Attack detection and tracing method and system based on code data fusion

Abstract

The application discloses an attack detection and tracing method and system based on code data fusion. The application obtains historical variable records in a SCADA system in an industrial control system, defines system states, state transitions and state transition periods, and constructs a finite state machine of the industrial control system in a normal working condition; the abnormal state of a PLC is detected in real time by checking real-time variable records and the finite state machine. A control program variable dependent path is constructed based on a PLC instruction table language; a suspicious attack weight of a PLC program variable is designed, and a tracing path is constructed based on a mapping relationship between SCADA variable records and the PLC program variable. The application is non-intrusive at each stage; the data acquisition and detection and tracing time meet the real-time requirement of the industrial control system, and compared with various detection systems, the application can be closely combined with system physical semantics, and each state and transition objectively maps the physical semantics of the system.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection in industrial control systems, and in particular to an attack detection and tracing method and system based on code-data fusion. Background Technology

[0002] Programmable Logic Controllers (PLCs) are among the most widely used small-to-medium-sized control systems in industrial control systems. They directly connect to the sensors and actuators of the controlled system, performing real-time control through pre-set control logic. As the core control device of the field control layer, they are of significant value for the field protection of industrial control systems. However, PLCs themselves are lagging in their design of security verification and communication data encryption measures. This allows attackers to exploit vulnerabilities in industrial control protocols to modify PLC memory and alter physical process states, leading to serious security incidents such as the Stuxnet attack. To quickly detect abnormal system operation, it is necessary to design corresponding intrusion detection systems for the specific operating environment of PLCs. Furthermore, to guide operators in locating attack vectors, isolating attack impacts, and restoring normal operation of the industrial control system, specific attack point tracing is required.

[0003] Existing intrusion detection methods for industrial control systems are typically designed from two aspects: 1) Communication behavior-based detection, which mainly uses the principle of misuse to detect abnormal communication behavior in network components, network protocols, and communication processes; 2) Physical process dynamic detection, which uses system physical data as the monitoring object, often based on normal physical process behavior models to detect abnormal data behavior. Existing intrusion detection methods for industrial control systems rely on limited system modeling methods and lack a holistic view of the controlled system, making it difficult to support the need for attack attribution after attack detection. Furthermore, existing detection methods lack a joint design for real-time intrusion detection and attack attribution, especially lacking attack attribution at the control code level, making it difficult to support the rapid recovery of the attacked system's normal behavior and hindering the mitigation of attack impact. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by providing an attack detection and tracing system based on code-data fusion, suitable for intrusion detection and tracing scenarios in industrial control systems. Specifically addressing scenarios where Programmable Logic Controllers (PLCs) in industrial control systems are attacked, this method demonstrates excellent detection and tracing capabilities for system anomalies and attack points. This method utilizes historical variable records obtained from a SCADA system, constructs a normal operating condition model of the industrial control system using a finite state machine, and simultaneously detects PLC anomalies in real time by verifying real-time variable records against the normal operating condition model. Based on the PLC instruction list language, this invention employs static program analysis techniques to construct dependency paths for control program variables, designs suspicious attack weights for PLC program variables, and constructs a tracing path from PLC anomalies to suspicious attack variables based on the mapping relationship between SCADA variable records and PLC program variables. The attack detection and tracing system using this method offers advantages such as meeting the real-time requirements of industrial control systems, non-intrusive operation, and no impact on the normal and stable operation of the industrial control system.

[0005] The objective of this invention is achieved through the following technical solution:

[0006] This invention provides an attack detection and tracing method based on code-data fusion, which is applied to the security monitoring of industrial control systems and includes the following steps:

[0007] S1: Obtain the control program of the PLC in the industrial control system and the historical data of the SCADA monitoring system, and use OPC UA to obtain the real-time variable records of SCADA;

[0008] S2: Using the historical variable records of the SCADA monitoring system as input, identify the system state and state transition, construct the system finite state machine under normal operating conditions, and access the mapping relationship between SCADA variable records and PLC program variables from the underlying database of the SCADA monitoring software.

