An industrial control device anomaly detection method based on function mode

Abstract

The application discloses an industrial control equipment abnormality detection method based on a function mode, which analyzes control operation changes of the industrial control equipment, constructs a control operation feature library, adopts a correlation degree mining method to mine linkage relations between the control operation and safety faults, forms a function mode sequence, and designs an abnormality discrimination engine based on a dynamic Bayesian network to detect abnormal operation behaviors of the industrial control equipment in real time. Through the above method, the application can comprehensively consider the cause-effect relations and linkage effects between the control operation changes and information safety, detect safety faults of the industrial control equipment caused by malicious attacks or misoperations and generate alarms through real-time analysis and abnormality discrimination of the industrial control operation, and thus the safety of the industrial control system is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control device information security, and more particularly to an industrial control device anomaly detection method based on a function mode. BACKGROUND

[0002] The development of networking and informatization promotes the large-scale integration and interconnection of industrial control systems. The increasingly exposed vulnerability and security threats are no longer simply linear superposition. In the face of organized and high-intensity attacks, industrial control systems are facing serious information security threats. In fact, traditional simple attack methods against industrial control systems have evolved into advanced persistent threats (APT).

[0003] PLC, RTU, DCS controller and other industrial control devices are mainly responsible for collecting industrial field data, controlling industrial field devices, and can control the operation of industrial devices and handle their faults according to the program, and have become the core of realizing the control function of industrial control systems. However, most of the programmable embedded electronic devices in service and on sale do not consider information security risks and are in an unguarded state. Moreover, programmable embedded electronic devices increasingly use general protocols, general hardware and general software, and are fully digitized and networked, providing more possibilities for malicious intrusion.

[0004] The availability priority principle of industrial control systems makes it impossible to directly apply traditional IT information technology. Therefore, researchers have carried out research on information security protection technologies such as industrial firewalls and industrial whitelist software that are suitable for the characteristics of industrial control systems. As one of the key implementation methods of industrial control system security protection measures, anomaly detection can effectively identify known and unknown attacks without interfering with the availability of the industrial internet, and has been widely recognized by the industry. Industrial control system anomaly detection research at the present stage can be generally summarized into three categories: feature / state-based methods, model-based methods and machine learning-based methods. Among them, the feature / state-based method identifies system anomalies by identifying data features, behavior features or state changes of the industrial control system; the model-based method establishes a mathematical model of normal communication, operation and operation behavior according to the actual parameters of the system, application and device, and detects abnormal attack behavior by comparing it with the model in real time; the machine learning-based method has many research results, mainly focusing on the application of neural networks, support vector machines, clustering algorithms, Bayesian methods, genetic algorithms and decision tree algorithms in anomaly detection. These algorithms can be used as detection engines to effectively identify intrusions.

[0005] Most of the above industrial anomaly detection methods analyze and identify anomalies in industrial network traffic, few start from the control operation change characteristics of industrial control devices themselves, and also lack the correlation between specific control operations and security failures. The anomaly detection capability of industrial control devices is limited, and the actual application has certain limitations and one-sidedness. SUMMARY

[0006] A further object of the present application is to provide an industrial control device anomaly detection method based on function mode, which analyzes the control operation change of the industrial control device, constructs a control operation feature library, uses a correlation degree mining method to mine the linkage relationship between the control operation and the security failure, forms a function mode sequence, and designs an anomaly discrimination engine based on a dynamic Bayesian network to detect the abnormal operation behavior of the industrial control device in real time. The method can deeply analyze the complex mapping relationship between the control operation change and the information security failure, and through the establishment of a lightweight local dynamic Bayesian network anomaly detection engine, the security failure of the industrial control device caused by known / unknown attacks or misoperations can be detected in real time and effectively, and an alarm is generated to ensure the safety of the industrial control system.

[0007] To achieve the above object, the technical scheme adopted by the present application is as follows: an industrial control device anomaly detection method based on function mode, characterized in that the steps are as follows:

[0008] 1) Control operation feature library construction: analyze the control operation commands received by the industrial control device, extract the control operation change characteristics in time sequence, and construct a control operation feature library.

[0009] 2) Mining of linkage relationship between control operation and security failure: based on the information security failure caused by network attacks, analyze the coupling and contradiction effect between the control operation characteristics, establish a normal and abnormal chain control model, and use it to perfect the linkage relationship between the control operation of the industrial control device and the security failure.

