Abnormal traffic detection method and related device

Abstract

This application provides an abnormal traffic detection method and related equipment. The abnormal traffic detection method, applied to an industrial control system, includes: real-time acquisition of system traffic data from the industrial control system; the system traffic data includes kernel-level traffic data and user-level traffic data; identification and parsing of the system traffic data based on deep packet inspection technology to obtain protocol data within the system traffic data; conversion processing of the protocol data, and obtaining a test sequence based on the converted protocol data; inputting the test sequence into a pre-trained abnormal traffic identification model; and determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model. This method can automatically collect traffic data from the control system in real time and expands the sensing range, adapting to deployment needs of different scales; it can deeply analyze common network protocols, thus providing more diverse behavior patterns and adapting to more complex environments.

Description

Technical Field

[0001] This application relates to the field of power system information security technology, and in particular to an abnormal flow detection method and related equipment. Background Technology

[0002] Identifying anomalous behavior in a network is crucial for defending against malicious attacks and maintaining network security. Network attacks often leave traces in network traffic; therefore, anomaly detection based on network traffic is a common network security detection method.

[0003] In related technologies, there is a problem that the identification results for abnormal traffic in power industrial control networks are not accurate enough. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose an abnormal flow detection method and related equipment.

[0005] To achieve the above objectives, this application provides an abnormal flow detection method applied to an industrial control system, the method comprising:

[0006] Real-time acquisition of system flow data in industrial control systems; the system flow data includes kernel-level flow data and user-level flow data;

[0007] The system traffic data is identified and parsed using deep packet inspection technology to obtain the protocol data in the system traffic data.

[0008] The protocol data is converted, and the sequence to be tested is obtained based on the converted protocol data;

[0009] Input the sequence to be tested into a pre-trained abnormal traffic identification model;

[0010] Based on the output of the abnormal traffic identification model, it is determined whether the system traffic data is abnormal.

[0011] In some embodiments, the abnormal traffic identification model is an abnormal traffic detection model; determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model includes:

[0012] Obtain the predicted value of the sequence to be tested;

[0013] Based on the detected value output by the abnormal traffic detection model and the predicted value, the system traffic is determined to be abnormal traffic.

[0014] In some embodiments, the detection value includes the number of abnormal traffic data entries, and determining whether the system traffic data is abnormal based on the detection value and the predicted value includes:

[0015] In response to determining that the number of abnormal traffic data entries in the detected value is greater than the number of abnormal traffic data entries in the predicted value, the system traffic data is determined to be abnormal.

[0016] In some embodiments, the real-time acquisition of system flow data in the industrial control system includes:

[0017] Real-time acquisition of kernel layer flow data in industrial control systems using the data plane development kit;

[0018] Real-time acquisition of user-level traffic data in industrial control systems is achieved through XDP, which uses XML-based data encapsulation.

[0019] In some embodiments, the process of converting the protocol data and obtaining the sequence to be tested based on the converted protocol data includes:

[0020] Encode all sub-data fields in the protocol data to obtain status data;

[0021] The state data within a preset time period is sorted by time to obtain the sequence to be tested.

[0022] In some embodiments, encoding all sub-data fields in the protocol data includes:

[0023] The number of codes for a sub-data field is determined based on the number of changes in the sub-data field's value in the protocol data.

[0024] All sub-data fields in the protocol data are encoded according to the number of encodings of the sub-data fields.

[0025] In some embodiments, the protocol data includes application information; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data includes:

[0026] By identifying the port number and data packet structure in the system traffic data, the corresponding protocol data packet in the system traffic data can be obtained;

[0027] Extract the application information from the corresponding protocol data packets.

[0028] In some embodiments, the protocol data includes Modbus protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data includes:

[0029] Based on the Modbus protocol port number, packet structure, and packet properties, the Modbus protocol packets in the system traffic data are obtained;

[0030] Extract the device address, function code, data address, data quantity, and additional data or parameters from the Modbus protocol data packet.

[0031] In some embodiments, the abnormal traffic identification model is a traffic threshold prediction model; determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model includes: determining that the system traffic data is abnormal in response to determining that the traffic threshold output by the traffic threshold prediction model exceeds the threshold of the normal baseline.

[0032] This application embodiment also provides an abnormal flow detection device, applied to an industrial control system, the device comprising:

[0033] The acquisition module is used to acquire system flow data in the industrial control system in real time; the system flow data includes kernel layer flow data and user layer flow data.

[0034] The parsing module is used to identify and parse the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data;

[0035] The processing module is used to convert the protocol data and obtain the sequence to be tested based on the converted protocol data.

