module is configured to determine a feature mutual information value between each two target feature parameters.

[0035] The state fusion index determination module is configured to determine a state fusion index according to the plurality of feature mutual information values.

[0036] The threat detection module is configured to perform threat detection on the state fusion index by using a pre-trained threat detection model.

[0037] Optionally, the target feature parameter acquisition module comprises:

[0038] The feature parameter acquisition module is configured to acquire a plurality of feature parameters in the industrial control network.

[0039] The importance evaluation factor determination module is configured to determine an importance evaluation factor between adjacent two feature parameters, thereby obtaining a plurality of importance evaluation factors.

[0040] The judgment matrix construction module is configured to construct a judgment matrix according to the plurality of importance evaluation factors.

[0041] The consistency index determination module is configured to determine a consistency index of the judgment matrix according to a maximum eigenvalue of the judgment matrix.

[0042] The judgment module is configured to judge whether the consistency index accords with a preset consistency index range.

[0043] The sorting module is configured to, if the consistency index accords with the preset consistency index range, sort the plurality of feature parameters according to a feature vector of the maximum eigenvalue of the judgment matrix.

[0044] The target feature parameter acquisition submodule is configured to determine a preset number of feature parameters as the plurality of target feature parameters according to the importance sorting result.

[0045] Optionally, the feature mutual information value determination module comprises:

[0046] an entropy value determination module configured to determine information entropy and conditional entropy between each two target feature parameters;

[0047] a feature mutual information value determination submodule configured to obtain a feature mutual information value between each two target feature parameters by using the information entropy and the conditional entropy.

[0048] Optionally, the state fusion index determination module comprises:

[0049] a label mutual information value determination module configured to determine a label mutual information value between each target feature parameter and a preset class label to obtain a plurality of label mutual information values;

[0050] a state fusion index determination submodule configured to determine a state fusion index according to the plurality of target feature parameters, the plurality of label mutual information values, the plurality of feature mutual information values and the preset class label.

[0051] Optionally, the pre-trained threat detection model is obtained by training in the following manner:

[0052] an acquisition module configured to acquire a training state fusion index and a label set corresponding to the training state fusion index;

[0053] a training set and validation set determination module configured to divide the training state fusion index and the label set into two parts according to a preset ratio, one part as a training set and the other part as a validation set;

[0054] an input module configured to input the training set into a threat detection model to be trained;

[0055] a training detection result acquisition module configured to perform threat detection on the training set by using the threat detection model to be trained, and obtain a training detection result;

[0056] a training module configured to verify the training detection result by using the validation set; if a verification result conforms to a preset verification result, the training of the threat detection model to be trained is completed; if the verification result does not conform to the preset verification result, parameters of the threat detection model to be trained are adjusted, and the threat detection model to be trained is trained by using a new training state fusion index.

[0057] Compared with the prior art, the present application has the following beneficial effects:

[0058] The application obtains a plurality of target feature parameters in an industrial control network, determines a feature mutual information value between each two target feature parameters, determines a state fusion index according to the plurality of feature mutual information values, and performs threat detection on the state fusion index by using a pre-trained threat detection model. The state fusion index is determined by the plurality of feature mutual information values, that is, the state fusion index is used to reflect the state of the industrial control network, and a threat feature database does not need to be established. Then, the threat detection model is used to perform threat detection on the state fusion index, so that the industrial control network is automatically detected. Once a threat occurs, it can be detected, the hysteresis of threat detection is avoided, and the efficiency of threat detection is improved. BRIEF DESCRIPTION OF DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0060] Figure 1 A flowchart of a threat detection method of an industrial control network provided by an embodiment of the present application;

[0061] Figure 2 A structural schematic diagram of a threat detection device of an industrial control network provided by an embodiment of the present application. DETAILED DESCRIPTION

[0062] As described above, the inventors found in the research on the threats of industrial control networks that, in the prior art, in order to detect the threats existing in the industrial control network, a threat feature library is established, all known industrial control network threats are established corresponding threat feature portraits, and the threat feature portraits are stored in the threat feature library. The industrial control network is detected, and once an event consistent with the threat feature portrait in the threat feature library is found, it is considered that a threat occurs. However, this method of establishing a threat feature library can only detect the threats whose threat feature portraits exist in the threat feature library, and can only detect the threats whose threat feature portraits completely occur or completely conform to the threat feature portrait. The threat detection has hysteresis, and the detection efficiency is low.