[0009] S3: Based on the PLC control program, static program analysis technology is used to extract the program variable dependencies;

[0010] S4: In the data space, based on the real-time variable records of SCADA, compare the system's finite state machine under normal operating conditions to identify abnormal system states and abnormal state transitions, and complete the attack detection.

[0011] S5: In the code space, based on the system anomalies detected by the attack detection mechanism, a suspicious attack tracing chain is constructed according to the program variable dependency relationship and the mapping relationship between SCADA variable records and PLC program variables. Suspicious attack weights are identified, and attack tracing is performed.

[0012] Furthermore, in S2, the SCADA system variable log = {v1, v2, ..., v} is used to record the system variables. m} is the input (containing m variables in total), and any variable v is... m Discretization to a unified value space J m This constitutes a complete system state space. Simultaneously, by combining the system's operational laws and physical constraints, the system state is constructed using a unified set of variables, making the actual abstract normal system state much smaller than the actual system state.

[0013] Furthermore, in S2, the variable record u of the SCADA system at time i is defined. i ={v i1 ,v i2, ,…,v im Let} represent the state, and define the variable record u for adjacent time steps. i →u i+1 For state transitions, the time interval between identical state transitions is defined as the state transition period; using SCADA historical variable records as input, a finite state machine for normal operating conditions is constructed: the system's initial state is used as the initial state of the state machine, and any other state is used as the receiving state. State transition edges are established between corresponding states, and the time interval between identical edges is recorded.

[0014] Furthermore, in S2, variable records are automatically accessed from the underlying database of the SCADA monitoring software, a finite state machine is recursively constructed, and online updates of new states, new state transitions, and new state transition cycles are supported.

[0015] Furthermore, in S3, a programming language oriented towards the PLC basic instruction list is used, with register assignment operations as the core, to construct the dependencies between PLC program variables. Specifically, for PLC non-jump instructions, a transfer function D{Reg / Var} is designed to depict the direct dependency of the register-stored variable Reg on the related operand variable Var before and after PLC instruction execution; for PLC jump instructions, the dependency between the transfer functions D{Reg / Var} before and after the program jump is depicted; and for PLC function call instructions, the dependency between the actual parameter D{parameter} and the formal parameter D{argument} of the called function is depicted.

[0016] Furthermore, in S4, for any SCADA variable record at any given time, it is discretized into the value space J. m It generates system states, state transitions, and state transition cycles, and detects attacks online in real time by comparing them with the finite state machine of the system under normal operating conditions.

[0017] Furthermore, in S5, based on the dependencies between PLC program variables, an attack variable sourcing graph G(V,E) is established for the PLC program, where V defines all PLC program variables and E defines all dependencies between program variables. For the variable set V, according to the PLC variable definition rules, regular expressions are used to identify all variables in the program. For the edge set E, variable dependencies are added or eliminated for all program instructions according to the code execution order. Specifically, for any instruction s, its predecessor output register dependency set is merged register by register to obtain the input dependency of instruction s. If instruction s * If there is a write operation with the program variable Var as the destination address, then all input dependency variables of instruction s are added to the dependency edge set of program variable Var; continue analyzing PLC program instructions until the set of instructions to be analyzed is empty.

[0018] Furthermore, in S5, when a system anomaly is detected from the SCADA variable records, the abnormal program variable Var will be automatically located based on the mapping relationship between the SCADA variable records and PLC program variables. a And based on the attack variable source graph G(V,E), the propagation path of the attack variable's influence is traced, specifically by recursively identifying nodes Var. a Construct a chain of suspected attack attribution from all parent nodes.

