A Collaborative Defense Method for Industrial Control Systems Based on Bert Security Script Orchestration

Abstract

A collaborative defense method for industrial control systems based on BERT security script orchestration is presented. This method constructs a BERT security script orchestration model based on different attack types and corresponding security policies and protective measures within the industrial control system. For network attacks on the industrial control system detected in real-time by intrusion detection, it dynamically generates targeted security protection scripts and executes the security protection measures within the scripts. It also reconstructs and distributes access control actions in the industrial firewall and whitelist actions in the industrial control host whitelist protection software, thereby achieving flexible collaborative defense of multiple security technologies within the industrial control system. This invention, through the above method, orchestrates security protection scripts based on attack types, security policies, and protective measures, further organically integrating industrial intrusion detection technology, industrial firewall technology, and industrial control host whitelist protection technology, promoting mutual cooperation among different security technologies, and ensuring the overall security of the industrial control system.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology for industrial control systems, and more specifically to a collaborative defense method for industrial control systems based on Bert security script orchestration. Background Technology

[0002] With the continuous development and in-depth research of various network applications, network attacks such as computer viruses, Trojans, and hacker attacks are becoming increasingly rampant. Currently, network security incidents are entering a high-incidence period, severely impacting the production and daily life of the entire society. Industrial control systems, as a critical information infrastructure involving multiple industries, are an important component of modern production processes. However, with the development of networking and informatization in industrial control systems, the possibility of them being subjected to network attacks is rapidly increasing, and the impact on industrial control systems is showing an escalating trend.

[0003] In terms of security protection scope, current security protection technologies for industrial control systems mainly revolve around two aspects: industrial control network protection and industrial control terminal protection. Industrial control network protection primarily analyzes network communication interactions based on industrial control communication protocols, detecting and blocking attacks and intrusions in the industrial control network in real time, achieving network-level security zone isolation and protection. Typical protection technologies include industrial intrusion detection and industrial firewalls. Industrial control terminal protection often establishes a whitelist baseline in the operating system to protect executable programs and sensitive files, prohibiting the loading and execution of illegal files and preventing virus and Trojan infections. Typical protection technology is industrial control host whitelist protection software. While these security protection technologies can address some security issues in industrial control systems to a certain extent, with the continuous escalation and evolution of cybersecurity threats, relying solely on individual defensive measures is clearly insufficient to meet the current complex and ever-changing security needs. The lack of unified management and effective linkage mechanisms among these individual security protection technologies means that the functional limitations of various security products cannot effectively compensate for each other, resulting in insufficient overall security defense capabilities for industrial control systems. Summary of the Invention

[0004] A further objective of this invention is to provide a collaborative defense method for industrial control systems based on BERT security script orchestration. This method constructs a BERT security script orchestration model based on different attack types and corresponding security policies and protective measures within the industrial control system. For network attacks on the industrial control system detected in real-time by intrusion detection, it dynamically generates targeted security protection scripts and executes the security protection measures within the scripts. It also reconstructs and distributes access control actions in the industrial firewall and whitelist actions in the industrial control host whitelist protection software, thereby achieving flexible collaborative defense of multiple security technologies within the industrial control system. This invention, through the above method, orchestrates security protection scripts based on attack types, security policies, and protective measures, further organically integrating industrial intrusion detection technology, industrial firewall technology, and industrial control host whitelist protection technology. This promotes the mutual cooperation of different security technologies and ensures the overall security of the industrial control system from the perspective of collaborative defense of the industrial control network and industrial control equipment.

[0005] To achieve the above objectives, the technical solution adopted in this invention is: a collaborative defense method for industrial control systems based on Bert security script orchestration, the main steps of which are:

[0006] 1) Initialization preprocessing: Based on the industrial control network attacks identified in real time by intrusion detection, capture communication data, extract message samples, calculate attack feature vectors based on the extracted key feature information, perform one-hot encoding on the attack type, security policy and protection measures corresponding to the attack to form script tag vectors, and finally combine the attack feature vectors and script tag vectors to form script feature vectors.

[0007] The calculation process of the attack feature vector is as follows: Message samples are extracted from industrial communication data, key field data in the data packets are extracted as key feature information, all key feature information is combined into a multi-dimensional feature sequence, and then principal component analysis is used to reduce the dimensionality, finally forming the attack feature vector.