[0036] The input module is used to input the sequence to be tested into the pre-trained abnormal traffic identification model;

[0037] The judgment module is used to determine whether the system traffic data is abnormal based on the output of the abnormal traffic identification model.

[0038] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the preceding claims.

[0039] This application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing a computer to perform any of the methods described above.

[0040] This application also provides a computer program product, including computer program instructions that, when run on a computer, cause the computer to perform the method described in any of the preceding claims.

[0041] As can be seen from the above, the abnormal traffic detection method provided in this application can automatically collect and control system traffic data in real time and expand the sensing range, adapting to deployment needs of different scales. Furthermore, by utilizing deep packet inspection technology to analyze application layer data beyond the scope of ordinary detection, it can deeply analyze conventional network protocols, thus providing more diverse behavioral patterns and adapting to more complex environments. Through a pre-trained abnormal traffic identification model, more accurate identification results can be obtained, thereby identifying malicious signaling and reducing false positives and false negatives. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart illustrating the abnormal traffic detection method according to an embodiment of this application;

[0044] Figure 2 This is a schematic diagram illustrating the encoding of traffic data according to an embodiment of this application;

[0045] Figure 3 This is an architecture diagram of the traffic threshold prediction model in an embodiment of this application;

[0046] Figure 4 This is a schematic diagram of the modeling process of the abnormal traffic detection model in an embodiment of this application;

[0047] Figure 5 This is a schematic diagram illustrating the training of the abnormal traffic detection model according to an embodiment of this application;

[0048] Figure 6 This is another flowchart illustrating the abnormal traffic detection method according to an embodiment of this application;

[0049] Figure 7 This is a schematic diagram of the modeling process for the traffic threshold prediction model in an embodiment of this application;

[0050] Figure 8 This is a schematic diagram of an abnormal flow detection device according to an embodiment of this application;

[0051] Figure 9 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0053] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0054] Traffic detection based on normal behavior baselines is a behavior-based detection method that identifies anomalous behavior by establishing a baseline of normal behavior, thereby discovering potential malicious attacks. Before implementing this threat detection method, information needs to be collected from multiple sources, including the network, endpoints, network telemetry, identity services, and cloud services. This information, after preprocessing and standardization, can be used to train and optimize algorithms such as machine learning or statistical analysis to establish a baseline model that reflects normal behavior patterns. Once the normal behavior baseline is established, the collected real-time data can be compared with it to detect any anomalous behavior. If any threat is detected, the system immediately triggers an alarm response, allowing administrators to take appropriate defensive and countermeasure measures in a timely manner. Therefore, threat detection based on normal behavior baselines is a highly efficient and accurate method for detecting malicious attacks, helping organizations to promptly discover and respond to potential security threats.

[0055] Traffic-based abnormal behavior is divided into two stages: network traffic data collection and anomaly detection.

[0056] Among them, network traffic data is obtained by actively sending probe messages or passively collecting data through mirror ports, and traffic characteristics are extracted according to requirements, such as basic characteristics of connections, content characteristics of connections, and traffic statistics characteristics.

[0057] The core issue in anomaly detection algorithms is classifying normal traffic from abnormal traffic. Therefore, many security researchers are actively exploring detection methods that establish a baseline of normal behavior to identify abnormal behavior; that is, correctly establishing a behavioral baseline for normal traffic and filtering out abnormal traffic that deviates from this baseline. Current methods mainly include those based on statistical models, those based on supervised classification models, and those based on unsupervised models.

[0058] Statistical model-based detection methods are primarily applied to scenarios where data at anomaly points undergoes drastic changes. They detect anomalous traffic by using statistical features such as mean, variance, distribution, Hidden Markov Models, maximum entropy, and Gaussian distribution models to describe normal behavior. Statistical models require a learning period during which extracted traffic data is recorded and used to build the model.

[0059] Supervised classification models train a binary classifier based on currently acquired normal and abnormal traffic, and then use this binary classifier to classify unknown data. They can employ traditional machine learning models such as logistic regression, support vector machines, random forests, and gradient boosting trees, as well as deep learning models such as convolutional neural networks, long short-term memory networks, and deep residual networks. Traditional machine learning models have fewer parameters, lower requirements for sample data, lower resource consumption, and faster training speeds, but their learning capabilities are not as strong as deep learning models, and they rely on human experience for feature extraction. Deep learning models require large amounts of data for training, resulting in higher resource consumption, but their learning capabilities are strong, and they can directly utilize raw data to achieve end-to-end learning.

[0060] Compared to supervised classification models, unsupervised classification does not require training data, primarily utilizing online data for learning and detection. Commonly used unsupervised models include clustering, isolated forests, autoencoders, and generative adversarial networks. However, this method also requires a learning period. During the learning period, the system trains the model using data. During this phase, the model lacks detection capabilities. After the learning period ends, the model can be used to detect abnormal traffic.

