A control network communication anomaly identification method based on behavior state density

Abstract

A method for identifying control network communication anomalies based on behavioral state density extracts communication interaction data from edge control networks, abstracting three types of control communication behaviors consisting of function domains, address domains, and data domains. On this basis, two types of behavioral state machine models are constructed between the feature ontology core and feature ontology, and the average state density of each behavioral state machine is calculated. Furthermore, an anomaly identification engine based on clustering is designed, which uses local anomaly factors to detect abnormal communication behaviors in edge control networks in real time. The present invention, through the above method, can combine the characteristics of industrial control communications, directly and effectively reflect the communication changes of edge control networks through behavioral state machines, detect information interaction anomalies caused by malicious threats in real time, and issue alarms, thereby ensuring the security of edge control network communications.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network information security, and more particularly to a method for distinguishing control network communication anomalies based on behavior state density. Background Art

[0002] At present, industrial control systems have been widely used in key national infrastructure such as electricity, oil, and transportation. With the continuous advancement of industrial informatization, industrial control systems are rapidly developing in the direction of digitalization, networking, and intelligence. This not only improves the successful transformation of the manufacturing industry, but also realizes network interconnection inside and outside the factory. This breaks the relatively closed and isolated operating state of traditional industrial control systems. In particular, the industrial control systems of many key infrastructures lack protective measures and guarantees, which has led to the increasingly prominent information security issues and increasingly severe security situations of industrial control systems at this stage.

[0003] One of the important reasons why industrial control systems are facing increasingly severe information security challenges is that industrial control systems themselves have many vulnerabilities, mainly including: (1) system platform vulnerabilities, that is, industrial control systems have some security vulnerabilities due to program flaws, improper configuration or poor maintenance, such as loopholes and defects in system hardware, operating software and application software; (2) network vulnerabilities, that is, vulnerabilities in industrial network architecture, network communication and network boundaries, such as security design flaws in industrial communication protocols, incorrect configuration of control network connections and poor management of connections between private networks and other networks; (3) policy and procedure vulnerabilities, that is, incomplete, inappropriate or non-existent security policies and implementation guidelines. In fact, industrial control systems can be divided into enterprise resource layer, production management layer, process monitoring layer, field control layer and field device layer according to the vertical functional structure. Now the control layer and field device layer are often at the edge of the entire industrial control network, mainly completing the control of various execution devices according to the specific production process. Therefore, the network involved in the field control layer and field device layer is collectively referred to as the edge control network in this patent. The three aforementioned security vulnerabilities also exist in edge control networks and may lead to even more serious consequences. This is because edge control networks are often directly related to production processes or control procedures. Malicious threats can forcibly forge or tamper with control commands, causing production process failures, directly undermining the availability of process control, and potentially leading to industrial production accidents.

[0004] To address the vulnerabilities of edge control networks and the information security challenges they face, industry and academia have proposed a series of security solutions, primarily including industrial control host whitelisting, industrial firewalls, industrial intrusion detection, and industrial situational awareness. Of particular note, industrial intrusion detection technology has been widely recognized by the industry for its ability to analyze and control abnormal behavior patterns based on specific industrial communication protocols, without disrupting the availability of industrial control systems, and to detect attacks and threats to edge control networks in real time. Currently, intrusion detection technologies for edge control networks are primarily categorized into misuse detection and anomaly detection. Misuse detection analyzes and summarizes existing attacks or threats on edge control networks, extracting attack or threat signatures of malicious operations and establishing a knowledge base of malicious operation signatures. This knowledge base then matches new communication data with known attack or threat signatures to detect intrusions in real time. Anomaly detection learns the communication characteristics and patterns of edge control networks, establishing a normal communication behavior profile. By determining whether observed data violates this normal communication behavior profile, it can identify abnormal behavior in real time. Generally speaking, the advantage of misuse detection is its high detection rate for known types of attack behaviors, but its detection capability for new, unknown attacks is weaker. The advantage of anomaly detection is its ability to detect unknown attacks or threats and to self-adjust and optimize based on changes in communication behavior, but its false alarm rate is higher than that of misuse detection. Research on anomaly detection in edge control networks can be mainly divided into four categories: state-based detection, statistics-based detection, model-based detection, and machine learning-based detection. These anomaly detection methods often only select partial message domain information from edge control network communication data for feature extraction and anomaly identification. On the one hand, they lack a comprehensive consideration of all key message domain information involved in industrial communication protocols, resulting in certain limitations in anomaly detection capabilities. On the other hand, the design of anomaly detection engines cannot meet the needs of different control communication behaviors, resulting in a certain one-sidedness in the applicability of anomaly detection. Summary of the Invention