[0008] The script tag vector is formed as follows: For each type of attack, a security strategy and protection measures to defend against that type of attack are selected and set. The attack type, security strategy and protection measures are further combined into multi-label and multi-class data. Then, one-hot encoding is used to further process the data and transform it into a multi-dimensional binary vector to form the script tag vector.

[0009] The security strategy described is a method adopted in the process of defending against industrial network attacks, including filtering network traffic, implementing defense, auditing, encrypting sensitive information, remote data storage, operating system configuration, privileged process integrity, network segmentation, multi-factor authentication, restricting library loading, restricting access to network resources, credential access protection, restricting registry permissions, network intrusion prevention, and vulnerability exploitation protection.

[0010] The aforementioned protective measures refer to the actions performed by various security protection devices during the industrial network attack defense process. Specifically, the access control actions of the industrial firewall include adding basic packet filtering rules, changing basic packet filtering rules, changing basic packet filtering rules and logging the changes, adding industrial control rules, changing industrial control rules, changing industrial control rules and logging the changes, adding NAT rules, changing NAT rules, changing NAT rules and logging the changes, adding application layer packet filtering rules, changing application layer packet filtering rules, changing application layer packet filtering rules and logging the changes. The whitelist actions of the industrial control host whitelist protection software include adding file protection information, changing file permissions, changing file user group scope, changing file granting options, adding registry information, changing registry user group scope, changing registry granting options, and prohibiting processes from acquiring resources.

[0011] 2) Bert security script orchestration: Construct a Bert security script orchestration model, input attack feature vectors obtained from real-time analysis into the model, perform multi-label and multi-category classification, obtain script label vectors that are higher than a preset threshold through probability calculation, and finally generate security protection scripts.

[0012] The Bert security script orchestration model is constructed using a pre-training method. Industrial communication data of different known attack categories, along with their corresponding security policies and protection measures, are used as raw training samples. The raw training samples are then initialized and preprocessed to formulate raw scripts for model training. Finally, the Bert model is trained using the script feature vectors from the raw scripts to construct the optimal Bert security script orchestration model.

[0013] The processing flow of the BERT security script orchestration model is as follows:

[0014] 2.1) Input the attack feature vector obtained in real time into the embedding;

[0015] 2.2) Map the embedding results to query Q, key K, and value V matrices respectively;

[0016] 2.3) After passing through the multi-head attention layer and the feedforward neural network layer, the output features of the last layer of BERT encoding are input into the fully connected layer;

[0017] The multi-head attention layer uses the dot product attention function, calculated as follows:

[0018]

[0019] Where n is the depth of the attack feature vector, and T is the transpose of the matrix;

[0020] 2.4) The fully connected layer performs low-dimensional mapping on the output features of BERT encoding, calculates the probability of the mapped vector, and then compares the probability of a vector with a threshold. When the probability of a vector is greater than the preset threshold, the vector is identified as the final script tag vector and a security protection script is generated accordingly.

[0021] The probability calculation for a fully connected layer involves passing the mapped vector through a softmax function to further transform it into a probability distribution. The specific calculation formula is as follows:

[0022]

[0023] Among them, y j It is the j-th element in the mapped vector y, and e is the base of the natural logarithm.

[0024] 3) Security Protection Script Implementation: Check the rationality of the real-time generated security protection script. If it is rational, reconstruct and issue access control actions in the industrial firewall and whitelist actions in the industrial control host whitelist protection software according to the protection measures corresponding to the security protection script. If it is not rational, discard the security protection script and record it in the log.

[0025] The process for checking the reasonableness of newly generated security protection scripts is as follows: extract the script label vectors from the newly generated security protection scripts and match them one by one with the script label vectors in the original scripts used for model training. If the match is successful, the newly generated security protection scripts are considered reasonable; if the match is unsuccessful, the security protection scripts are discarded and logged.