[0063] In order to solve the above problems, an embodiment of the present application provides a threat detection method of an industrial control network. The method comprises the following steps: obtaining a plurality of target feature parameters in an industrial control network, determining a feature mutual information value between each two target feature parameters, determining a state fusion index according to the plurality of feature mutual information values, and performing threat detection on the state fusion index by using a pre-trained threat detection model.

[0064] Thus, the state fusion index is determined through the plurality of feature mutual information values, that is, the state of the industrial control network is reflected by using the state fusion index, a threat feature database does not need to be established, and then the state fusion index is subjected to threat detection by using a threat detection model, so that the industrial control network is automatically detected. Once a threat occurs, the threat can be detected, the hysteresis of threat detection is avoided, and the efficiency of threat detection is improved.

[0065] In order to enable personnel in the technical field to better understand the scheme of the present application, the technical scheme in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0066] Figure 1 A flowchart of the threat detection method of the industrial control network provided by the embodiments of the present application is shown in Figure 1 The threat detection method of the industrial control network provided by the embodiments of the present application can include the following steps.

[0067] S101: Obtain a plurality of target feature parameters in an industrial control network.

[0068] As an implementable embodiment, step S101 can specifically include the following steps.

[0069] Step one: Obtain a plurality of feature parameters in an industrial control network.

[0070] The feature parameters in the industrial control network can include asset state, asset vulnerability, traffic information, port opening information, device connection relationship, asset system log, security device log, event comprehensive analysis data, and the like, but are not limited to the above parameters, and the specific types of the feature parameters are not limited herein.

[0071] The feature parameters to be obtained can be determined according to historical threat data, including but not limited to using historical threats to determine the feature parameters, and can also use experimental data or engineering network library or threat database, and the like, which are not limited herein.

[0072] Step two: Determine an importance evaluation factor between two adjacent feature parameters to obtain a plurality of importance evaluation factors.

[0073] Step three: Construct a judgment matrix according to the plurality of importance evaluation factors.

[0074] The constructed matrix can be an n-order matrix, and n represents the number of feature parameters.

[0075] In the step two and the step three, the importance factor and the construction of the judgment matrix can be achieved by using the scale method, including but not limited to using the scale method, and other methods can also be used, which are not specifically limited here.

[0076] In the step four, the consistency index of the judgment matrix is determined according to the maximum eigenvalue of the judgment matrix.

[0077] In the step five, it is determined whether the consistency index meets the preset consistency index range.

[0078] The preset consistency index range can be the range of random consistency index, including but not limited to using the range of random consistency index as the judgment standard, which is not specifically limited here.

[0079] In the step six, if it meets, the importance of the multiple characteristic parameters is sorted according to the eigenvector of the maximum eigenvalue of the judgment matrix.

[0080] Specifically, when the consistency index meets the preset consistency index range, the importance of the multiple characteristic parameters relative to the target layer is sorted according to the eigenvector of the maximum eigenvalue of the judgment matrix.

[0081] When the analytic hierarchy process (AHP) is used to determine the target characteristic parameter, it is divided into three levels (target layer, criterion layer, and scheme layer), and the target layer is the layer containing the important parameters of the industrial control network security.

[0082] In the step seven, the preset number of characteristic parameters are determined as the multiple target characteristic parameters according to the importance sorting result.

[0083] As an implementable embodiment, when the step S101 uses the analytic hierarchy process to determine the target characteristic parameter, the specific process of the steps two to seven can be achieved by the following way:

[0084] First, the judgment matrix is constructed according to the importance evaluation factor.

[0085] For the construction of the judgment matrix, the relative scale method can be used to reduce the difficulty of comparing different factors as much as possible, to make quantitative determination while qualitative, so as to improve the accuracy.

[0086] The M characteristic parameters are respectively represented as evaluation factors x1, x2, x3, …, x m , and the scale table shown in Table 1 is used to construct the judgment matrix.

[0087] Table 1 Scale table

[0088]

[0089] Evaluation factors x1, x2, x3,..., x m After scaling by the scale table shown in Table 1 above, the judgment matrix elements are obtained, denoted as x ij The properties of the judgment matrix elements can be determined using the following formula:

[0090]

[0091] where x ii The value of the ith row and the ith column in the judgment matrix is 1, and according to the above properties, the following judgment matrix A is obtained, as shown in Table 2:

[0092] Table 2 Judgment matrix A

[0093]

[0094] The characteristic vector of the largest eigenvalue λ max in the above judgment matrix A is determined, and after normalization processing (making the sum of each element in the vector equal to 1), it is recorded as W. The matrix elements of W are the ranking weights of the relative importance of the same level matrix elements to certain matrix elements in the previous level matrix elements. This process is called hierarchical single sorting, and in this embodiment, only the upper two layers of the three-layer matrix elements are taken.