[0005] A further objective of the present invention is to provide a control network communication anomaly identification method based on behavioral state density. This method extracts communication interaction data from edge control networks and abstracts three types of control communication behaviors: the function domain, the address domain, and the data domain. Based on this, two types of behavioral state machine models are constructed: a feature ontology core and an inter-feature ontology. The average state density of each behavior state machine is calculated. Furthermore, a clustering-based anomaly identification engine is designed, which uses local anomaly factors to detect abnormal communication behaviors in edge control networks in real time. Based on an analysis of the protocol specifications and interaction methods of industrial communication protocols, this method uses three types of control communication behaviors to describe changes in the function, address, and data message domains. By constructing two types of behavioral state machine models, one within the feature ontology and one between the feature ontology, these models comprehensively encompass all feature states and their associated attributes. Furthermore, each behavior state machine can be quantified using the average state density. Finally, clustering and a local anomaly factor algorithm are used to detect information interaction anomalies caused by known and unknown threats in real time and generate alarms, thereby ensuring data communication security in edge control networks.

[0006] In order to achieve the above objectives, the present invention adopts a technical solution: a control network communication anomaly detection method based on behavior state density, the steps of which are:

[0007] 1) Feature extraction of three control communication behaviors: Based on the protocol specifications and operating mechanisms of the industrial communication protocol, key message domain information is extracted from data packets within a fixed period of time t. The message domain information is then organized into an initial information sequence in chronological order. The three control communication behaviors are then abstracted to form feature sequences for the three control communication behaviors.

[0008] The key message domain mainly includes three parts: function domain, address domain and data domain, which constitute the function characteristics, address characteristics and data characteristics respectively. The characteristic sequence of each control communication behavior is composed of the extracted message domain information in chronological order.

[0009] 2) Construction of Two Types of Behavior State Machines: Based on the initial information sequence and the characteristic sequences of the three control communication behaviors, a finite state machine approach is used to establish two types of behavior state machine models: within the feature ontology and between the feature ontology. Each type of behavior state machine model contains three different behavior state machines. The average state density of each behavior state machine is calculated. The data packet within a fixed time period t is represented by a six-dimensional point composed of the average state density of the six behavior state machines.

[0010] The behavior state machine within the feature ontology takes each feature itself as a state in the model, and the transition probability between states is calculated by the proportion of the two states in the control communication behavior feature sequence to which they belong.

[0011] The inter-feature ontology behavioral state machine uses mappings of two different features as a state in the model, and the transition probability between states is calculated based on the weight of the two states in the corresponding behavioral state machine mapping sequence. The mappings of two different features consist of two consecutive message domains in the initial message sequence, and the two consecutive message domains belong to different message domains. The behavioral state machine mapping sequence is composed of all mappings contained in the behavioral state machine in chronological order.

[0012] For each behavioral state machine, the average state density is defined as:

[0013]

[0014] in, is the average state density, s i is the state value of the i-th state: for the behavior state machine within the feature ontology, it is the feature value corresponding to the state; for the behavior state machine between feature ontologies, it is the mapping value of the two different features corresponding to the state. i is the frequency of occurrence of the i-th state, and p(i|j) is the transition probability from the j-th state to the i-th state.

[0015] The mapping values ​​of the two different features are defined as follows:

[0016]

[0017] Among them, c→e is a state of the behavior state machine between feature ontology, which is the mapping of two different features c and e, x c and x e are the eigenvalues ​​of two different features.

[0018] 3) Clustering anomaly identification: According to the above method, the data packets within the real-time captured time range are segmented and analyzed according to a fixed time t. A six-dimensional point is calculated for each segment. The K-means algorithm is used to cluster all six-dimensional points. When performing real-time detection, the local anomaly factor is used to identify anomalies, realize anomaly detection and alarm.