[0026] The beneficial effects of this invention are as follows:

[0027] 1. This invention provides a collaborative defense method for industrial control systems based on Bert security script orchestration. This method applies large model technology to the collaborative defense of industrial control system security. By orchestrating security protection scripts, it guides industrial intrusion detection technology, industrial firewall technology, and industrial control host whitelist protection technology to cooperate and link with each other, thereby realizing automated collaborative defense of industrial control systems.

[0028] 2. This method can set multiple corresponding security policies and protection measures for each type of network attack. After a network attack is detected, a corresponding security protection script is generated for different attacks. Based on the script, different execution actions of various security protection equipment are automatically issued, making the defense against network attacks more precise and efficient.

[0029] 3. This method can dynamically generate security protection scripts that adapt to changes in network attacks, and reconstruct the execution actions of various security protection equipment based on the new scripts, thus giving the security defense of industrial control systems a certain degree of flexibility.

[0030] 4. This method enables security protection technologies deployed in different locations to work collaboratively through Bert security script orchestration, transforming the single-point, passive protection of industrial control systems into overall, proactive protection. Attached Figure Description

[0031] Figure 1 This is a schematic diagram illustrating an application and deployment embodiment of the method of the present invention in an industrial control system based on Modbus / TCP.

[0032] Figure 2 This is a schematic diagram of the basic model of the method of the present invention.

[0033] Figure 3 This is a schematic diagram of the main execution process of the initialization preprocessing in the method of the present invention.

[0034] Figure 4 This is a schematic diagram illustrating the main execution process of the Bert security script arrangement in the method of the present invention. Detailed Implementation

[0035] A collaborative defense method for industrial control systems based on Bert security script orchestration, comprising the following steps:

[0036] 1) Initialization preprocessing: Based on the industrial control network attacks identified in real time by intrusion detection, relevant communication data is captured, message samples are extracted, and attack feature vectors are calculated based on the extracted key feature information. At the same time, the attack type, security policy and protection measures corresponding to the attack are one-hot encoded to form a script tag vector. Finally, the attack feature vector and the script tag vector are combined into a script feature vector.

[0037] The calculation process of the attack feature vector is as follows: Message samples are extracted from industrial communication data, key field data in the data packets are extracted as key feature information, all key feature information is combined into a multi-dimensional feature sequence, and then the dimensionality is reduced by principal component analysis to finally form the attack feature vector.

[0038] The script tag vector is formed as follows: For each type of attack, select and set security strategies and protection measures to defend against that type of attack. Combine the attack type, security strategy and protection measures into multi-label multi-class data. Then, use one-hot encoding to further process the data and convert it into a multi-dimensional binary vector to form the script tag vector.

[0039] The security policy describes a series of measures and guidelines taken in the process of defending against industrial network attacks, including filtering network traffic, implementing defenses, auditing, encrypting sensitive information, remote data storage, operating system configuration, privileged process integrity, network segmentation, multi-factor authentication, restricting library loading, restricting access to network resources, credential access protection, restricting registry permissions, network intrusion prevention, and vulnerability exploitation protection.

[0040] The protective measures describe the actions performed by various security devices during the defense against industrial network attacks. Specifically, the access control actions of the industrial firewall include adding basic packet filtering rules, changing basic packet filtering rules, changing basic packet filtering rules and logging the changes, adding industrial control rules, changing industrial control rules, changing industrial control rules and logging the changes, adding NAT rules, changing NAT rules, changing NAT rules and logging the changes, adding application layer packet filtering rules, changing application layer packet filtering rules, changing application layer packet filtering rules and logging the changes. The whitelisting actions of the industrial control host whitelist protection software include adding file protection information, changing file permissions, changing file user group scope, changing file granting options, adding registry information, changing registry user group scope, changing registry granting options, and prohibiting processes from accessing resources.

[0041] 2) Bert security script orchestration: Construct a Bert security script orchestration model, input attack feature vectors obtained from real-time analysis into the model, perform multi-label and multi-category classification, obtain script label vectors that are higher than a preset threshold through probability calculation, and finally generate security protection scripts;

[0042] The Bert security script orchestration model is constructed using a pre-training method. Industrial communication data of different known attack categories, along with their corresponding security strategies and protection measures, are used to form the original training samples. The original training samples are then initialized and preprocessed to formulate the original scripts for model training. Finally, the script feature vectors in the original scripts are used to train the Bert model and construct the optimal Bert security script orchestration model.