[0010] 3) Real-time anomaly discrimination of dynamic Bayesian network: group the control operation characteristics and the linkage relationship into a function mode sequence, which is used to construct a dynamic Bayesian network, and use the incremental learning suffix probability tree as an anomaly decision function to judge the degree of deviation from the normal situation, realize anomaly detection and alarm.

[0011] In step 1), the control operation includes setting temperature, humidity, pressure, speed, etc. change function operation.

[0012] The time sequence control operation change characteristics include instantaneous discrete jump transition characteristics and time continuous flow change characteristics.

[0013] In step 2), the correlation mining method is used to explore the linkage between control operations and security faults. Combined with information security faults, the correct and incorrect evolution process of control operations is analyzed to establish a normal and abnormal chain control model.

[0014] The information security failures mentioned include functional failures and erroneous operating states exhibited by industrial control equipment under cyberattacks.

[0015] In step 3), the functional mode sequence consists of a series of functional modes with a certain temporal relationship.

[0016] Each functional mode comprises two parts: control operation characteristics and the linkage between control operation and safety faults.

[0017] In step 3), the dynamic Bayesian network is a local dynamic Bayesian network. The functional pattern sequence is used to train the local sub-network, and dynamic information is transferred between the sub-networks.

[0018] The incremental learning suffix probability tree is used to detect anomalies by calculating the functional mode transition probability in real time.

[0019] The functional mode transition probability is defined as follows:

[0020] P(v (t) |v (1) ,...,v (t-2) ,v (t-1) )=

[0021] P(c (t) |c (1) ,...,c (t-2) ,c (t-1) )*P(m (t) |c (t) ;…m (1) ,...,m (t-2) ,m (t-1) )

[0022] Among them, v (t) =(c (t) ,m (t) ) represents the functional mode at time t, c (t) m represents a certain control operation characteristic at time t. (t) The control operation at time t is c. (t) The linkage relationship between time and time. P(c) (t) |c (1) ,...,c (t-2) ,c (t-1) P(m) is the conditional probability calculated for changes in control operation. (t) |c (t) ;m(1) ...,m (t-2) ,m (t-1) ) is the conditional probability calculated for the change in the linkage relationship.

[0023] The beneficial effects of the present application are:

[0024] 1. Compared with the prior art, the present application provides an industrial control device anomaly detection method based on function mode, which is different from the traditional anomaly detection based on industrial network flow. The method realizes real-time anomaly analysis and determination directly facing the industrial control device by analyzing the control operation command of the industrial control device.

[0025] 2. The control operation feature library of the method not only involves different physical execution operations, but also contains the transfer and change derivation of the control operation, which can more accurately describe the change mode of the control operation in time sequence, thereby effectively supporting the construction of the function mode sequence.

[0026] 3. The method can fully analyze the industrial control device function failure characteristics and error running state caused by information security faults, and associate them with the control operation, summarize the correct and error evolution process of the control operation, establish the normal and abnormal linkage control model, so that the feature detection is more comprehensive and the detection result is more accurate.

[0027] 4. The local dynamic Bayesian network of the method can reduce the computational complexity of network construction, and combine the simplified decision calculation of function mode transfer probability, so that the anomaly detection engine is more lightweight.

[0028] 5. The method can be independently run in the system of the industrial control device as a third-party listening method, and does not participate in the control operation activities of the industrial control device, so it will not interfere with the real-time and availability of the industrial control.

[0029] 6. The method can not only detect known and unknown industrial network attacks suffered by the industrial control device, but also identify abnormal behaviors caused by misoperation of the industrial control device. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a typical industrial control network application deployment embodiment schematic diagram of the method of the present application.

[0031] Figure 2 is a basic model schematic diagram of the method of the present application.

[0032] Figure 3 is a main execution process schematic diagram of the linkage relationship mining of the control operation and security faults in the method of the present application.

[0033] Figure 4The main execution process diagram of the dynamic Bayesian network real-time anomaly discrimination in the method of the application. DETAILED DESCRIPTION

[0034] An industrial control device anomaly detection method based on function mode, the steps of which are:

[0035] 1) Control operation feature library construction: analyze the control operation commands of the industrial control device, extract the control operation change features in time sequence, and construct the control operation feature library.

[0036] The control operation includes setting temperature, humidity, pressure, rotation speed, and other changeable function operations.

