An anomaly detection method for industrial control systems based on session feature continuity
By collecting and processing the timing characteristics of network data packets in industrial control systems, a twin convolutional neural network model is constructed, which solves the problem of difficulty in capturing timing exceptions and data set imbalance in the existing technology, and realizes high-precision abnormality detection of industrial control systems .
Patent Information
- Application Number
- CN202410883211.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-03
- Publication Date
- 2024-12-20
- Estimated Expiration
- 2044-07-03
AI Technical Summary
The existing industrial control system anomaly detection method based on convolutional neural networks is difficult to capture timing anomalies, and the training effect is poor when the samples of the training data set are uneven.
Using a method based on session feature continuity, network data packets are collected during normal operation of industrial control systems, network data packets are extracted in five-tuple rules, in-depth protocol analysis and time sorting, training samples and data sets are constructed, and twins are used. Convolutional neural networks are trained to implement timing anomaly detection, and a combined sample is constructed during the detection phase to capture packet continuity.
It can detect timing abnormalities with high accuracy without abnormal samples, improve the abnormal detection accuracy of the model, adapt to unknown exceptions, and maintain good training results when the data set is unbalanced.
Smart Images
Figure CN118631569B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of industrial control system security, and more specifically, discloses an industrial control system anomaly detection method based on session feature continuity. Background Art
[0002] Anomaly detection is crucial in current industrial control networks. With the rapid development of industrial automation and intelligence, the security threats faced by industrial control systems are increasing. Timely and effective detection and processing of anomalies are essential to ensure the stability and security of the system. Anomaly detection can not only help identify potential security threats, but also detect system failures in a timely manner, thereby preventing production losses and safety accidents.
[0003] Existing industrial control anomaly detection methods based on convolutional neural networks (also known as CNNs) have shown good results in dealing with complex and changing industrial control environments. These methods use the powerful feature extraction capabilities of CNNs to automatically extract features from large amounts of industrial control data and identify abnormal behaviors. Through multi-layer convolution and pooling operations, these methods can capture spatial features and local patterns in the data, making them very effective in detecting static anomalies.
[0004] However, these methods often require a balanced training data set to ensure the accuracy of detection. If the normal data and abnormal data in the training data set are unevenly distributed, the detection effect of the model may be greatly reduced. In addition, CNN-based methods usually have difficulty capturing time series anomalies, that is, it is difficult to handle the dynamic patterns and sequence dependencies of data changing over time. These limitations make existing methods face challenges in dealing with anomaly detection in actual industrial control environments.
[0005] Based on the above background, the present invention proposes an industrial control system anomaly detection method based on session feature continuity. The present invention utilizes the characteristics of the continuity of network data packet features in the same network session, can capture timing anomalies in network sessions, and the construction of training data sets does not require abnormal samples. A continuous sample pair construction method and an industrial control system anomaly detection method are designed. The problem that the existing industrial control anomaly detection method based on convolutional neural networks cannot capture timing anomalies and the training effect is poor when the training data set samples are unbalanced is solved, and an industrial control system anomaly detection method based on session feature continuity is provided. Summary of the invention
[0006] The purpose of the embodiment of the present application is to provide an industrial control system anomaly detection method based on session feature continuity, which solves the problem that the existing industrial control anomaly detection method based on convolutional neural network cannot capture timing anomalies and has poor training effect when the training data set samples are unbalanced. It has the characteristics of not requiring abnormal samples in the training stage, being able to detect timing anomalies, having high model anomaly detection accuracy, and being able to discover unknown anomalies.