[0043] The processing flow of the BERT security script orchestration model is as follows:

[0044] (1) Input the attack feature vector obtained in real time into the embedding;

[0045] (2) Map the embedding results to query Q, key K and value V matrices respectively;

[0046] (3) After passing through the multi-head attention layer and the feedforward neural network layer, the output features of the last layer of BERT encoding are input into the fully connected layer;

[0047] (4) The fully connected layer performs low-dimensional mapping on the output features of Bert encoding, calculates the probability of the mapped vector, and then compares the thresholds. When the probability of a certain vector is greater than the preset threshold, the vector is identified as the final script tag vector and a security protection script is generated accordingly.

[0048] The multi-head attention layer uses the dot product attention function, which is calculated as follows:

[0049]

[0050] Where n is the depth of the attack feature vector, and T is the transpose of the matrix.

[0051] The probability calculation for a fully connected layer involves passing the mapped vector through a softmax function to further transform it into a probability distribution. The specific calculation formula is as follows:

[0052]

[0053] Among them, y j It is the j-th element in the mapped vector y, and e is the base of the natural logarithm.

[0054] 3) Implementation of security protection scripts: The real-time generated security protection scripts are checked for reasonableness. If reasonable, the access control actions in the industrial firewall and the whitelist actions of the industrial control host whitelist protection software are reconstructed and issued according to the protection measures corresponding to the security protection scripts.

[0055] The process of checking the rationality of the newly generated security protection script is as follows: extract the script label vector in the newly generated security protection script and match it one by one with the script label vector in the original script used for model training. If the match is successful, the newly generated security protection script is considered to be reasonable; otherwise, the security protection script is discarded.

[0056] Example 1:

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] The method of this invention falls under the category of information security defense for industrial control systems. Figure 1This diagram illustrates a deployment embodiment of the method of the present invention in an industrial control system based on Mobus / TCP communication. As shown, industrial intrusion detection is deployed in the industrial control network to capture and analyze communication data throughout the network via third-party eavesdropping, detecting various potential attacks in real time. Industrial firewalls are deployed between various industrial control terminals (such as operator stations, engineer stations, HMIs, etc.) and controllers (such as PLCs, DCS controllers, RTUs, etc.) to block attacks and intrusions between them, achieving secure area isolation and protection at the network level. Industrial control host whitelist protection software is installed in various industrial control terminals to protect executable programs and sensitive files in the operating system. Security devices using the method of the present invention are deployed in the industrial control network, capable of capturing communication data in the network while maintaining communication connections with industrial intrusion detection, industrial firewalls, and industrial control host whitelist protection software. Based on the above deployment, the specific implementation process of the method of this invention is as follows: First, the industrial intrusion detection system monitors the Modbus / TCP communication data in the industrial control network in real time, identifies hidden attacks and intrusion behaviors, and sends alarm information, including attack type and intrusion time, to the security device applying this method, hereinafter referred to as the security collaboration device; then, the security collaboration device captures and analyzes relevant communication data based on the alarm information, performs initialization preprocessing to calculate the attack feature vector, and generates a security protection script for the attack through the Bert security script orchestration model; finally, based on the specific protection measures given in the security protection script, it reconstructs the access control actions and whitelist actions to defend against the attack, and sends them to the industrial firewall and the industrial control host whitelist protection software respectively, thus completing the collaborative defense of industrial intrusion detection, industrial firewall, and industrial control host whitelist protection software.