[0061] However, while the aforementioned methods can learn features from traffic data, they lack a comprehensive preliminary traffic data collection scheme and fine-grained data identification and analysis strategies. Therefore, these technologies suffer from incomplete traffic data collection and inaccurate traffic data analysis, resulting in models with inaccurate traffic detection.

[0062] Based on this, embodiments of this application provide an abnormal traffic detection method and related equipment. By automatically collecting and controlling system traffic data in real time and expanding the sensing range, it can adapt to deployment needs of different scales. In addition, by utilizing deep packet inspection technology to analyze application layer data beyond the scope of ordinary detection, it can deeply analyze conventional network protocols, thus providing more diverse behavior patterns and adapting to more complex environments. This can, to a certain extent, solve the problem of insufficient accuracy in traffic detection of existing models.

[0063] Figure 1 A flowchart illustrating an exemplary abnormal traffic detection method according to an embodiment of this application is shown.

[0064] like Figure 1 As shown, this application provides an abnormal flow detection method applied to an industrial control system. Typically, the industrial control system can be an industrial control system within a power control network. The method may include:

[0065] S100, acquires system flow data in the industrial control system in real time; the system flow data includes kernel layer flow data and user layer flow data;

[0066] S200, based on deep packet inspection technology, identify and parse the system traffic data to obtain the protocol data in the system traffic data;

[0067] S300, the protocol data is converted and the sequence to be tested is obtained based on the converted protocol data;

[0068] S400, Input the sequence to be tested into the pre-trained abnormal traffic identification model;

[0069] S500 determines whether the system traffic data is abnormal based on the output of the abnormal traffic identification model.

[0070] The abnormal traffic detection method provided in this application can automatically collect system traffic data of the control system in real time and expand the sensing range, adapting to deployment needs of different scales. Furthermore, by utilizing deep packet inspection technology to analyze application layer data beyond the scope of ordinary detection, it can deeply analyze conventional network protocols, thus providing more diverse behavioral patterns and adapting to more complex environments. Through a pre-trained abnormal traffic identification model, more accurate identification results can be obtained, thereby identifying malicious signaling and reducing false positives and false negatives.

[0071] In step S100, in some embodiments, the real-time acquisition of system flow data in the industrial control system may include:

[0072] Real-time acquisition of kernel layer traffic data in industrial control systems is achieved using the DataPlane Development Kit (dpdk).

[0073] Real-time acquisition of user-level traffic data in industrial control systems is achieved through XDP (XML Data Package) technology, which encapsulates XML data.

[0074] In some embodiments, traffic acquisition includes an interface for acquiring mirrored data. Using technologies such as DPDK and XDP, traffic is acquired from the kernel or physical network card. On the hardware side, a general-purpose hardware network card is used to acquire photoelectric signals. After capturing and caching network traffic, multi-queue distribution can be completed through Really Simple Syndication (RSS).

[0075] In this way, the network behavior of all network hosts and online power devices can be detected, which facilitates the automatic detection and alerting of "suspicious" network traffic and behavior through the built-in analysis engine.

[0076] In step S200, in some embodiments, the protocol may include conventional Internet protocols such as HTTP, FTP, SMTP, POP3, IMAP, and SMB, and the Modbus protocol, a protocol used in industrial control systems. The protocol data may include application information. By identifying and parsing the system traffic data using deep packet inspection (DPI) technology, the protocol data within the system traffic data can be obtained. This can be achieved by identifying port numbers and packet structures within the system traffic data to obtain the corresponding protocol packets. User information can then be extracted from the corresponding protocol packets. Thus, deep packet inspection (DPI) technology can identify and parse layer 2-7 traditional network traffic and industrial control network traffic in the collected traffic data. Compared to ordinary packet inspection, which only analyzes IP packets below layer 4, DPI can simultaneously analyze source address, destination address, source port, destination port, protocol type, and application layer information within the data packets, enabling better identification of various application protocols and in-depth analysis of the content of each application protocol.

[0077] In some embodiments, the protocol data may include Modbus protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0078] Based on the Modbus protocol port number, packet structure, and packet properties, the Modbus protocol packets in the system traffic data are obtained;

[0079] Obtain one of the additional data and additional parameters, device address, function code, data address, and data quantity from the Modbus protocol data packet. That is, the protocol data packet includes a Modbus protocol data packet; the Modbus protocol data packet includes one of the additional data and additional parameters, device address, function code, data address, and data quantity.