[0007] To achieve the above objectives, this application provides the following technical solutions:
[0008] (1) In the data set preparation stage, when the industrial control system is operating normally, the traffic in the industrial control network is continuously collected to obtain the network data packet pcap file;
[0009] (2) Extract multiple network data packets in each session in the pcap file according to the five-tuple rule. The five-tuple refers to: source IP, destination IP, source port, destination port, and application layer network protocol;
[0010] (3) Perform deep protocol analysis on the network data packets in each session one by one to obtain the industrial control protocol data vector H = [h1, h2, h3, ..., h p ], the industrial control protocol data vector specifically includes the state values of sensors and actuators in the current industrial control system, h i Represents the i-th data in the industrial control protocol data vector. Specifically, deep protocol parsing refers to parsing the valid fields in the application layer message of the industrial control protocol one by one according to the rules specified in the protocol specification. P is the total number of sensors and actuators in the current industrial control system;
[0011] (4) According to the method described in step (3), multiple industrial control protocol data vectors H are extracted from the network data packet of each session. i , sort them by time to form an industrial control protocol data group HG = [H1, H2, H3, ..., H J ], where J is the total number of industrial control protocol data vectors obtained by parsing the network data packets in the current session one by one;
[0012] (5) In order, two industrial control protocol data vectors are selected from the industrial control protocol data group HG each time to form a training sample S = (H i , H i+1 ), then select the sample coordinate i and move it back one unit, and continue to select two industrial control protocol data vectors to form a training sample. i and H i+1 close in time series, so their features should be similar, i.e., features are continuous;
[0013] (6) Repeatedly select industrial control protocol data vectors according to step (5) to obtain multiple training samples [S1, S2, S3, ..., S J ]=[(H1, H2), (H2, H3)..., (H J-1 , H J )], where J is the total number of industrial control protocol data vectors obtained by parsing the network data packets in the current session one by one;
[0014] (7) According to the method of step (5) and step (6), training samples are extracted from the data packets of each session in the pcap file, and all the obtained training samples are combined into a training data set D = S1, S2, S3, ..., S N , where N is the total number of training samples obtained, and is also the total number of industrial control protocol data vectors obtained after parsing the network data packets in the current pcap file one by one;
[0015] (8) Use convolutional neural networks to build twin networks for industrial control anomaly detection. Specifically, the twin network consists of two convolutional neural networks with the same structure, and the two convolutional neural networks share weights;
[0016] (9) In the model training phase, samples in the training data set D are read one by one, and the i-th sample is represented as (H i , H i+1 ), input it into the twin network, H i As the input of X1 in the twin network, H i+1 As the input of X2 in the twin network;
[0017] (10) The two convolutional neural networks in the twin network output hash vectors f1 = F(X1) and f2 = F(X2) respectively, where f1 and f2 are two one-dimensional vectors of length Z, and Z is the length of the output vector of the convolutional neural network;
[0018] (11) Use the contrast loss function to calculate the loss value l of the twin network for the current sample:
[0019]
[0020] Among them, ||.||2 means taking the second norm, and f(i) means taking the i-th value of the output prediction result vector f;
[0021] (12) According to the sorting loss calculated in step (11), the parameters of the current model are updated using the stochastic gradient descent method to obtain the updated parameters θ of the convolutional neural network model. new :
[0022]
[0023] Where η is the learning rate, which is 0.001;
[0024] (13) According to step (5), since H i and H i+1 The features are continuous, and the hash vectors f1 and f2 output by the network should have similar features, so the training loss should be as small as possible. Repeat steps (11) to (12) until the training loss l is less than the set threshold, or the number of iterations reaches the maximum set number. Get the trained twin network
[0025] (14) In the anomaly detection stage, the traffic in the industrial control network is collected in real time, and the network data packets of each session in the traffic are extracted according to the five-tuple rule. The network data packets of each session are subjected to deep protocol analysis to obtain the session data frame at the current moment;
[0026] (15) If it is the first collection, the data frame obtained in step (14) is used as the current session data frame H1, otherwise the session data frame H′2 in the last constructed combined sample (H′1, H′2) is used as the current session data frame H1. This method realizes the function of constructing a combined sample on a sliding window with a length of 2 and a step size of 1, and the purpose is to detect the continuity between each data packet in the session and the next data packet, so as to more comprehensively detect anomalies in the industrial control system;
[0027] (16) Collecting the traffic in the industrial control network in the manner of step (14) to obtain a session data frame as the current session data frame H2;
[0028] (17) Combining the session data frame H1 and the session data frame H2 to form a combined sample;
[0029] (18) Repeat steps (15) and (17) to continuously obtain new combination samples (H1, H2);
[0030] (19) Inputting the combined sample obtained from step (18) into the anomaly detection model, if the output value of the model is greater than the set threshold, it indicates that the current industrial control system is abnormal, otherwise it is normal;
[0031] (20) The combined sample construction method described in steps (14) to (18) is only the processing flow of an independent session in the current network traffic, and other sessions are processed according to the same steps.