[0059] This invention provides a collaborative defense method for industrial control systems based on Bert security script orchestration. See also... Figure 2 This paper presents a basic model of a collaborative defense method for industrial control systems based on Bert security script orchestration. The model mainly consists of three parts: initialization preprocessing, Bert security script orchestration, and security protection script implementation. In the initialization preprocessing section, attack feature vectors and script label vectors are calculated and mapped one-to-one to form script feature vectors. These vectors are used to construct the Bert security script orchestration model during the model training phase and as input to the Bert security script orchestration model to generate security protection scripts during the real-time script generation phase. For the specific process of initialization preprocessing, please refer to [link to relevant documentation]. Figure 3As shown, when industrial intrusion detection detects an attack or intrusion, the method of this invention first captures the Modbus / TCP communication data stream between the industrial control terminal Modbus / TCP master station and the controller Modbus / TCP slave station. Message samples are extracted according to the Modbus / TCP communication protocol specifications, and key field data in the data packets are extracted as key feature information. These key field data include the source IP address, destination IP address, source port number, destination port number, function code, register address, and register status value of the Modbus / TCP data packets. Then, a multi-dimensional feature sequence of the same length is constructed using all key feature information, and Principal Component Analysis (PCA) is employed. Analysis performs PCA dimensionality reduction on the multidimensional feature sequences to obtain the principal component vector of each multidimensional feature sequence. The principal component vector is used as the attack feature vector. In addition, for attacks identified by intrusion detection, the attack type is determined, and security strategies and protective measures for defending against this type of attack are selected. The attack type, security strategy, and protective measures are further combined into multi-label, multi-class data. Then, one-hot encoding is used to further process the data, converting each data into a multidimensional binary vector. Each multidimensional binary vector is a script label vector. Finally, the attack feature vector and the script label vector are combined one by one to form the script feature vector.

[0060] For details on the execution process in the Bert security script orchestration section, please refer to [link / reference]. Figure 4 First, the attack feature vectors calculated in real time are embedded as input. Based on their respective weight matrices, corresponding Q, K, and V matrices are generated and input into the multi-head attention layer. The multi-head attention layer divides the input into multiple "heads," each with its own weight matrix. Then, the outputs of these heads are concatenated. For the i-th head, the dot product attention function is expressed as:

[0061]

[0062] Where n is the feature depth of the script vector, and T is the transpose of the matrix.

[0063] After residual connections and layer normalization, the output is input into a feedforward neural network layer to perform a linear transformation on the representation at each position. The output is then subjected to residual connections and layer normalization again. This process is repeated for the number of times equal to the number of layers in the BERT model. Finally, the output features of the last layer of BERT encoding are input into a fully connected layer. The fully connected layer performs a low-dimensional mapping on the output features of BERT encoding and then applies a softmax function to the mapped vector to further convert it into a probability distribution. The specific calculation formula is as follows:

[0064]

[0065] Among them, y j It is the j-th element in the mapped vector y, and e is the base of the natural logarithm.

[0066] The obtained probability distribution is used to identify the mapped vectors. When the probability of a certain vector is greater than a preset threshold, the vector is identified as the final script tag vector and a security protection script is generated. The security protection script specifies the security strategy and specific protection measures to defend against the corresponding attacks through the script tag vector.

[0067] In the implementation section of the security protection script, for the newly generated security protection script, the script tag vector in the script is extracted and matched one by one with the script tag vector in the original script used for model training. If the match is successful, the newly generated security protection script is considered reasonable; otherwise, the security protection script is discarded. If the newly generated security protection script is deemed reasonable, the access control actions in the industrial firewall and the whitelist actions in the industrial control host whitelist protection software are reconstructed according to the specific protection measures corresponding to the security protection script. For example, when the protection measure is to add a basic packet filtering rule, the method of this invention will use the key feature information in the data packet to generate a basic packet filtering rule, and then send the newly generated access control action and whitelist action to the industrial firewall and the industrial control host whitelist protection software, respectively. This completes the mutual cooperation and linkage between industrial intrusion detection, industrial firewall, and industrial control host whitelist protection software, realizing automated collaborative defense of the industrial control system.