[0080] Typically, the Modbus (Modbus TCP) protocol uses port 502. The format of a Modbus protocol packet can include the device address, function code, data, and checksum (such as CRC checksum). The function code, along with the port number and packet format, indicates whether the packet is a Modbus request. The function code indicates the type of operation requested (such as reading coil status, writing to a single register, etc.), thus the nature of the packet can be determined by analyzing the function code.

[0081] In some embodiments, the protocol data may include HTTP protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0082] Based on the port number and packet structure of the HTTP protocol, identify the port number and packet structure in the system traffic data to obtain the HTTP protocol packets in the system traffic data;

[0083] Obtain the request method, request URL, response status code, and response content from the HTTP protocol data packet.

[0084] Typically, the HTTP protocol uses port 80. The data packet structure includes header information. By analyzing the packet header and the commonly used ports for this protocol, the HTTP protocol can be identified.

[0085] In some embodiments, the protocol data may include FTP protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0086] Based on the port number and data packet structure of the FTP protocol, the port number and data packet structure in the system traffic data are identified to obtain the FTP protocol data packets in the system traffic data;

[0087] Retrieve commands or responses from the FTP protocol data packets.

[0088] Typically, the FTP protocol uses port 21. The data packet structure includes header information. By analyzing the packet header and the commonly used port for this protocol, the FTP protocol can be identified. Commands in FTP protocol packets may include RETR or STOR, and responses may include status codes such as 220 or 250. Parsing these commands and responses reveals application information within the FTP session.

[0089] In some embodiments, the protocol data may include SMTP protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0090] Based on the port number and data packet structure of the SMTP protocol, the port number and data packet structure in the system traffic data are identified to obtain the SMTP protocol data packets in the system traffic data;

[0091] Retrieve the commands and responses from the SMTP protocol data packets.

[0092] The SMTP protocol is typically used for email transmission. The SMTP protocol uses port 25. The data packet structure includes header information. By analyzing the packet header and the commonly used port for this protocol, the SMTP protocol can be identified. Commands in SMTP protocol packets may include HELO, MAILFROM, RCPTTO, DATA, etc. By parsing these commands and responses, the email sending process can be traced.

[0093] In some embodiments, the protocol data may include POP3 protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0094] Based on the port number, packet structure, and packet nature of the POP3 protocol, the port number and packet structure in the system traffic data are identified, and the POP3 protocol packets in the system traffic data are obtained.

[0095] Obtain the commands and server responses from the POP3 protocol data packets.

[0096] POP3 is typically used to retrieve emails from a mail server. The POP3 protocol typically uses port 110. The data packet structure includes header information. By analyzing the packet header and the commonly used port for this protocol, the POP3 protocol can be identified. Commands in POP3 protocol packets may include USER, PASS, LIST, or RETR. By parsing these commands and responses, it's possible to understand how users retrieve and download emails.

[0097] In some embodiments, the protocol data may include IMAP protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0098] Based on the port number and packet structure of the IMAP protocol, the port number and packet structure in the system traffic data are identified to obtain the IMAP protocol packets in the system traffic data;

[0099] Retrieve commands from the IMAP protocol data packet.

[0100] Typically, the IMAP protocol allows users to manage emails online. The IMAP protocol typically uses port 143. The structure of the data packets reflects the protocol's characteristics. By analyzing the protocol-specific features and commonly used ports within the data packets, the IMAP protocol can be identified. Commands within IMAP protocol data packets may include LOGIN, SELECT, or FETCH. Parsing these commands reveals how users read, move, and delete emails online.

[0101] In some embodiments, the protocol data may include SMB protocol data; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data may include:

[0102] Based on the port number and packet structure of the SMB protocol, the port number and packet structure in the system traffic data are identified to obtain the SMB protocol packets in the system traffic data;

[0103] Obtain the request and response from the SMB protocol data packet.

[0104] Typically, the SMB protocol is primarily used for file and printer sharing. The SMB protocol can use port 445. The data packet structure can be categorized by its header information. By analyzing the header information and the commonly used ports for this protocol, the SMB protocol can be identified. IMAP protocol data packets can include requests and responses such as opening, reading, writing, and closing files, as well as printer management commands. Parsing these commands allows understanding of the operations performed on files and printers.

[0105] In some embodiments, when the DPI engine identifies data packets, it can match the data in the data packets with information about the corresponding protocol in the protocol library (such as port number, protocol characteristics, data packet structure, data packet header information, etc.) to identify data packets in system traffic data. Typically, the protocol library can be equipped in the DPI system.