[0095] After obtaining the matrix elements, a consistency index CI can be defined:

[0096]

[0097] where CI represents the consistency index, and n represents the order of the judgment matrix A.

[0098] Where CI = 0, it has complete consistency; CI close to 0, has satisfactory consistency; the larger CI, the more serious inconsistency.

[0099] In order to measure the size of CI, a random consistency index RI is introduced, and the random consistency index RI is shown in Table 3 as follows:

[0100] Table 3 Random consistency index RI

[0101]

[0102] Based on the above Table 3, the consistency ratio CR is defined as:

[0103]

[0104] When the consistency ratio CR is less than 0.1, it is considered that the inconsistency degree of the judgment matrix A is within the allowable range, and there is satisfactory consistency, which passes the consistency test, and the corresponding normalized eigenvector can be used as the weight vector. Otherwise, the x ij needs to be adjusted, and the judgment matrix is reconstructed.

[0105] The feature parameters corresponding to the qualified weight vectors are sorted in descending order, and a preset number of feature parameters are taken as target feature parameters.

[0106] The preset number can be one or more, which is not specifically limited here, and the specific number of target feature parameters can be determined according to actual conditions.

[0107] The target feature parameters are determined through the above embodiments, and subsequent target feature parameters can be directly obtained in the industrial control network without the need to repeatedly determine the target feature parameters. Moreover, by determining the target feature parameters, the threat feature library feature portrait can no longer be relied on, and only the target feature parameters in the industrial control network need to be collected or obtained to perform threat detection on the industrial control network, thereby avoiding the lag of threat detection and improving the efficiency of threat detection.

[0108] S102: Determine the feature mutual information value between each two target feature parameters.

[0109] As an implementable embodiment, step S102 can be implemented in the following manner:

[0110] Determine the information entropy and the conditional entropy between each two target feature parameters; and obtain the feature mutual information value between each two target feature parameters by using the information entropy and the conditional entropy.

[0111] As an implementable embodiment, the feature mutual information value is determined by determining the information entropy and the conditional entropy between each two target feature parameters, which can be implemented in the following manner:

[0112] First, the target feature parameters obtained in step S101 are subjected to feature extraction, and a feature set u (which can include flow, log, event analysis parameters, etc.) is established.

[0113] Second, the feature set u can be fused by using a maximum relevance minimum redundancy algorithm (MRMR algorithm), and the specific steps are as follows:

[0114] (1) Construct the information entropy between two target feature parameters.

[0115] Suppose p(x) is the probability of the target feature parameter X taking the value x, and the information entropy can be expressed as:

[0116]

[0117] (2) Determine the conditional entropy of the target feature parameter X under the given feature value Y, which can be expressed as:

[0118]

[0119] Where p(x, y) is the joint probability distribution of random variables X and Y, and p(x|y) is the conditional probability distribution of X given Y.

[0120] (3) Calculate the mutual information value between each two target feature parameters according to the information entropy and conditional entropy obtained in steps (1) and (2).

[0121] The mutual information value can be expressed as:

[0122]

[0123] Where the mutual information value can represent the correlation between two target feature parameters. In this embodiment, the target features in the optimal feature subset satisfy the maximum correlation between features and categories and the minimum correlation between features, i.e., the minimum redundancy maximum correlation criterion.

[0124] S103: Determine the state fusion index according to the plurality of feature mutual information values.

[0125] As an implementable embodiment, step S103 can specifically include:

[0126] Determine the label mutual information value between each target feature parameter and the preset class label to obtain a plurality of label mutual information values;

[0127] Determine the state fusion index according to the plurality of target feature parameters, the plurality of label mutual information values, the plurality of feature mutual information values, and the preset class label.

[0128] As an implementable embodiment, the determination process of the state fusion index can be realized by the following way:

[0129] Suppose there is a feature set S and a class label set F, where the feature set S contains a plurality of target feature parameters, and the maximum correlation minimum redundancy algorithm is used to process the feature set S to obtain an optimal feature subset s, which can be obtained by using the following two formulas:

[0130] (1) Calculate the correlation between the feature set S and the class label set F, which is the average value of all label mutual information values between each target feature parameter x i and the class label set F classification variable:

[0131]

[0132] (2) The redundancy of all target feature parameters in the set S is the average value of all feature mutual information values between the target feature parameters x i and the target feature parameters y j

[0133]

[0134] wherein D represents the label mutual information value between the target feature parameters and the class label, R represents the mutual information value between the features, and |s| represents the number of the feature subset s.