[0032] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention utilizes the continuous characteristics of network data packet features in the same network session, can capture timing anomalies in network sessions, and the construction of training data sets does not require abnormal samples, and designs a continuous sample pair construction method and an industrial control system anomaly detection method. The existing industrial control anomaly detection method based on convolutional neural networks cannot capture timing anomalies, and the training effect is poor when the training data set samples are unbalanced, and provides an industrial control system anomaly detection method based on session feature continuity. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0034] Figure 1 A flowchart of an industrial control system anomaly detection method based on session feature continuity is provided for the application.
[0035] Figure 2 This is a network structure diagram of the twin network used for training and performing anomaly detection in industrial control systems in the present invention. DETAILED DESCRIPTION
[0036] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.
[0037] The terms "comprises," "comprising," or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.
[0038] The terms "first", "second", etc. are only used to distinguish one entity or operation from another entity or operation, and should not be understood as indicating or implying relative importance, nor should they be understood as requiring or implying any such actual relationship or order between these entities or operations.
[0039] The basic idea of the present invention is that, under the normal operation of the industrial control system, the traffic in the industrial control network is continuously collected to obtain a network data packet pcap file, the network data packet of each session in the pcap file is extracted according to the five-tuple rule, and a training data set is constructed according to the continuous characteristics of the session features. A twin network is constructed using a convolutional neural network, and the twin network is trained using the training data set to obtain a trained industrial control anomaly detection model. In the anomaly detection stage, the traffic in the industrial control network is collected in real time, the network data packet of each session in the traffic is extracted according to the five-tuple rule, and a combined sample is constructed according to the continuous characteristics of the session features, and the combined sample is output to the industrial control anomaly detection model. If the output value of the model is greater than the set threshold, it indicates that the current industrial control system is abnormal, otherwise it is normal. The present invention utilizes the continuous characteristics of the network data packet features in the same network session, can capture the timing anomaly in the network session, and the construction of the training data set does not require abnormal samples, and designs a continuous sample pair construction method and an industrial control system anomaly detection method. The problem that the existing industrial control anomaly detection method based on convolutional neural networks cannot capture timing anomalies and the training effect is poor when the training data set samples are unbalanced is solved, and an industrial control system anomaly detection method based on session feature continuity is provided.
[0040] like Figure 1 As shown, the present invention provides an industrial control system anomaly detection method based on session feature continuity, comprising the following steps:
[0041] (1) In the data set preparation stage, when the industrial control system is operating normally, the traffic in the industrial control network is continuously collected to obtain the network data packet pcap file;
[0042] (2) Extract multiple network data packets in each session in the pcap file according to the five-tuple rule. The five-tuple refers to: source IP, destination IP, source port, destination port, and application layer network protocol;
[0043] (3) Perform deep protocol analysis on the network data packets in each session one by one to obtain the industrial control protocol data vector H = [h1, h2, h3, ..., h P ], the industrial control protocol data vector specifically includes the state values of sensors and actuators in the current industrial control system, h i Represents the i-th data in the industrial control protocol data vector. Specifically, deep protocol parsing refers to parsing the valid fields in the application layer message of the industrial control protocol one by one according to the rules specified in the protocol specification. P is the total number of sensors and actuators in the current industrial control system;