[0106] In some embodiments, system traffic data parsing can be performed using tools such as Suricata or Wireshark. For example, the Suricata network security monitoring engine can perform deep protocol parsing and anomaly analysis on the collected raw packets to obtain advanced events, namely power control protocol logs and alarm logs. Vector (a high-performance observable data container / pipeline) can be used as a data extraction, transformation, and loading tool (ETL, extracttransformload) to transform the advanced events obtained from the network traffic data parsed by Suricata (an open-source network threat detection engine) and send them to the Elasticsearch (an open-source distributed full-text search engine) system for storage. Elasticsearch is used for storing and retrieving advanced events, and MySQL (an open-source cross-platform database management system) is used to store configuration parameters.

[0107] In step S300, the protocol data typically undergoes a series of preprocessing steps, including data cleaning, data segmentation, and type conversion, to obtain state data. The state data within a preset time period is then arranged according to a time series to obtain the test sequence.

[0108] In some embodiments, converting the protocol data and obtaining the sequence to be tested based on the converted protocol data may include:

[0109] Encode all sub-data fields in the protocol data to obtain status data;

[0110] The state data within a preset time period is sorted by time to obtain the sequence to be tested.

[0111] In some embodiments, for different protocols, corresponding sub-data fields can be extracted, that is, various sub-data fields included in the protocol itself can be extracted. Sub-data fields may include, for example, source address, destination address, protocol identifier, control information, data and checksum, or other error detection mechanisms. It is understood that different protocols may correspond to different field formats or different fields, but for any given type of protocol, the sub-data fields are usually fixed.

[0112] Taking the Modbus industrial control protocol as an example, this section explains the sub-data fields in the protocol. These can include eight fields, as shown in Table 1 below.

[0113] Table 1. Sub-data fields in the Modbus protocol for industrial control systems.

[0114] Fields meaning source Source IP address destination target IP address length Data length unitidentifier Lower position address functioncode Function code reference address Register start address wordcount Operation bits date Traffic Date

[0115] In some embodiments, encoding all sub-data fields in the protocol data may include: determining the number of encodings for each sub-data field based on the number of changing values ​​of the sub-data fields in the protocol data; and encoding all sub-data fields in the protocol data according to the number of encodings for each sub-data field.

[0116] Taking specific protocol data as an example, let's illustrate the value for determining the number of encodings for a sub-data field. For instance, for a specific protocol data (i.e., signaling information) "10.10.111.1,10.10.111.2,6,0,4,1536,4,2024.6.15", it contains a total of 8 sub-data segments. Each sub-data segment is encoded, with each sub-data segment represented by a numerical code. The number of encodings for each sub-data segment is the number of possible variations in that sub-data segment's value. The specific encoding can be as follows: Figure 2 As shown. In this way, each traffic flow can be constructed as a state.

[0117] In some embodiments, values ​​within the same interval can be encoded as the same value, thus avoiding inaccurate identification and enabling accurate identification of approximately periodic numerical sequences. Furthermore, voting can be used to determine values ​​near boundaries to address the potential for out-of-bounds behavior due to encoding near boundaries, thereby eliminating the impact of value fluctuations.

[0118] In some embodiments, the preset unit duration can be five seconds. Based on the original traffic packets, the total number of data packets within each five-second unit is counted, and these data packets are sorted according to the time sequence. This sorting can be tailored to the characteristics of the baseline in the industrial control network to obtain a state sequence.

[0119] In some embodiments, the state sequence can be a five-dimensional state sequence, which may include, for example, the total length of data packets within a unit time (five seconds), minimum value, maximum value, average value, and quantity statistics.

[0120] In step S400, the pre-trained abnormal traffic identification model can be either an abnormal traffic detection model or a traffic threshold prediction model. In some embodiments, the pre-trained abnormal traffic identification model can be an abnormal traffic detection model. The abnormal traffic detection model can include an LSTM detection model. Specifically, the LSTM-based model is used in a recurrent network, with each layer employing progressively decreasing neurons. The intermediate layers use ReLU as the activation function, and the output layer also uses the ReLU activation function. The loss function is MSE, and the optimizer is Adam.

[0121] In some of these embodiments, such as Figure 4As shown, the modeling process for the abnormal traffic detection model may include:

[0122] Add a first LSTM layer, and set the first number of neurons, the first activation function, and the structure of the first input; for example, the first number of neurons (units) can be 80; the first activation function (activation) can be ReLU, and the input structure (input_shape) can be (None.5).

[0123] Add a Dropout layer and set a probability value; for example, the probability value can be 0.25.

[0124] Add a second LSTM layer, and set the second number of neurons and the second activation function; for example, the second number of neurons (units) can be 80; the second activation function (activation) can be ReLU.

[0125] Add a fully connected layer and set the number of third neurons; for example, the number of third neurons in a fully connected Dense layer can be 1.