[0019] During real-time detection, data packets within a fixed time period t are captured in real time, and the average state density of the six behavioral state machines is calculated respectively to obtain the six-dimensional points of the data packet. The k-nearest neighbor algorithm is used to find the most likely cluster to which the six-dimensional points belong. Then, the local anomaly factor algorithm is used to calculate the local anomaly factor of the six-dimensional point in the possible cluster. If the local anomaly factor is greater than the preset threshold value, it is determined that there is an anomaly in the data packet.

[0020] The beneficial effects of the present invention are:

[0021] 1. Compared with the existing technology, the present invention discloses a control network communication anomaly identification method based on behavioral state density. Unlike traditional anomaly detection methods, this method comprehensively analyzes three different key message domains in the edge control network and abstracts three control communication behaviors, making feature extraction more comprehensive and improving the anomaly detection capability.

[0022] 2. This method adopts the concept of finite state machines and establishes two types of behavioral state machine models. These models not only reflect the changes in the feature ontology itself, but also consider the correlation between different feature ontologies. A behavioral state density is designed to quantify the six types of behavioral state machines, making the description of the communication content of the edge control network more effective and accurate, further enhancing the accuracy of anomaly detection.

[0023] 3. This method uses a combination of K-means clustering algorithm, k-nearest neighbor algorithm and local anomaly factor algorithm for anomaly identification. On the one hand, it meets the detection requirements of different control communication behaviors and effectively supports the design of the anomaly detection engine. On the other hand, it has low computational complexity, making the anomaly detection engine more lightweight and enhancing the real-time performance of detection.

[0024] 4. This method can be used as a third-party monitoring method and run independently on a dedicated detection device to capture and detect communication data sent by the mirror port of an industrial switch in real time. It can also be installed on one or more workstations in an edge control network to analyze communication anomalies at the workstation.

[0025] 5. This method can not only identify, detect and alarm attack or threat behaviors in edge control networks, but also detect changes in network communications caused by misoperation. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a schematic diagram of an embodiment of the method of the present invention deployed in an edge control network application.

[0027] Figure 2 Schematic diagram of the basic model of the method of the present invention.

[0028] Figure 3 Schematic diagram of the main execution process of controlling communication behavior analysis and feature extraction in the method of the present invention.

[0029] Figure 4 Schematic diagram of the construction process of two types of behavioral state machine models in the method of the present invention.

[0030] Figure 5 The figure is a schematic diagram of the main execution process of abnormality discrimination by clustering in the method of the present invention. DETAILED DESCRIPTION

[0031] A control network communication anomaly detection method based on behavior state density, the steps of which are:

[0032] 1) Feature extraction of three control communication behaviors: Based on the protocol specifications and operating mechanism of the industrial communication protocol, key message domain information is extracted from data packets within a fixed time period t. The message domain information is organized into an initial information sequence in chronological order, and three control communication behaviors are abstracted to further form feature sequences of the three control communication behaviors.

[0033] The key message domain mainly includes three parts: function domain, address domain and data domain, which constitute the function characteristics, address characteristics and data characteristics respectively, and the characteristic sequence of each control communication behavior is composed of the extracted message domain information in chronological order.

[0034] 2) Construction of two types of behavioral state machines: Based on the initial information sequence and the characteristic sequences of three control communication behaviors, the finite state machine method is used to establish two types of behavioral state machine models: within the feature ontology and between the feature ontology. Each type of behavioral state machine model contains three different behavioral state machines, and the average state density of each behavioral state machine is calculated. In this way, the data packet within a fixed period of time can be represented by a six-dimensional point composed of the average state density of six behavioral state machines.

[0035] The behavioral state machine within the feature ontology uses each feature itself as a state in the model, such as the behavioral state machine of function change. The transition probability between states is calculated by the proportion of the two states in the control communication behavior feature sequence to which they belong.

[0036] The behavioral state machine between feature ontologies uses the mapping of two different features as a state in the model, such as the behavioral state machine of function and address mapping, and the transition probability between states is calculated by the proportion of the two states in the mapping sequence of the corresponding behavioral state machine.