[0044] (4) According to the method described in step (3), multiple industrial control protocol data vectors H are extracted from the network data packet of each session. i , sort them by time to form an industrial control protocol data group HG = [H1, H2, H3, ..., H J ], where J is the total number of industrial control protocol data vectors obtained by parsing the network data packets in the current session one by one;
[0045] (5) In order, two industrial control protocol data vectors are selected from the industrial control protocol data group HG each time to form a training sample S = (H i , H i+1 ), then select the sample coordinate i and move it back one unit, and continue to select two industrial control protocol data vectors to form a training sample. i and H i+1 close in time series, so their features should be similar, i.e., features are continuous;
[0046] (6) Repeatedly select industrial control protocol data vectors according to step (5) to obtain multiple training samples [S1, S2, S3, ..., S J ]=[(H1, H2), (H2, H3)..., (H J-1 , H J )], where J is the total number of industrial control protocol data vectors obtained by parsing the network data packets in the current session one by one;
[0047] (7) According to the method of step (5) and step (6), training samples are extracted from the data packets of each session in the pcap file, and all the obtained training samples are combined into a training data set D = S1, S2, S3, ..., S N , where N is the total number of training samples obtained, and is also the total number of industrial control protocol data vectors obtained after parsing the network data packets in the current pcap file one by one;
[0048] (8) Use convolutional neural networks to build twin networks for industrial control anomaly detection. Specifically, the twin network consists of two convolutional neural networks with the same structure, and the two convolutional neural networks share weights. The specific structure is as follows Figure 2 As shown;
[0049] (9) In the model training phase, samples in the training data set D are read one by one, and the i-th sample is represented as (H i , H i+1 ), input it into the twin network, H i As the input of X1 in the twin network, H i+1 As the input of X2 in the twin network;
[0050] (10) The two convolutional neural networks in the twin network output hash vectors f1 = F(X1) and f2 = F(X2) respectively, where f1 and f2 are two one-dimensional vectors of length Z, and Z is the length of the output vector of the convolutional neural network;
[0051] (11) Use the contrast loss function to calculate the loss value l of the twin network for the current sample:
[0052]
[0053] Among them, ||.||2 means taking the second norm, and f(i) means taking the i-th value of the output prediction result vector f;
[0054] (12) According to the sorting loss calculated in step (11), the parameters of the current model are updated using the stochastic gradient descent method to obtain the updated parameters θ of the convolutional neural network model. new :
[0055]
[0056] Where η is the learning rate, which is 0.001 in this embodiment;
[0057] (13) According to step (5), since H i and H i+ 1. The features are continuous. The hash vectors f1 and f2 output by the network should have similar features, so the training loss should be as small as possible. Repeat steps (11) to (12) until the training loss l is less than the set threshold, or the number of iterations reaches the maximum set number. Get the trained twin network
[0058] (14) In the anomaly detection stage, the traffic in the industrial control network is collected in real time, and the network data packets of each session in the traffic are extracted according to the five-tuple rule. The network data packets of each session are subjected to deep protocol analysis to obtain the session data frame at the current moment;
[0059] (15) If it is the first collection, the data frame obtained in step (14) is used as the current session data frame H1, otherwise the session data frame H′2 in the last constructed combined sample (H′1, H′2) is used as the current session data frame H1. This method realizes the function of constructing a combined sample on a sliding window with a length of 2 and a step size of 1, and the purpose is to detect the continuity between each data packet in the session and the next data packet, so as to more comprehensively detect anomalies in the industrial control system;
[0060] (16) Collecting the traffic in the industrial control network in the manner of step (14) to obtain a session data frame as the current session data frame H2;
[0061] (17) Combining the session data frame H1 and the session data frame H2 to form a combined sample;
[0062] (18) Repeat steps (15) and (17) to continuously obtain new combination samples (H1, H2);
[0063] (19) Inputting the combined sample obtained from step (18) into the anomaly detection model, if the output value of the model is greater than the set threshold, it indicates that the current industrial control system is abnormal, otherwise it is normal;
[0064] (20) The combined sample construction method described in steps (14) to (18) is only the processing flow of an independent session in the current network traffic, and other sessions are processed according to the same steps.