[0126] Add a third activation function; where the activation function can be ReLU.

[0127] Add a first loss function and set a first optimizer; the first loss function (loss) can be mse. The first optimizer (optimizer) can be adam, thus completing the construction of the LSTM-based model.

[0128] In some embodiments, Bayesian optimization algorithms can be incorporated into the prediction model. Specifically, optimizing a Long Short-Term Memory (Bayes-LSTM) network for data classification prediction using Bayesian optimization algorithms can improve the model's performance and accuracy.

[0129] Typically, the training dataset can be obtained as described in steps S100-S300 above, and the obtained training dataset can be stored in the elapticsearch database.

[0130] In some of these embodiments, such as Figure 5 and Figure 6 As shown, the training methods for the abnormal traffic detection model can include:

[0131] Acquire historical system traffic data from the industrial control system; the historical system traffic data includes historical traffic data from the kernel layer and historical traffic data from the user layer.

[0132] The historical system traffic data is identified and parsed using deep packet inspection technology to obtain the protocol data within the system traffic data.

[0133] The protocol data is transformed, and a training dataset is obtained based on the transformed data. Typically, the training dataset can be stored in an Elapticsearch database. Generally, protocol data requires a series of preprocessing steps, including data cleaning, data partitioning, and data transformation, to obtain state data. Using the sliding window approach, every 61 data points from all the acquired state data sorted by time series (the first 60 data points are used as input data, and the last data point is the label value representing the output value) are used to construct a training dataset. For normal training data, the state data consists entirely of positive samples; these generated states are stored as a whitelist of normal states, facilitating subsequent state detection. For training data obtained from advanced event transformations, all state data consists of negative samples.

[0134] The pre-built model is trained based on the training dataset to obtain the anomaly detection model.

[0135] In some embodiments, the detection values ​​may include: the number of abnormal traffic data entries present in the sequence to be tested, and the number of normal traffic data entries present in the sequence to be tested.

[0136] Correspondingly, in some embodiments, in step S500, the abnormal traffic identification model is an abnormal traffic detection model; determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model may include:

[0137] Obtain the predicted value of the sequence to be tested; typically, the predicted value can be obtained from an existing industrial system or from a trained traffic threshold prediction model.

[0138] Based on the detected values ​​output by the abnormal traffic detection model and the predicted values, it is determined whether the system traffic data is abnormal. Specifically, if the number of abnormal traffic data entries in the detected values ​​is greater than the number of abnormal traffic data entries in the predicted values, the system traffic data is determined to be abnormal.

[0139] This application also provides a method for constructing a traffic threshold prediction model. The traffic threshold prediction model can be a TCN-based model, and its network architecture can be, for example... Figure 3 As shown, the TCN-based model can be effectively used for time series data prediction tasks. It mainly combines extended convolution and causal convolution, and finally combines them into residual modules, which are then stacked to form the structure.

[0140] In some possible embodiments, in step S400, such as Figure 7 As shown, the modeling process for the traffic threshold prediction model may include:

[0141] Create the input and set the batch_shape of the input structure;

[0142] Add a TCN layer and set parameters such as nb_fiters and the fourth activation function activation;

[0143] Add a fully connected layer;

[0144] That is, to complete the construction of the TCN-based model;

[0145] A second loss function is added, and a second optimizer is set; the second loss function can be MSE. The second optimizer can be Adam, thus constructing a traffic threshold prediction model and an anomaly detection model.

[0146] In some possible implementations, a traffic threshold prediction model using an improved Bayesian optimization algorithm (IBOA) and a temporal convolutional neural network (TCN) can be employed. By introducing a temporal pattern attention mechanism (TPA) to extract the weights of each input feature, the temporal sequence of historical traffic threshold data can be improved. Furthermore, an invertible residual network can be introduced to reduce the memory usage during TCN model training. Finally, the Bayesian optimization algorithm is used to optimize the hyperparameters (kernel size K, inflation coefficient d) in the temporal convolutional network, enabling traffic threshold prediction after obtaining the optimal model.

[0147] In some possible embodiments, the training method for the traffic threshold prediction model may include:

[0148] Acquire historical system traffic data from the industrial control system; the historical system traffic data includes historical traffic data from the kernel layer and historical traffic data from the user layer.

[0149] The historical system traffic data is identified and parsed using deep packet inspection technology to obtain the protocol data within the system traffic data.