[0019] Furthermore, in S3.2, in the face of multiple potentially suspicious attack variables, the suspicious attack weight W of program variable node n is defined. n ,

[0020]

[0021] Among them, D n Define node n to the exception procedure variable Var a Network dependency hop count, Define a set of all exception program variables that have dependencies on node n. Define a set of normal variables that are dependent on node n, with parameter α adjusting the proportion of normal / abnormal variables in the tracing weights of different systems; the distance to the anomalous program variable Var a Nodes n that are closer to each other have a higher probability of being attacked variables, because the influence of attacked variables weakens as conditions increase; nodes n that influence more anomalous program variables have a higher probability of being attacked variables; based on the suspicious attack weight W of each program variable node n. n The suspicious attack tracing paths are sorted according to their weights.

[0022] Another aspect of this invention provides an attack detection and tracing system based on code-data fusion, which is non-intrusive, online, and hot-deployable, and includes the following modules:

[0023] Data acquisition module: Acquires the PLC's control program, as well as the historical and real-time records of the SCADA monitoring system;

[0024] System state construction module: Automatically constructs the behavior of industrial control system under normal operating conditions, including the following sub-modules: (i) Based on SCADA data records, constructs a finite state machine model of the behavior of industrial control system; (ii) Based on PLC control program, abstracts the dependency relationship between program variables.

[0025] Attack Detection and Tracing Module: Based on the real-time data recording of the SCADA monitoring system from the data acquisition module, it identifies system states, state transitions, and state transition cycles; by comparing the system's finite state machine under normal operating conditions, it identifies anomalies in the industrial control system; based on the mapping between SCADA variable records and PLC program variables, as well as the dependencies between PLC program variables, it traces the possible attack paths corresponding to abnormal system states.

[0026] The beneficial effects of this invention are:

[0027] For industrial control systems, this invention combines monitoring data variables and control program variables, and uses a finite state machine model to model system states and state changes from historical variable records. The model has a direct mapping relationship with the physical space. Compared with various detection systems that use machine learning and neural networks, this method, as an intrusion detection system, can be closely integrated with the physical semantics of the system. Each state and transition objectively maps the physical semantics of the system.

[0028] Furthermore, this method chooses to use SCADA historical records for finite state machine modeling, rather than abstracting the system's finite state machine at the code level. This is a more reasonable choice for the real-time performance of industrial control system intrusion detection and for depicting the actual operating state of the system. After detecting an abnormal state, the system backtracks from the abnormal program variables to extract the affected physical quantities, the set of program variables represented by the components, and all dependencies of this set. This provides a reference for subsequent investigation of program attack points, enabling attack tracing at the control program level. Moreover, it provides operators with effective reference for quickly locating attack points and eliminating threats.

[0029] This invention models the normal behavior of industrial control systems based on SCADA historical data and PLC control programs, without requiring modifications to the original control system, and will not affect the normal operation of the system during deployment and use. Attached Figure Description

[0030] Figure 1 This invention provides an architecture design for an intrusion detection and tracing system.

[0031] Figure 2This is a schematic diagram illustrating the attack tracing method provided in an embodiment of the present invention.

[0032] Figure 3 This diagram illustrates the cumulative time consumed in communication, intrusion detection, and attack tracing, as provided in an embodiment of the present invention. Detailed Implementation

[0033] To better understand the technical solution of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0034] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0035] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0036] This invention provides an attack detection and tracing method based on code data fusion. This method selects abnormal behaviors detected by modeling from variable records and maps the abnormal behaviors to suspicious attack variables in the control program to complete the monitoring and tracing of industrial control systems, thereby realizing an intrusion detection and tracing system based on variable records and control programs.

[0037] In one embodiment, the implementation process of the attack detection and tracing method based on code-data fusion is as follows: Figure 1 As shown, the intrusion detection and tracing system designed in this method utilizes widely used SCADA systems, OPC UA protocols, and control programs in the PLC working environment to acquire data in both physical and program spaces. The intrusion detection and tracing system mainly comprises two stages: industrial control system modeling and abnormal behavior detection. In the modeling stage, a normal operating condition model of the system in the data space is constructed based on SCADA monitoring records, and the variable dependencies of the system in the code space are constructed based on the control program. In the detection stage, OPC UA is used to acquire real-time variable records from the SCADA system, detect abnormal system states, and trace the attacked variables.