[0065] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method for detecting anomalies in an industrial control system based on session feature continuity, characterized in that: The specific steps include: (1) In the data set preparation stage, when the industrial control system is operating normally, the traffic in the industrial control network is continuously collected to obtain the network data packet pcap file; (2) Extract multiple network data packets in each session in the pcap file according to the five-tuple rule. The five-tuple refers to: source IP, destination IP, source port, destination port, and application layer network protocol; (3) Perform deep protocol analysis on the network data packets in each session one by one to obtain the industrial control protocol data vector H = [h1, h2, h3, ..., h p ], the industrial control protocol data vector specifically includes the state values of sensors and actuators in the current industrial control system, h i represents the i-th data in the industrial control protocol data vector. Specifically, deep protocol parsing refers to parsing the application layer message of the industrial control protocol one by one according to the rules specified in the protocol specification to obtain the valid words in it. P is the total number of sensors and actuators in the current industrial control system; (4) According to step (3), multiple industrial control protocol data vectors H are extracted from the network data packet of each session. i , sort them by time to form an industrial control protocol data group HG = [H1, H2, H3, ..., H J ], where J is the total number of industrial control protocol data vectors obtained by parsing the network data packets in the current session one by one; (5) In order, two industrial control protocol data vectors are selected from the industrial control protocol data group HG each time to form a training sample S = (H i , H i+1 ), then select the coordinate i of the sample and move it back one unit, and continue to select two industrial control protocol data vectors to form a training sample, H i and H i+1 Close in time series, so H i and H i+1 The characteristics are similar, that is, the characteristics are continuous; (6) Repeatedly select industrial control protocol data vectors according to step (5) to obtain multiple training samples [S1, S2, S3, ..., S J ]=[(H1, H2), (H2, H3)..., (H J-1 , H J )], where J is the total number of industrial control protocol data vectors obtained by parsing the network data packets in the current session one by one; (7) According to the method of step (5) and step (6), training samples are extracted from the data packets of each session in the pcap file, and all the obtained training samples are combined into a training data set D = S1, S2, S3, ..., S N , where N is the total number of training samples obtained, and is also the total number of industrial control protocol data vectors obtained after parsing the network data packets in the current pcap file one by one; (8) Use convolutional neural networks to build twin networks for industrial control anomaly detection. The twin network consists of two convolutional neural networks with the same structure, and the two convolutional neural networks share weights; (9) In the model training phase, samples in the training data set D are read one by one, and the i-th sample is represented as (H i , H i+1 ), input it into the twin network, H i As the input of X1 in the first twin network, H i+1 As the input of X2 in the second twin network; (10) The two convolutional neural networks in the twin network output hash vectors f1 = F(X1) and f2 = F(X2) respectively, where f1 and f2 are two one-dimensional vectors of length Z, and Z is the length of the output vector of the convolutional neural network; F() is the contrast loss function; (11) Use the contrast loss function to calculate the loss value l of the twin network for the current sample: Among them, ||.||2 means taking the second norm, and f(i) means taking the i-th value of the output prediction result vector f; (12) According to the sorting loss calculated in step (11), the parameters of the current model are updated using the stochastic gradient descent method to obtain the updated parameters θ of the convolutional neural network model. new : Where θ refers to the original parameters of the convolutional neural network model; η is the learning rate, which is 0.001; (13) According to step (5), H i and H i+1 The features are continuous, the hash vectors f1 and f2 output by the network have similar features, and the training loss is as small as possible; repeat steps (11) to (12) until the training loss l is less than the set threshold, or the number of iterations reaches the maximum set number; obtain a trained twin network (14) In the anomaly detection stage, the traffic in the industrial control network is collected in real time, and the network data packets of each session in the traffic are extracted according to the five-tuple rule. The network data packets of each session are subjected to deep protocol analysis to obtain the session data frame at the current moment; (15) If it is the first collection, the data frame obtained in step (14) is used as the current session data frame H1, otherwise the session data frame H′2 in the last constructed combined sample (H′1, H′2) is used as the current session data frame H1, and H1′ refers to the last session data frame; this method realizes the function of constructing a combined sample on a sliding window with a length of 2 and a step size of 1, and the purpose is to detect the continuity between each data packet in the session and the next data packet, so as to more comprehensively detect anomalies in the industrial control system; (16) Collecting the traffic in the industrial control network in the manner of step (14) to obtain a session data frame as the current session data frame H2; (17) Combining the session data frame H1 and the session data frame H2 to form a combined sample; (18) Repeat steps (15) and (17) to continuously obtain new combination samples (H1, H2); (19) Inputting the combined sample obtained from step (18) into the anomaly detection model, if the output value of the model is greater than the set threshold, it indicates that the current industrial control system is abnormal, otherwise it is normal; (20) The combined sample construction method described in steps (14) to (18) is only the processing flow of an independent session in the current network traffic, and other sessions are processed according to the same steps.