[0037] The mapping of two different characteristics is composed of two consecutive message domain information in the initial information sequence, and the two consecutive message domain information belong to different types of message domains.

[0038] The behavior state machine mapping sequence is composed of all mappings contained in the behavior state machine in chronological order.

[0039] For each behavioral state machine, the average state density is defined as:

[0040]

[0041] in, is the average state density, s iis the state value of the i-th state (for the behavior state machine within the feature ontology, it is the feature value corresponding to the state; for the behavior state machine between feature ontologies, it is the mapping value of two different features corresponding to the state), q i is the frequency of occurrence of the i-th state, and p(i|j) is the transition probability from the j-th state to the i-th state.

[0042] The mapping values ​​of the two different features are defined as follows:

[0043]

[0044] Among them, c→e is a state of the behavior state machine between feature ontology, that is, the mapping of two different features c and e, x c and x e are the eigenvalues ​​of two different features.

[0045] 3) Clustering anomaly identification: Data packets within a longer time range are segmented and analyzed according to a fixed time t in the above manner. A six-dimensional point can be calculated for each segment. The K-means algorithm is used to cluster all six-dimensional points. When performing real-time detection, local anomaly factors are used to identify anomalies, realize anomaly detection and alarm.

[0046] During real-time detection, data packets within a fixed time period t are captured in real time, and the average state density of the six behavioral state machines is calculated respectively to obtain the six-dimensional points of the data packet segment. The k-nearest neighbor algorithm is used to find its most likely belonging cluster, and then the local anomaly factor algorithm is used to calculate the local anomaly factor of the six-dimensional point in the possible belonging cluster. If the local anomaly factor is greater than the preset threshold value, it is determined that there is an anomaly in the data packet segment.

[0047] Example 1: The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0048] The method of the present invention belongs to the category of information security detection and protection of industrial control systems. Figure 1A schematic diagram illustrates an embodiment of the present invention's deployment in a typical edge control network. As shown, the present invention has two deployment methods. The first deployment method can be used as a third-party monitoring method on a dedicated detection device. The device connects to the mirror port of an industrial switch and captures communication data from the mirror port in real time. The industrial switch forwards communication data between workstations, such as operator stations and engineer stations, and field control devices, such as PLCs and DCS controllers, and copies all communication data to its mirror port. The dedicated detection device uses the present invention to analyze and detect the captured communication data, identify changes in communication, and thereby detect information exchange anomalies caused by known and unknown threats in the edge control network and generate alarms. The second deployment method involves installing the present invention on one or more workstations, such as operator stations and engineer stations, in the edge control network. The present invention captures communication data between the workstation and the field control device in real time, analyzes and detects this communication data, and detects attacks or misoperations initiated by the workstation against the field control device after malicious intrusion, and generates alarms.

[0049] The present invention provides a method for determining abnormal communication in a control network based on behavior state density. Figure 2 , shows a basic model of a control network communication anomaly identification method based on behavior state density. The model is mainly divided into three parts: control communication behavior analysis, behavior state machine construction, and clustering anomaly identification. In the control communication behavior analysis part, the communication characteristics of the edge control network with limited states and limited behaviors make it possible to model the corresponding control communication behavior. However, the communication interaction of the edge control network covers information such as function, address, and data, so see Figure 3 The main process of control communication behavior analysis and feature extraction is shown, as follows: first, data packets within a fixed time t are captured from the edge control network and arranged in chronological order; then, based on the protocol specifications and operation mechanism of the industrial communication protocol, deep packet parsing technology is used to extract key message domain information such as the function domain, address domain, and data domain, and the message domain information is organized into an initial information sequence in chronological order; finally, the extracted function domain information, address domain information, and data domain information are respectively composed of function features, address features, and data features to describe and abstract three types of control communication behaviors, and each feature is arranged in sequence to form a feature sequence of the corresponding control communication behavior.