[0038] The following uses a physical elevator system and its supporting workstation system as an example to illustrate the specific application of this method. Based on the SCADA system, this method obtains the physical state of the system and establishes an intrusion detection algorithm to provide the starting point information for attack tracing; based on the PLC control program, it obtains the program variable dependencies and establishes an attack variable tracing mechanism.

[0039] By utilizing the established state machine of the industrial control system and the dependency of control program variables, system attack detection is performed, and all possible program variable attack points are traced back from abnormal system states.

[0040] Specifically, the steps include the following:

[0041] Step 1: The intrusion detection and tracing system is deployed in the local area network where the elevator system's SCADA is located. It obtains the variable history records under normal operating conditions of the elevator system by accessing the SCADA system database, and obtains the instruction list program executed by the PLC by accessing the PLC.

[0042] Step 2: Based on the historical variable records of the SCADA monitoring system, identify the system state and state transitions, and use a finite state machine to establish a normal operating condition model of the controlled physical process;

[0043] Record the SCADA system variables log = {v1, v2, ..., v m} is the input (containing m variables in total), and any variable v is... m Discretization to J m This constitutes a complete system state space. Simultaneously, by combining the system's operational rules and physical constraints, a unified system state is constructed using all variables. The actual abstract normal system state will be much smaller than...

[0044] Define the SCADA system and its variable record u at time i. i ={v i1 ,v i2, ,…,v im Let} represent the state, and define the variable record u for adjacent time steps. i →u i+1 For state transitions, the time interval between identical state transitions is defined as the state transition period. Using SCADA historical variable records as input, a finite state machine for normal operating conditions is constructed: the system's initial state is used as the initial state of the state machine, and any other state is used as the receiving state. State transition edges are established between corresponding states, and the time interval between identical edges is recorded.

[0045] When constructing a finite state machine for normal operating conditions, variable records are automatically accessed from the underlying database of the SCADA monitoring software. These records contain a one-to-one mapping between SCADA variable records and PLC program variables. Each historical variable record is used as a state node of the finite state machine, and the model state set is constructed record by record. For each traversed state, if it is not in the state set, it is added to the state set. Adjacent different variable records, such as u... i ={v i1 ,v i2,…v im} and u i+1 ={v (i+1)1 ,v (i+1)2 ,…v (i+1)m}, then a variable is generated to record the corresponding state s. i With s j State transitions s i →s j Add it to the state transition set. Note that there are multiple identical state transitions in the historical record. This represents repetitive behavior of the industrial control system due to program logic and normal input environment. To record the normal time range of the transition process, within the range of the previous recorded state s... i Different states s j When it occurs, start timer recording until the next different state s. k If an end-of-time timer is recorded, determine whether the state transition occurs at an extreme value in time length. Within the specified range, otherwise the duration range of the state transition needs to be updated. A finite state machine is recursively constructed using the above method to establish a normal operating condition model of the controlled physical process, and this model supports online updates of new states, new state transitions, and new state transition cycles.

[0046] In this embodiment, a state machine model of the elevator system is constructed based on two hours of variable records from the SCADA system (each record monitors 46 key input / output points). The historical data records of the 46 key input / output points are partitioned into value spaces (e.g., logical states are divided into 0 and 1). The number of states of the elevator system gradually converges with the increase in the number of records, and is far less than the theoretical maximum value, i.e., 2^32. 46 The elevator system operating condition modeling process yielded a total of 2008 system states and 2868 state transitions. This finite state machine will serve as the basic model for intrusion behavior monitoring.