[0135] Through the above two formulas, the feature mutual information value between each two target feature parameters and the label mutual information value between each target feature parameter and the class label are calculated respectively, and the maximum relevance minimum redundancy algorithm is used to remove the feature indicators with the largest difference in value, so as to obtain an optimal feature subset, which is used as a state fusion indicator.

[0136] wherein the target feature parameters with poor correlation or large redundancy are removed by processing a plurality of target feature parameters, and the remaining plurality of target feature parameters are used as state fusion indicators, which can improve the accuracy of subsequent threat detection.

[0137] wherein the redundancy information is automatically removed in the process of obtaining the state fusion indicator, while the diversity of information in the state representation is retained, the state fusion comprehensive indicator for accurately representing the state of the industrial control network security is established, and the disadvantage of single dependence on the feature library is avoided.

[0138] S104: performing threat detection on the state fusion indicator by using a pre-trained threat detection model.

[0139] wherein as an implementable embodiment, the pre-trained threat detection model can be obtained by training in the following manner:

[0140] Step 1: obtaining training state fusion indicators and a label set corresponding to the training state fusion indicators.

[0141] Step 2: dividing the training state fusion indicators and the label set into two parts according to a preset proportion, one part as a training set and the other part as a validation set.

[0142] Step 3: inputting the training set into a threat detection model to be trained.

[0143] Step 4: performing threat detection on the training set by using the threat detection model to be trained, and obtaining a training detection result.

[0144] ​Step 5: verifying the training detection result by using the verification set; if the verification result meets the preset verification result, the training of the to-be-trained threat detection model is completed; if the verification result does not meet the preset verification result, the parameters of the to-be-trained threat detection model are adjusted, and the to-be-trained threat detection model is trained by using a new training state fusion index.

[0145] The pre-trained threat detection model obtained through steps 1-5 can make the accuracy of the threat detection model higher when detecting the industrial control network.

[0146] The threat detection model detects the state fusion index, and the state fusion index can reflect the situation of the industrial control network. If the state fusion index is detected by the threat detection model and it is found that the values or features are different from those of the normal industrial control network, it is considered that a threat may occur. Unlike the prior art, which identifies threats in the industrial control network by comparing threat feature portraits, it does not need to establish a threat feature portrait, nor does it need to wait until the threat is completely occurring or completely consistent with the threat feature portrait to identify the threat. In this application, the threat can be detected as soon as it occurs, avoiding the lag of detection.

[0147] The threat detection method for the industrial control network provided by the embodiments of the present application acquires a plurality of target feature parameters in the industrial control network, determines a feature mutual information value between each two target feature parameters, determines a state fusion index according to a plurality of feature mutual information values, and detects the state fusion index by using a pre-trained threat detection model. The state fusion index is determined by using a plurality of feature mutual information values, i.e., the state fusion index is used to reflect the state of the industrial control network, and there is no need to establish a threat feature database, and then the state fusion index is detected by using the threat detection model to realize automatic detection of the industrial control network. Once a threat occurs, it can be detected, avoiding the lag of threat detection and improving the efficiency of threat detection.

[0148] Based on the threat detection method for the industrial control network provided in the above embodiments, the embodiments of the present application also provide a threat detection device for an industrial control network, which is described with reference to Figure 2 , Figure 2 The structure diagram of the threat detection device for the industrial control network provided by the embodiments of the present application is shown in combination with Figure 2 The device 200 can include:

[0149] The target feature parameter acquisition module 201 is configured to acquire a plurality of target feature parameters in the industrial control network.

[0150] The feature mutual information value determination module 202 is configured to determine a feature mutual information value between each two target feature parameters.

[0151] The state fusion index determination module 203 is configured to determine a state fusion index according to the plurality of feature mutual information values.

[0152] The threat detection module 204 is configured to perform threat detection on the state fusion index by using a pre-trained threat detection model.

[0153] As an implementable embodiment, the target feature parameter acquisition module 201 can include:

[0154] The feature parameter acquisition module is configured to acquire a plurality of feature parameters in the industrial control network.

[0155] The importance evaluation factor determination module is configured to determine an importance evaluation factor between two adjacent feature parameters, to obtain a plurality of importance evaluation factors.

[0156] The judgment matrix construction module is configured to construct a judgment matrix according to the plurality of importance evaluation factors.