Claims

1. A collaborative defense method for industrial control systems based on Bert security script orchestration, characterized in that, The main steps are as follows: 1) Initialization preprocessing: Based on the industrial control network attacks identified in real time by intrusion detection, capture communication data, extract message samples, calculate attack feature vectors based on the extracted key feature information, perform one-hot encoding on the attack type, security policy and protection measures corresponding to the attack to form script tag vectors, and finally combine the attack feature vectors and script tag vectors to form script feature vectors. 2) Bert security script orchestration: Construct a Bert security script orchestration model, input attack feature vectors obtained from real-time analysis into the model, perform multi-label and multi-category classification, obtain script label vectors that are higher than the preset threshold through probability calculation, and finally generate security protection scripts; In step 2), the Bert security script orchestration model is constructed using a pre-training method. Industrial communication data of different known attack categories, along with their corresponding security strategies and protection measures, are used to form the original training samples. The original training samples are then initialized and preprocessed to formulate the original scripts for model training. Finally, the script feature vectors in the original scripts are used to train the Bert security script orchestration model, thereby constructing the optimal Bert security script orchestration model. The processing flow of the Bert security script orchestration model in step 2) is as follows: 2.1) Input the attack feature vector obtained in real time into the embedding; 2.2) Map the embedding results to a query Q, key K, and value V matrix, respectively; 2.3) After passing through the multi-head attention layer and the feedforward neural network layer, the output features of the last layer of BERT encoding are input into the fully connected layer; The multi-head attention layer uses the dot product attention function, calculated as follows: Where n is the depth of the attack feature vector, and T is the transpose of the matrix; 2.4) The fully connected layer performs low-dimensional mapping on the output features of BERT encoding, calculates the probability of the mapped vector, and then compares the probability of a vector with a threshold. When the probability of a vector is greater than the preset threshold, the vector is identified as the final script tag vector and a security protection script is generated accordingly. The probability calculation for a fully connected layer involves passing the mapped vector through a softmax function to further transform it into a probability distribution. The specific calculation formula is as follows: Among them, y j It is the j-th element in the mapped vector y, and e is the base of the natural logarithm; 3) Security protection script implementation: Check the rationality of the real-time generated security protection script. If it is rational, reconstruct and issue the access control actions in the industrial firewall and the whitelist actions of the industrial control host whitelist protection software according to the protection measures corresponding to the security protection script. If it is not rational, discard the security protection script and record the log.

2. The collaborative defense method for industrial control systems based on Bert security script orchestration according to claim 1, characterized in that: In step 1), the calculation process of the attack feature vector is as follows: extract message samples from industrial communication data, extract key field data from the data packets as key feature information, combine all key feature information into a multi-dimensional feature sequence, and then use principal component analysis to reduce the dimensionality, finally forming the attack feature vector.

3. The collaborative defense method for industrial control systems based on Bert security script orchestration according to claim 1, characterized in that: The script tag vector formation process in step 1) is as follows: For each type of attack, select and set security strategies and protection measures to defend against that type of attack. Combine the attack type, security strategy and protection measures into multi-label multi-class data. Then, use one-hot encoding to further process the data and convert it into a multi-dimensional binary vector to form the script tag vector.

4. The collaborative defense method for industrial control systems based on Bert security script orchestration according to claim 3, characterized in that: The security strategy described is a method adopted in the process of defending against industrial network attacks, including filtering network traffic, implementing defense, auditing, encrypting sensitive information, remote data storage, operating system configuration, privileged process integrity, network segmentation, multi-factor authentication, restricting library loading, restricting access to network resources, credential access protection, restricting registry permissions, network intrusion prevention, and vulnerability exploitation protection.

5. The collaborative defense method for industrial control systems based on Bert security script orchestration according to claim 3, characterized in that: The aforementioned protective measures refer to the actions performed by various security protection devices during the industrial network attack defense process. Specifically, the access control actions of the industrial firewall include adding basic packet filtering rules, changing basic packet filtering rules, changing basic packet filtering rules and logging the changes, adding industrial control rules, changing industrial control rules, changing industrial control rules and logging the changes, adding NAT rules, changing NAT rules, changing NAT rules and logging the changes, adding application layer packet filtering rules, changing application layer packet filtering rules, changing application layer packet filtering rules and logging the changes. The whitelist actions of the industrial control host whitelist protection software include adding file protection information, changing file permissions, changing file user group scope, changing file granting options, adding registry information, changing registry user group scope, changing registry granting options, and prohibiting processes from acquiring resources.

6. The collaborative defense method for industrial control systems based on Bert security script orchestration according to claim 1, characterized in that: The rationality check process for the newly generated security protection script in step 3) is as follows: extract the script tag vector in the newly generated security protection script and match it one by one with the script tag vector in the original script used for model training. If the match is successful, the newly generated security protection script is considered to be reasonable; if the match is unsuccessful, the security protection script is discarded and logged.

Images