[0047] Step 3: Based on the PLC instruction list program and considering the characteristics of the PLC programming language, design program semantic abstraction to address the attack tracing requirements and construct dependencies between variables. Specifically, for PLC non-jump instructions, establish a transfer function D{Reg / Var} to characterize the direct dependency of the register-stored variable Reg on the related operand variable Var before and after PLC instruction execution; for PLC jump instructions, characterize the dependency between the transfer functions D{Reg / Var} before and after the program jump; for PLC function call instructions, characterize the dependency between the actual parameter D{parameter} and the formal parameter D{argument} of the called function. These three transfer functions constitute the normal state propagation model of PLC program variables.

[0048] Construct an attack variable sourcing graph G(V,E) for the PLC program, where V defines all PLC program variables and E defines all dependencies between program variables. For the variable set V, identify all variables in the program using regular expressions according to PLC variable definition rules. For the edge set E, add / remove variable dependencies D{Reg / Var} for all program instructions according to the code execution order. Specifically, for any instruction s, perform a register-by-register union of its predecessor output register dependencies to obtain the input dependencies of instruction s; if instruction s... * If there is a write operation with the program variable Var as the destination address, then all input dependency variables of instruction s are added to the dependency edge set of program variable Var; continue analyzing PLC program instructions until the set of instructions to be analyzed is empty.

[0049] Step 4: Utilize the variable records obtained in real-time from SCADA via the OPC UA protocol for attack detection. This method establishes communication with WinCC through the OPC UA interface. WinCC's default variable recording period is 500ms, therefore, this method uses a loop polling approach to read the software's real-time recorded values ​​and compares them with the established finite state machine under normal operating conditions.

[0050] For any SCADA variable record at any time, discretize it into the value space J. m It generates system states, state transitions, and state transition cycles. By checking whether variables are included in the set of intrusion behaviors that the finite state machine can detect under normal operating conditions—including states not described by the model, state transitions not described by the model, and state transitions exceeding the upper and lower bounds of the recording time—it detects attacks online in real time. If a variable is not included in the behaviors recorded by the model under normal operating conditions, it adds these variables to the exception variable set AVars and calls functions such as reportEventTimeError() to report the exception.

[0051] Step 5: When a system anomaly is detected from the SCADA variable records, the abnormal program variable Var will be automatically located based on the mapping relationship between the obtained SCADA variable records and PLC program variables. a And based on the attack variable source graph G(V,E), trace the propagation path of the attack variable's influence—that is, recursively identify the node Var. a Construct a chain of suspected attack attribution from all parent nodes.

[0052] Weights are evaluated for all dependent variables of the anomalous variable to determine the investigation priority of the variable. For multiple potentially suspicious attack variables, the suspicious attack weight W of program variable node n is calculated. n ,

[0053]

[0054] Among them, D n Define node n to the exception procedure variable Var a Network dependency hop count, Define a set of all exception program variables that have dependencies on node n. Define a set of normal variables that are dependent on node n. The parameter α adjusts the proportion of normal and abnormal variables in the tracing weights of different systems. The α parameter is designed with two ranges: from 0 to 1 with a step size of 0.05, and from 1 to 20 with a step size of 1. When α = 15, both the average and maximum tracing steps converge to the optimal values: the average tracing steps are 4.0, and the maximum tracing steps are 25. The suspicious attack weight W of node n is determined based on the program variable. n Size, sorted by attack tracing path.

[0055] The attack detection and tracing of this industrial control system is now complete. In the elevator system embodiment, five types of attack vectors were designed: Type A attack vectors aim to guide the elevator into a dangerous operating state; Type B attack vectors aim to maliciously damage the equipment; Type C attack vectors aim to provide erroneous information; Type D attack vectors forge user input commands; and Type E attack vectors deceive sensors.