[0157] The consistency index determination module is configured to determine a consistency index of the judgment matrix according to a maximum eigenvalue of the judgment matrix.

[0158] The judgment module is configured to judge whether the consistency index meets a preset consistency index range.

[0159] The sorting module is configured to, if the consistency index meets the preset consistency index range, perform importance sorting on the plurality of feature parameters according to an eigenvector of the maximum eigenvalue of the judgment matrix.

[0160] The target feature parameter acquisition submodule is configured to determine a preset number of feature parameters as a plurality of target feature parameters according to the importance sorting result.

[0161] As an implementable embodiment, the feature mutual information value determination module 202 can include:

[0162] The entropy value determination module is configured to determine information entropy and conditional entropy between every two target feature parameters.

[0163] The feature mutual information value determination submodule is configured to obtain a feature mutual information value between every two target feature parameters by using the information entropy and the conditional entropy.

[0164] As an implementable embodiment, the state fusion index determination module 203 can include:

[0165] The label mutual information value determination module is configured to determine a label mutual information value between each target feature parameter and a preset class label, to obtain a plurality of label mutual information values.

[0166] The state fusion index determination sub-module is configured to determine a state fusion index according to the plurality of target feature parameters, the plurality of label mutual information values, the plurality of feature mutual information values, and a preset class label.

[0167] As an implementable embodiment, the pre-trained threat detection model can be trained in the following manner:

[0168] The acquisition module is configured to acquire a training state fusion index and a label set corresponding to the training state fusion index.

[0169] The training set and validation set determination module is configured to divide the training state fusion index and the label set into two parts according to a preset ratio, one part as a training set and the other part as a validation set.

[0170] The input module is configured to input the training set into a threat detection model to be trained.

[0171] The training detection result acquisition module is configured to perform threat detection on the training set by using the threat detection model to be trained, and obtain a training detection result.

[0172] The training module is configured to verify the training detection result by using the validation set. If the verification result meets a preset verification result, the training of the threat detection model to be trained is completed. If the verification result does not meet the preset verification result, the parameters of the threat detection model to be trained are adjusted, and the threat detection model to be trained is trained by using a new training state fusion index.

[0173] The threat detection device of the industrial control network provided in the embodiments of the present application has the same beneficial effects as the threat detection method of the industrial control network provided in the above embodiments, and thus will not be described again.

[0174] The embodiments of the present application further provide a corresponding device and a computer storage medium for implementing the schemes provided in the embodiments of the present application.

[0175] The device includes a memory and a processor. The memory is configured to store instructions or codes. The processor is configured to execute the instructions or codes, so that the device performs the threat detection method of the industrial control network according to any of the embodiments of the present application.

[0176] The computer storage medium stores codes. When the codes are executed, a device running the codes implements the threat detection method of the industrial control network according to any of the embodiments of the present application.

[0177] It should be noted that each of the embodiments in the specification adopts a progressive manner, and the same and similar parts between each embodiment can be referred to each other. Each embodiment focuses on the difference from other embodiments. Especially, the device and equipment embodiments are described more simply because they are basically similar to the method embodiments. The relevant parts can be referred to the part of the method embodiments. The above-described device and equipment embodiments are only illustrative, and the units described as separate components can be or can not be physically separated, and the components indicated as units can be or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to the actual needs. Those skilled in the art can understand and implement it without creative labor.

[0178] The "first" and "second" in the names of "first" and "second" mentioned in the embodiments of the application are only used for name identification, and do not represent the first and second in order.

[0179] From the description of the above embodiments, those skilled in the art can clearly understand that all or part of the steps in the above embodiment methods can be implemented by means of software plus a general hardware platform. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as a read-only memory (English: read-only memory, ROM) / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network communication device such as a router) execute the method described in each embodiment or some parts of the embodiments of the present application.

[0180] The above is only one specific embodiment of the present application, but the protection scope of the present application is not limited to this. Any skilled person in the art can easily think of changes or replacements within the technical scope disclosed in the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for detecting threats in an industrial control network, characterized in that: The method comprises: Obtain multiple characteristic parameters in industrial control networks; Determine the importance evaluation factor between two adjacent feature parameters to obtain multiple importance evaluation factors; Constructing a judgment matrix according to the plurality of importance evaluation factors; Determining a consistency index of the judgment matrix according to the maximum eigenvalue of the judgment matrix; Determining whether the consistency index meets the preset consistency index range; If they are met, the plurality of characteristic parameters are sorted by importance according to the eigenvector of the maximum eigenroot of the judgment matrix; Determine a preset number of feature parameters as multiple target feature parameters according to the importance ranking results; Determine the feature mutual information value between each two target feature parameters; Determine a state fusion index based on multiple feature mutual information values; A pre-trained threat detection model is used to perform threat detection on the state fusion indicator.