[0150] The protocol data is transformed, and a training dataset is obtained based on the transformed data. Typically, the training dataset can be stored in an Elapticsearch database. Generally, the protocol data requires a series of preprocessing steps, including data cleaning, data partitioning, and data transformation, to obtain state data. Using the sliding window approach, every 61 data points from all the acquired state data sorted by time series (where the first 60 data points are used as input data and the last data point is the label value representing the output value) are used to construct a training dataset. For example, if there are 100 statistical data points in the original historical traffic data, then there will be 41 training data points, where 41 is obtained by subtracting 60 from 100 and adding 1. When the actual dataset size is insufficient, the sliding window approach can be used to construct the training sample set. The aforementioned statistics (sum, average, max, min, and count) are obtained through various statistical algorithms, and these statistics are then used as the processed observation dataset. Then, a window with a width of 60 units is used to slide sequentially across the observation dataset to form the training dataset X = {x1, x2, ..., xn}. The observation immediately following the window forms the training dataset Y = {y1, y2, ..., yn}. Typically, each data point can have 5 dimensions, namely sum, average, max, min, and count. In practical applications, feature selection can also be performed, and data with different dimensions can be used.

[0151] Based on the training dataset, a pre-built model is trained to obtain the traffic threshold prediction model and anomaly detection model.

[0152] Thus, by adopting a TCN-based model, it can be effectively used for time series data prediction tasks. It mainly combines extended convolution and causal convolution, and finally combines them into residual modules, which are then stacked to form a structure.

[0153] Based on the same inventive concept, this application also provides an abnormal flow detection method, applied to an industrial control system, the method including:

[0154] Real-time acquisition of system flow data in industrial control systems; the system flow data includes kernel-level flow data and user-level flow data;

[0155] The system traffic data is identified and parsed using deep packet inspection technology to obtain the protocol data in the system traffic data.

[0156] The protocol data is converted, and the sequence to be tested is obtained based on the converted protocol data;

[0157] Input the sequence to be tested into a pre-trained abnormal traffic identification model;

[0158] Based on the output of the abnormal traffic identification model, it is determined whether the system traffic data is abnormal. The abnormal traffic identification model can be a traffic threshold prediction model. Typically, when the predicted value exceeds the threshold of the normal baseline, it is judged as abnormal, and when the predicted value does not exceed the threshold of the normal baseline, it is judged as normal. That is, determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model can include: determining that the system traffic is abnormal in response to determining that the traffic threshold output by the traffic threshold prediction model exceeds the threshold of the normal baseline.

[0159] A baseline typically provides a macroscopic view of network flow in a normal production environment. Under normal circumstances, the state of a 5G power grid network is stable, without drastic fluctuations. When a Distributed Denial-of-Service (DDoS) attack occurs, each attacking proxy host sends a large number of service request packets to the target host. These packets often consume significant system resources, causing the target host to be unable to provide normal services to users, leading to a crash. A large accumulation of packets within a short period causing a traffic spike, with a significant difference from the normal baseline, can be a marker of abnormal signaling. Since the baseline is a curve obtained by statistically analyzing data in chronological order, it can be considered a time-series data. Packet analysis in industrial control networks, also known as packet capture analysis, aims to gain a deeper understanding of a series of events occurring on the industrial control network. PCAP files obtained through Wireshark packet capture are a common network packet file storage format. By statistically analyzing the total number of packets within a certain time interval and arranging this data in chronological order, a statistical curve, or baseline, can be obtained. This baseline represents the network traffic situation in a production line under normal conditions. A security baseline can be seen as a basic line in data measurement, calculation, or location. In terms of information security, a security baseline can be considered as the minimum set that enables a system to operate. It represents the minimum performance and functional requirements. Based on the baseline generated under normal conditions, if the subsequent baseline to be tested is not within the control range of the previous baseline, an abnormal situation is very likely to have occurred.

[0160] The method in this application relies on DPDK and XDP technologies to collect real-time traffic data from power industrial control network systems and expands the sensing range, enabling it to adapt to deployment needs of different scales. Furthermore, it utilizes Deep Packet Inspection (DPI) technology to analyze application layer data beyond the scope of ordinary detection, allowing for in-depth analysis of conventional network protocols and thus providing more diverse behavioral patterns to adapt to more complex environments. Finally, the detection model aims to obtain a better normal baseline, thereby identifying malicious signaling and reducing false alarms and missed alarms.

[0161] This invention not only enhances the monitoring and analysis capabilities of power industrial control networks but also provides an efficient, accurate, and scalable solution for the field of network security, helping to ensure the safe and stable operation of critical infrastructure. The method provided in this application can be used to identify abnormal traffic and can adapt to scenarios such as traffic thresholds.

[0162] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0163] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0164] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0165] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0166] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0167] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0168] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides an abnormal flow detection device.

[0169] refer to Figure 8 The abnormal flow detection device 800 is applied to an industrial control system, and the device includes:

[0170] The acquisition module 810 is used to acquire system flow data in the industrial control system in real time; the system flow data includes kernel layer flow data and user layer flow data.