[0056] The intrusion detection and attack tracing results of the designed attack vectors in the elevator system implementation are shown in Table 1. The evaluation indicators in the table include three items: whether the attack behavior was detected, how many steps are needed to trace back to the attack site according to the tracing chain, and the proportion of tracing steps to the total number of variables. Among the tested attack vectors, a total of 46 actual attacks were carried out on the elevator system. All detected attacks could be traced back to the attack site through a specific number of steps. A total of 24 attacks at different sites were carried out for dangerous operating state categories A1-A24. Except for A8-A11, all were successfully detected. Among the four attacks for A8-A11, one triggered the door closing action immediately after the elevator arrived at the destination, and three delayed the door closing action after the door was opened to the destination. Two attacks with delayed door closing were detected. All 20 attacks, including malicious equipment damage, erroneous information guidance, and sensor spoofing, were detected. Two attacks were tested for user command forgery. Since the forged user commands themselves existed in the historical records, the relevant states were included in the finite state machine during modeling, which made them undetectable. In the above test tasks, the system achieved an accuracy of 91.3% in intrusion detection. When an attack was successfully detected, all tracing chains contained the attack site. Based on the tracing order of nodes on the attack tracing graph, the actual steps required to trace the attack site were within 4 steps for variables in areas I and Q. For attack vectors in area M, the tracing steps accounted for 31.25% of the total number of variables in extreme cases. The table is explained based on typical attack vectors in various types of attacks. Attack vector A1, in the open state, performs a setting operation on point QO.7, causing the elevator door to open and rise, potentially leading to a serious consequence of passengers falling. The SCADA variable records detected a state outside the model during intrusion detection. Point QO.7 experienced a level jump when other sensors did not change; therefore, tracing began from this point. Since it is itself an attack point, the tracing steps were 1. Attack vector B3 triggers the Q1.2 door-closing control point when the door is open, causing the motor to screech violently and stop in the middle position. That is, when the Q1.1 door-opening point is active, the attack vector simultaneously activates Q1.2. According to the PLC's logic operation rules, the two points are sequentially transmitted to the control point during the output phase, causing the motor to rapidly reverse. During intrusion detection, because the attack simultaneously affects the state changes of other points, corresponding level jumps occur. Attack vector C3 illuminates the digital display "3" through the QO.3 point when the elevator is on the second floor, misleading passengers on the third floor into believing the elevator has arrived, potentially causing them to fall into the elevator shaft. During intrusion detection, the abnormal variable change only occurs at the QO.3 point. Type D attack vectors simulate attacks initiated through passenger buttons that cause elevator occupancy. Since this type of behavior itself does not cause abnormal states or state transitions, and corresponding behavior records exist during normal elevator operation, this type of attack cannot be detected.Type E attacks also target sites in region I, but since their attack sites are sensors, such as when the elevator is on the third floor and triggers the second-floor arrival sensor, causing the elevator to open erroneously, there is no corresponding state in the model, so it can be detected.

[0057] Both attack vectors A21 and A22 use M1.0 as the attack point, but the number of tracing steps differs. This is because the elevator was stationary and open during the attacks, respectively, resulting in the elevator rising a certain distance and the elevator indicator light illuminating, respectively. The former has anomaly variable set {QO.4, QO.7}. By constructing the attack tracing graph and calculating the tracing weights of variables at each level, the actual attack variable tracing order is 8. The latter has anomaly variable set {QO.4}, and the actual attack variable tracing order is 3. Although the two attack vectors share the same attack point, the state changes caused by attacking the same point under different operating conditions are not identical, leading to different anomaly variables detected by intrusion detection. Therefore, the structure of the attack tracing graph and the tracing weights of each node also differ, ultimately affecting the number of steps required to trace back to the attack point.

[0058] Table 1: Intrusion monitoring and attack attribution results for the designed attack vectors

[0059]

[0060]

[0061]

[0062] In the elevator system implementation, the attack tracing path and corresponding tracing weight ranking are as follows: Figure 2 As shown: The suspicious variable set is constructed with the detected abnormal variable as the core and the dependency distance as the radius. The node weights in each layer are distinguished by the length of the radius. When tracing the source, the attack investigation is carried out from the inside out. The outermost layer consists of variables that have no dependency relationship with the abnormal node and are least likely to be attacked.