[0037] The control operation change features in time sequence include instantaneous discrete jump transition features and time-based continuous flow change features.

[0038] 2) Control operation and security failure linkage relationship mining: based on information security failures caused by network attacks, analyze the coupling and contradiction effects between control operation features, and use them to improve the linkage relationship between industrial control device control operation and security failure.

[0039] The control operation and security failure linkage relationship mining adopts the correlation degree mining method, combines the information security failure, analyzes the correct and incorrect evolution process of the control operation, and establishes the normal and abnormal interlocking control model.

[0040] The information security failure includes the function failure features and error running state of the industrial control device under network attacks.

[0041] 3) Real-time anomaly discrimination of dynamic Bayesian network: the control operation features and linkage relationship groups form a function mode sequence, which is used to construct a dynamic Bayesian network, and the incremental learning suffix probability tree is used as an anomaly decision function to discriminate the deviation from the normal situation, realize anomaly detection and alarm.

[0042] The function mode sequence is composed of a series of function modes with certain time sequence relationship.

[0043] Each function mode includes two parts: control operation features and linkage relationship between control operation and security failure.

[0044] The dynamic Bayesian network is a local dynamic Bayesian network, and the function mode sequence is used to train the local sub-network, and the sub-networks perform dynamic information transmission.

[0045] The incremental learning suffix probability tree discriminates anomalies by real-time calculation of function mode transition probability.

[0046] The function mode transition probability is defined as follows:

[0047] P(v(t) |v (1) ,...,v (t-2) ,v (t-1) )=

[0048] P(c (t) |c (1) ,...,c (t-2) ,c (t-1) )*P(m (t) |c (t) ;m (1) ,...,m (t-2) ,m (t-1) )

[0049] Wherein, v (t) =(c (t) ,m (t) ) represents a function mode at t time, c (t) represents a control operation characteristic at t time, m (t) represents the linkage relationship when the control operation is c (t) at t time. P(c (t) |c (1) ,...,c (t-2) ,c (t-1) ) is the conditional probability calculated for control operation change; P(m (t) |c (t) ;m (1) ,...,m (t-2) ,m (t-1) ) is the conditional probability calculated for linkage relationship change.

[0050] In the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described by combining with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0051] The method of the present application belongs to the category of industrial control device information security detection and protection. Figure 1The application method is shown in a typical industrial control network. As shown in the figure, the application method can be used as a third-party monitoring method, and is independently applied to the system of an industrial control device (such as a PLC, RTU, DCS controller). The application method collects the control operation instructions sent by a workstation (such as an operator station or an engineer station) to the industrial control device in real time, analyzes and detects the changes in the control operation, finds the intrusion behavior and misoperation behavior in the normal process operation, and performs an alarm. In this embodiment, the application method first collects the control operation instructions (including the function operation instructions for changing the temperature, humidity, pressure, and rotating speed) sent by the workstation to the industrial control device, analyzes and extracts the control operation change characteristics in time sequence, constructs a control operation characteristic library, then mines the linkage relationship between the control operation and the information security fault, forms a function mode sequence, constructs a local dynamic Bayesian network, and finally realizes abnormal detection and alarm through the decision function mode transition probability.

[0052] The application provides an industrial control device abnormality detection method based on a function mode. Figure 2 The application provides an industrial control device abnormality detection method based on a function mode. In the control operation characteristic library construction part, the temperature, humidity, pressure, rotating speed and other function changes are realized by sending control operation instructions from the workstation to the industrial control device, which is manifested as a relatively fixed change mode in time sequence. Based on this, the control operation characteristic library is established by extracting the control operation change characteristics in time sequence, which not only involves different physical execution operations, but also describes the function control transition and change derivation, including: ① instantaneous discrete jump transition; and ② time continuous flow change. Figure 3 The main execution process of the linkage relationship mining is shown. Based on the control operation characteristic library, the linkage relationship mining method is adopted, the function failure characteristics and error running state of the industrial control device subjected to a network attack are fully combined, on one hand, the complex mapping relationship between the originally isolated two types of elements is analyzed in depth, an effective way of mutual transformation between the function operation and the security fault of the industrial control device is established, on the other hand, the coupling and contradiction relationship between the control operation characteristics is studied, the correct and error evolution process of the control operation is simulated in the form of a function chain, the normal and abnormal chain control models are constructed respectively, and the causal relationship and linkage effect between the control operation and the security fault of the industrial control device are further improved. Figure 4The main execution process of real-time anomaly detection is shown. The computing and storage resources of industrial control devices are limited. The local dynamic Bayesian network can not only reduce the computational complexity of network construction, but also solve the transition accumulation problem of the linkage relationship between control operations and safety failures. Therefore, based on the changes of control operations and the linkage relationship between control operations and safety failures, a functional mode sequence is further constructed to establish a local dynamic Bayesian network. In the process of constructing the network, according to the periodicity of process operation, the long functional mode sequence is segmented, each segment is used to train a local sub-network, and dynamic information is transmitted between sub-networks, thereby reducing the overall complexity of the Bayesian network and indirectly reducing the computing and storage resources occupied by anomaly detection. In addition, an incremental learning suffix probability tree is used as a potential anomaly decision function. By calculating the functional mode transition probability in real time, the degree of deviation from the normal situation is determined to realize anomaly detection and alarm. The functional mode transition probability is defined as follows:

[0053]

[0054] Where, v (t) = (c (t) , m (t) ) represents the functional mode at time t, c (t) represents a control operation feature at time t, and m (t) represents the linkage relationship when the control operation is c (t) at time t. P(c (t) |c (1) ,...,c (t-2) ,c (t-1) ) is the conditional probability calculated by the control operation change; P(m (t) |c (t) ; m (1) ,...,m (t-2) ,m (t-1) ) is the conditional probability calculated by the linkage relationship change.

[0055] In addition, in order to enhance the rapid adaptability of the network, an adaptive genetic algorithm is used to learn the parameters of the dynamic Bayesian network. The maximum likelihood estimation function is selected as the fitness function of the genetic algorithm. Through coding, fitness calculation, selection, crossover, mutation, adaptive strategy and other operations, global search and multiple iterations are performed to obtain the optimal network node parameters. At the same time, in order to improve the detection accuracy, a threat weight unit is established to evaluate the detection results through a voting mechanism, and a smoothing function is used to provide more accurate alarms.

Claims

1. A functional pattern-based industrial control device anomaly detection method, characterized by, The steps are: 1) Control operation feature library construction: analyzing the control operation commands of industrial control equipment, extracting the control operation change features in time sequence, and constructing the control operation feature library; 2) Control operation and security failure linkage relationship mining: based on the information security failure caused by network attack, analyzing the coupling and contradiction effect between control operation features, establishing normal and abnormal chain control models, and used for improving the linkage relationship between industrial control equipment control operation and security failure; 3) Real-time anomaly discrimination of dynamic Bayesian network: the control operation features and linkage relationship are combined into function mode sequence, which is used to construct dynamic Bayesian network, and the incremental learning suffix probability tree is used as an anomaly decision function to judge the deviation degree from the normal situation, realize anomaly detection and alarm; In the step 1), the control operation includes setting temperature, humidity, pressure, and speed change function operation; In the step 1), the time sequence control operation change feature includes instantaneous discrete jump transition feature and time continuous flow change feature. 2.The functional mode based industrial control device anomaly detection method of claim 1, wherein: In the step 2), the control operation and security failure linkage relationship mining adopts the correlation degree mining method, combines the information security failure, analyzes the correct and error evolution process of control operation, and establishes the normal and abnormal chain control model.

3. The method of claim 2, wherein: The information security failure includes the function failure features and error running state of industrial control equipment under network attack.

4. The method of claim 1, wherein the method further comprises: In the step 3), the function mode sequence is composed of a series of function modes with certain time sequence relationship; each function mode includes two parts: control operation feature and linkage relationship between control operation and security failure.

5. The method of claim 1, wherein: In the step 3), the dynamic Bayesian network is a local dynamic Bayesian network, which segments the longer function mode sequence, each segment is used to train local subnetwork, and the subnetworks dynamically transmit information.

6. The method of claim 1, wherein: In the step 3), the incremental learning suffix probability tree discriminates the anomaly by real-time calculation of function mode transition probability.

7. The functional mode based industrial control device anomaly detection method of claim 6, wherein: The function mode transition probability is defined as follows: wherein represents a functional mode at a certain time instant, represents a certain control operation feature at a certain time instant, represents a control operation at a certain time instant, a linkage relationship at a certain time instant; a conditional probability calculated for a control operation change; a conditional probability calculated for a linkage relationship change.

Images