2. The method for detecting threats in an industrial control network according to claim 1, wherein: Determining the feature mutual information value between every two target feature parameters includes: Determine the information entropy and conditional entropy between every two target feature parameters; The information entropy and the conditional entropy are used to obtain a feature mutual information value between every two target feature parameters.

3. The method for detecting threats in an industrial control network according to claim 1, wherein: Determining the state fusion index according to multiple feature mutual information values ​​includes: Determine the label mutual information value between each target feature parameter and the preset class label to obtain multiple label mutual information values; A state fusion index is determined according to the multiple target feature parameters, the multiple label mutual information values, the multiple feature mutual information values ​​and the preset class labels.

4. The method for detecting threats in an industrial control network according to claim 1, wherein: The pre-trained threat detection model is trained in the following way: Obtaining a training state fusion indicator and a label set corresponding to the training state fusion indicator; Dividing the training state fusion indicator and the label set into two parts according to a preset ratio, one part as a training set and the other part as a validation set; Inputting the training set into the threat detection model to be trained; Performing threat detection on the training set using the threat detection model to be trained, and obtaining a training detection result; Verifying the training test results using the verification set; If the verification result meets the preset verification result, the training of the threat detection model to be trained is completed; if the verification result does not meet the preset verification result, the parameters of the threat detection model to be trained are adjusted, and the threat detection model to be trained is trained using the new training state fusion indicator.

5. A threat detection device for an industrial control network, characterized in that: The device includes: a target feature parameter acquisition module, a feature mutual information value determination module, a state fusion index determination module and a threat detection module; The target characteristic parameter acquisition module includes: A characteristic parameter acquisition module is used to obtain multiple characteristic parameters in the industrial control network; An importance evaluation factor determination module is used to determine the importance evaluation factor between two adjacent feature parameters to obtain multiple importance evaluation factors; A judgment matrix construction module, configured to construct a judgment matrix based on the plurality of importance evaluation factors; A consistency index determination module, configured to determine the consistency index of the judgment matrix according to the maximum eigenvalue of the judgment matrix; A judgment module, configured to judge whether the consistency index meets a preset consistency index range; A sorting module, configured to sort the plurality of characteristic parameters by importance according to the eigenvector of the maximum eigenroot of the judgment matrix if the conditions are met; A target feature parameter acquisition submodule is used to determine a preset number of feature parameters as multiple target feature parameters according to the importance ranking result; The feature mutual information value determination module is used to determine the feature mutual information value between every two target feature parameters; The state fusion index determination module is used to determine the state fusion index according to multiple feature mutual information values; The threat detection module is used to perform threat detection on the state fusion indicator using a pre-trained threat detection model.

6. The threat detection device for industrial control networks according to claim 5, characterized in that: The feature mutual information value determination module includes: An entropy value determination module is used to determine the information entropy and conditional entropy between every two target feature parameters; The feature mutual information value determination submodule is used to obtain the feature mutual information value between every two target feature parameters using the information entropy and the conditional entropy.

7. The threat detection device for an industrial control network according to claim 5, characterized in that: The state fusion index determination module includes: A label mutual information value determination module is used to determine the label mutual information value between each target feature parameter and a preset class label to obtain multiple label mutual information values; The state fusion index determination submodule is used to determine the state fusion index according to the multiple target feature parameters, the multiple label mutual information values, the multiple feature mutual information values ​​and the preset class label.

8. The threat detection device for an industrial control network according to claim 5, characterized in that: The pre-trained threat detection model is trained in the following way: An acquisition module, configured to acquire a training state fusion indicator and a label set corresponding to the training state fusion indicator; A training set and validation set determination module, configured to divide the training state fusion indicator and the label set into two parts according to a preset ratio, one part as a training set and the other as a validation set; An input module, configured to input the training set into a threat detection model to be trained; A training detection result acquisition module, configured to perform threat detection on the training set using the threat detection model to be trained, and obtain a training detection result; A training module, configured to verify the training detection results using the verification set; If the verification result meets the preset verification result, the training of the threat detection model to be trained is completed; if the verification result does not meet the preset verification result, the parameters of the threat detection model to be trained are adjusted, and the threat detection model to be trained is trained using the new training state fusion indicator.

Images