[0063] In the elevator system implementation, the Siemens S7-300 PLC drives the elevator by executing control programs and reading / writing sensor / actuator states. Exploiting vulnerabilities in the current S7-300 PLC communication protocol, attacks such as PLC memory tampering and malicious logic triggering are launched to alter the elevator's normal operation. In 46 attacks tested, this method achieved a 91.3% positive detection rate, and the source tracing results were able to pinpoint the attack location within an average of four tracing steps.

[0064] Corresponding to the aforementioned embodiments of the attack detection and tracing method based on code data fusion, the present invention also provides embodiments of the attack detection and tracing system based on code data fusion.

[0065] Another aspect of this invention provides an attack detection and tracing system based on code-data fusion, which is non-intrusive, online, and hot-deployable, and includes the following modules:

[0066] Data acquisition module: Acquires the PLC's control program, as well as the historical and real-time records of the SCADA monitoring system;

[0067] System state construction module: Automatically constructs the behavior of industrial control system under normal operating conditions, including the following sub-modules: (i) Based on SCADA data records, constructs a finite state machine model of the behavior of industrial control system; (ii) Based on PLC control program, abstracts the dependency relationship between program variables.

[0068] Attack Detection and Tracing Module: Based on the real-time data recording of the SCADA monitoring system from the data acquisition module, it identifies system states, state transitions, and state transition cycles; by comparing the system's finite state machine under normal operating conditions, it identifies anomalies in the industrial control system; based on the mapping between SCADA variable records and PLC program variables, as well as the dependencies between PLC program variables, it traces the possible attack paths corresponding to abnormal system states.

[0069] This embodiment verifies the system's low detection latency and non-intrusive hot deployment capabilities. The communication time for real-time data acquisition constitutes the largest portion of the total data acquisition process. Figure 3 As shown, the horizontal axis represents duration, the vertical axis represents the recorded duration, and the dashed line represents the average duration. The average duration is approximately 200 milliseconds, with the extreme duration approaching 400 milliseconds, but still below the 500-millisecond SCADA data recording cycle.

[0070] The specific implementation methods described above are intended to enable those skilled in the art to understand and apply this invention. Those skilled in the art can readily make various modifications to the above content and apply the general principles described herein to other aspects without creative effort. Therefore, several improvements and modifications can be made to this invention without departing from its technical principles, and these improvements and modifications should also be considered within the scope of protection of this invention.