[0050] In the Behavioral State Machine Construction section, Figure 4The construction process of two types of behavioral state machine models is shown. Based on the obtained initial information sequence and the feature sequences of three control communication behaviors, a finite state machine approach is used to establish two types of behavioral state machine models within the feature ontology core and between feature ontologies. Each type of behavioral state machine model contains three different behavioral state machines, resulting in a total of six behavioral state machines: a behavioral state machine for function change, a behavioral state machine for address change, a behavioral state machine for data change, a behavioral state machine for function and address mapping, a behavioral state machine for function and data mapping, and a behavioral state machine for address and data mapping. In the construction of the behavioral state machines within the feature ontology, the feature sequences of the three control communication behaviors are used as input, and each feature itself is treated as a state in the model. Transitions between states are described by two consecutive features in the feature sequence. The transition probability between states is calculated based on the proportion of the two states in their corresponding control communication behavior feature sequences: that is, the ratio of the number of two consecutive features corresponding to the two states to the number of all two consecutive features in the feature sequence. Differently, in the process of constructing the behavioral state machine between feature ontologies, the initial information sequence and the feature sequences of three control communication behaviors are used as input, and the mapping of two different features is used as a state in the model. These two different features belong to different types of message domains, and the mapping of the two different features is composed of two consecutive adjacent message domain information in the initial information sequence. For example, each mapping state in the behavioral state machine of function and address mapping is composed of a function feature and an address feature, and this mapping can correspond to two consecutive adjacent message domain information in the initial information sequence. In addition, all mappings contained in each behavioral state machine are combined into the mapping sequence of the behavioral state machine in chronological order, and the transition probability between states is calculated by the proportion of the two states in the mapping sequence of the behavioral state machine to which they belong, that is, the proportion of the number of two consecutive mappings corresponding to the two states to the number of all two consecutive adjacent mappings in the mapping sequence. Based on each established behavioral state machine, the average state density of the behavioral state machine can be further calculated. The specific calculation method is:

[0051]

[0052] in, is the average state density, s i is the state value of the i-th state, q i is the frequency of occurrence of the i-th state, and p(i|j) is the transition probability from the j-th state to the i-th state.

[0053] Regarding the state value, for the behavior state machine within the feature ontology, it is the feature value corresponding to the state, while for the behavior state machine between feature ontologies, it is the mapping value of the two different features corresponding to the state. The specific calculation method is as follows:

[0054]

[0055] Among them, c→e is a state of the behavior state machine between feature ontology, that is, the mapping of two different features c and e, x c and x e are the eigenvalues ​​of two different features.

[0056] Through the above calculation, each behavioral state machine will obtain an average state density, and the data packet within each fixed time t can establish six different behavioral state machines. Therefore, the data packet within each fixed time t can be further represented by a six-dimensional point composed of the average state density of the six behavioral state machines.

[0057] In the abnormality discrimination part of clustering, it is divided into training stage and real-time detection stage. Figure 5 The diagram shows the main execution processes of the training and real-time detection phases. Specifically, during the training phase, data packets are captured over a longer timeframe and segmented according to a fixed time interval t. For each segment, the control communication behavior analysis and behavior state machine construction processes are sequentially executed. The average state density of the six behavior state machines is calculated, and the six-dimensional points of the data packet segment are obtained. This analysis of data packets over a longer timeframe yields a large number of six-dimensional points. These six-dimensional points are then clustered using the K-means algorithm. Due to the high similarity in the average state density within the same cluster, K different clusters are obtained, and six-dimensional points with high similarity are grouped together in the same cluster. In the real-time detection stage, t data packets within a fixed period of time are captured in real time. The control communication behavior analysis and behavior state machine construction processes are executed successively for this segment of data packets. The six-dimensional point corresponding to this segment of data packets is obtained by calculating the average state density of six behavior state machines. Then, the k-nearest neighbor algorithm is used to find the most likely cluster to which this six-dimensional point belongs. The local anomaly factor algorithm is used to calculate the local anomaly factor of the six-dimensional point in the possible cluster to which it belongs. Finally, anomaly judgment is performed. The specific judgment rules are as follows: if the local anomaly factor of the six-dimensional point is greater than the preset threshold, it is determined that there is an anomaly in this segment of data packets; if the local anomaly factor of the six-dimensional point is less than or equal to the preset threshold, it is determined that this segment of data packets is normal.