Claims

1. An attack detection and tracing method based on code-data fusion, characterized in that, The method includes the following steps: S1: Obtain the control program of the PLC in the industrial control system and the historical data of the SCADA monitoring system, and use OPCUA to obtain the real-time variable records of SCADA. S2: Using historical variable records from the SCADA monitoring system as input, identify system states and state transitions, construct a finite state machine for normal operating conditions, and access the mapping relationship between SCADA variable records and PLC program variables from the underlying database of the SCADA monitoring software; specifically: using SCADA system variable records... For input, where This indicates the total number of variables in the SCADA records, including any variable. Discretization to a unified value space This constitutes a complete system state space. Simultaneously, by combining the system's operational laws and physical constraints, the system state is constructed using a unified set of variables, making the actual, abstracted normal system state much smaller than the actual system state. Define the SCADA system Variable records at time Define the variable records for adjacent time points as states. For state transitions, the time interval between the same state transitions is defined as the state transition period; using SCADA historical variable records as input, a finite state machine for normal operating conditions is constructed: the initial state of the system is used as the initial state of the state machine, and any other state is used as the receiving state. State transition edges are established between corresponding states, and the time interval between the occurrence of the same edge is recorded. S3: Based on the PLC control program, static program analysis techniques are used to extract the dependencies between program variables; specifically, using a PLC basic instruction list programming language and register assignment operations as the core, dependencies between PLC program variables are constructed; specifically, transfer functions are designed for PLC non-jump instructions. Describe the variables stored in the registers before and after the execution of PLC instructions. For relevant operands The direct dependencies; for PLC jump instructions, characterizing the transfer functions before and after the program jump. Dependencies between them; for PLC function call instructions, characterize the actual parameters of the called function. With formal parameters Dependencies between them; S4: In the data space, based on the real-time variable records of SCADA, compare the system's finite state machine under normal operating conditions to identify abnormal system states and abnormal state transitions, and complete the attack detection. S5: In the code space, based on the system anomalies detected by the attack detection mechanism, a suspicious attack tracing chain is constructed according to the program variable dependency relationship and the mapping relationship between SCADA variable records and PLC program variables. The suspicious attack weight is calculated, and the attack is traced. The construction of the suspected attack tracing chain includes: when a system anomaly is detected from the SCADA variable records, the abnormal program variable will be automatically located based on the mapping relationship between the SCADA variable records and PLC program variables. And based on the attack variable source graph Tracing the propagation path of the attack variable's impact, specifically, recursively identifying nodes. Construct a suspicious attack attribution chain from all parent nodes; the calculation of attack weights includes: defining program variable nodes in the face of multiple potentially suspicious attack variables. Suspicious attack weights , ， in, Define nodes to exception program variables Network dependency hop count, Definitions and Nodes The set of all exception program variables that have dependencies. Definitions and Nodes A set of normal variables with dependencies, parameters Adjusting the weighting of normal / abnormal variables in the tracing weights of different systems; distance from abnormal program variables. The closer the node The higher the probability, the more likely it is to be a vulnerable variable, because the influence of a vulnerable variable weakens as conditions increase; nodes that affect more abnormal program variables... The higher the probability, the more likely it is to be an attacked variable; based on each program variable node. Suspicious attack weights The suspicious attack tracing paths are sorted according to their weights.

2. The attack detection and tracing method based on code-data fusion according to claim 1, characterized in that, In S2, variable records are automatically accessed from the underlying database of the SCADA monitoring software, a finite state machine is recursively constructed, and online updates of new states, new state transitions, and new state transition cycles are supported.

3. The attack detection and tracing method based on code-data fusion according to claim 1, characterized in that, In S4, for any given SCADA variable record, the data is discretized into the value space. It generates system states, state transitions, and state transition cycles, and detects attacks online in real time by comparing them with the finite state machine of the system under normal operating conditions.

4. The attack detection and tracing method based on code-data fusion according to claim 1, characterized in that, In S5, an attack variable tracing graph is established for the PLC program based on the dependency relationships between PLC program variables. ,in Define all PLC program variables. Define all dependencies between program variables; For a set of variables According to the PLC variable definition rules, regular expressions are used to identify all variables in the program; for the edge set Add or remove variable dependencies for all program instructions according to the order of code execution; specifically, for any instruction... The instruction is obtained by performing a register-by-register union of the dependency sets of its predecessor output registers. Input dependencies; if the instruction There exist program variables For a write operation to the destination address, the instruction will be... Add all input dependency variables to program variables In the set of dependent edges; Continue analyzing the PLC program instructions until the set of instructions to be analyzed is empty.

5. A system for implementing the attack detection and tracing method based on code-data fusion as described in any one of claims 1-4, characterized in that, The system includes the following modules: Data acquisition module: used to acquire the PLC's control program, as well as the historical and real-time records of the SCADA monitoring system; System State Construction Module: Used to automatically construct the behavior of industrial control systems under normal operating conditions, including the following sub-modules: (i) Based on SCADA data records, construct a finite state machine model of the behavior of industrial control systems; (ii) Based on PLC control programs, abstract the dependencies between program variables. Attack Detection and Tracing Module: Based on the real-time data recording of the SCADA monitoring system from the data acquisition module, it identifies system states, state transitions, and state transition cycles; by comparing the system's finite state machine under normal operating conditions, it identifies anomalies in the industrial control system; based on the mapping between SCADA variable records and PLC program variables, as well as the dependencies between PLC program variables, it traces the attack paths corresponding to abnormal system states.

Images