[0058] Furthermore, some key parameters in the proposed method, such as the number of clusters K in the K-means algorithm and the number of nodes k in the k-nearest neighbor algorithm, directly affect the accuracy of real-time anomaly detection. Furthermore, different network communication scenarios may also lead to different parameter selections. Therefore, in practical applications, key parameters can be trained using real-world testing methods using real industrial communication data, while feedback correction analysis can be used to further optimize parameters.

Claims

1. A control network communication anomaly detection method based on behavior state density, characterized in that: The steps are: 1) Feature extraction of three control communication behaviors: Based on the protocol specifications and operating mechanisms of the industrial communication protocol, key message domain information is extracted from data packets within a fixed period of time t. The message domain information is then organized into an initial information sequence in chronological order. The three control communication behaviors are then abstracted to form feature sequences for the three control communication behaviors. 2) Construction of Two Types of Behavior State Machines: Based on the initial information sequence and the characteristic sequences of the three control communication behaviors, a finite state machine approach is used to establish two types of behavior state machine models: within the feature ontology and between the feature ontology. Each type of behavior state machine model contains three different behavior state machines. The average state density of each behavior state machine is calculated. The data packet within a fixed time period t is represented by a six-dimensional point composed of the average state density of the six behavior state machines. 3) Clustering anomaly identification: According to the above method, the data packets within the real-time captured time range are segmented and analyzed according to a fixed time t. A six-dimensional point is calculated for each segment. The K-means algorithm is used to cluster all six-dimensional points. When performing real-time detection, the local anomaly factor is used to identify anomalies, realize anomaly detection and alarm.

2. The method for detecting anomaly in control network communication based on behavior state density according to claim 1, characterized in that: In the step 1), the key message domain mainly includes three parts: function domain, address domain and data domain, which respectively constitute function characteristics, address characteristics and data characteristics. The characteristic sequence of each control communication behavior is composed of the extracted message domain information in chronological order.

3. The control network communication anomaly detection method based on behavior state density according to claim 1 is characterized in that: In the step 2), the behavior state machine within the feature ontology takes each feature itself as a state in the model, and the transition probability between states is calculated by the proportion of the two states in the control communication behavior feature sequence to which they belong.

4. The method for detecting anomaly in control network communication based on behavior state density according to claim 1, characterized in that: In the step 2), the behavior state machine between feature ontology uses the mapping of two different features as a state in the model, and the transition probability between states is calculated by the proportion of the two states in the mapping sequence of the behavior state machine to which they belong.

5. The method for detecting abnormalities in control network communication based on behavior state density according to claim 4, characterized in that: The mapping of the two different characteristics is composed of two consecutive message domain information in the initial information sequence, and the two consecutive message domain information belong to different types of message domains.

6. The method for detecting anomaly in control network communication based on behavior state density according to claim 4, characterized in that: The behavior state machine mapping sequence is composed of all mappings contained in the behavior state machine in chronological order.

7. The method for detecting anomaly in control network communication based on behavior state density according to claim 1, characterized in that: In step 2), for each behavior state machine, the average state density is defined as: in, is the average state density, s i is the state value of the i-th state: for the behavior state machine within the feature ontology, it is the feature value corresponding to the state; for the behavior state machine between feature ontologies, it is the mapping value of the two different features corresponding to the state. i is the frequency of occurrence of the i-th state, and p(i|j) is the transition probability from the j-th state to the i-th state.

8. The method for detecting abnormalities in control network communication based on behavior state density according to claim 7, characterized in that: The mapping values ​​of the two different features are defined as follows: Among them, c→e is a state of the behavior state machine between feature ontology, which is the mapping of two different features c and e, x c and x e are the eigenvalues ​​of two different features.

9. The method for detecting anomaly in control network communication based on behavior state density according to claim 1, characterized in that: In the step 3), when performing real-time detection, data packets within a fixed time period t are captured in real time, and the average state density of the six behavioral state machines is calculated respectively to obtain the six-dimensional points of the data packet segment. The k-nearest neighbor algorithm is used to find the most likely cluster to which the six-dimensional points belong, and then the local anomaly factor algorithm is used to calculate the local anomaly factor of the six-dimensional point in the possible cluster. If the local anomaly factor is greater than a preset threshold value, it is determined that an anomaly exists in the data packet segment.

Images