[0171] The parsing module 820 is used to identify and parse the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data;

[0172] The processing module 830 is used to convert the protocol data and obtain the sequence to be tested based on the converted protocol data.

[0173] Input module 840 is used to input the sequence to be tested into a pre-trained abnormal traffic identification model;

[0174] The judgment module 850 is used to determine whether the system traffic data is abnormal based on the output results of the abnormal traffic identification model.

[0175] In some embodiments, the abnormal traffic identification model is an abnormal traffic detection model; determining whether the system traffic data is abnormal based on the model's output includes:

[0176] Obtain the predicted value of the sequence to be tested;

[0177] Based on the detected value output by the abnormal traffic detection model and the predicted value, it is determined whether the system traffic data is abnormal.

[0178] In some embodiments, the detection value includes the number of abnormal traffic data entries, and determining whether the system traffic data is abnormal based on the detection value and the predicted value includes:

[0179] In response to determining that the number of abnormal traffic data entries in the detected value is greater than the number of abnormal traffic data entries in the predicted value, the system traffic data is determined to be abnormal.

[0180] In some embodiments, the real-time acquisition of system flow data in the industrial control system includes:

[0181] Real-time acquisition of kernel layer flow data in industrial control systems using the data plane development kit;

[0182] Real-time acquisition of user-level traffic data in industrial control systems is achieved through XDP, which uses XML-based data encapsulation.

[0183] In some embodiments, the process of converting the protocol data and obtaining the sequence to be tested based on the converted protocol data includes:

[0184] Encode all sub-data fields in the protocol data to obtain status data;

[0185] The state data within a preset time period is sorted by time to obtain the sequence to be tested.

[0186] In some embodiments, encoding all sub-data fields in the protocol data includes:

[0187] The number of codes for a sub-data field is determined based on the number of changes in the sub-data field's value in the protocol data.

[0188] All sub-data fields in the protocol data are encoded according to the number of encodings of the sub-data fields.

[0189] In some embodiments, the protocol data includes application information; the process of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data includes:

[0190] By identifying the port number and data packet structure in the system traffic data, the corresponding protocol data packet in the system traffic data can be obtained;

[0191] Extract the application information from the corresponding protocol data packets.

[0192] In some embodiments, the protocol data packet includes Modbus protocol data; the Modbus protocol data packet includes one of additional data and additional parameters, device address, function code, data address, and data quantity.

[0193] In some embodiments, the abnormal traffic identification model is a traffic threshold prediction model; determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model includes: in response to determining that the traffic threshold output by the traffic threshold prediction model exceeds the threshold of the normal baseline, the system traffic data is abnormal.

[0194] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0195] The apparatus described above is used to implement the corresponding abnormal traffic detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0196] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the abnormal traffic detection method described in any of the above embodiments.

[0197] Figure 9 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0198] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0199] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0200] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0201] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0202] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0203] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0204] The electronic devices described above are used to implement the corresponding abnormal traffic detection methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0205] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the abnormal traffic detection method as described in any of the above embodiments.

[0206] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0207] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the abnormal traffic detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0208] Based on the same inventive concept, corresponding to the abnormal traffic detection method described in any of the above embodiments, this disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to perform the abnormal traffic detection method. Corresponding to the execution entity for each step in each embodiment of the abnormal traffic detection method, the processor executing the corresponding step can belong to the corresponding execution entity.

[0209] The computer program product of the above embodiments is used to cause the computer and / or the processor to execute the abnormal traffic detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0210] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0211] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0212] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description.

[0213] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An abnormal flow detection method, characterized in that, The abnormal flow detection method, applied to industrial control systems, includes: Real-time acquisition of system flow data in industrial control systems; the system flow data includes kernel-level flow data and user-level flow data; The system traffic data is identified and parsed using deep packet inspection technology to obtain protocol data from the system traffic data; the protocol data includes application information. The protocol data is converted, and the sequence to be tested is obtained based on the converted protocol data; Input the sequence to be tested into a pre-trained abnormal traffic identification model; Based on the output of the abnormal traffic identification model, determine whether the system traffic data is abnormal; The step of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data includes: identifying the port number and packet structure in the system traffic data to obtain the corresponding protocol data packet in the system traffic data; and extracting the application information in the corresponding protocol data packet. The process of converting the protocol data and obtaining the test sequence based on the converted protocol data includes: encoding all sub-data fields in the protocol data to obtain status data; and sorting the status data within a preset time period according to time to obtain the test sequence. The abnormal traffic identification model is an abnormal traffic detection model; determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model includes: Obtain the predicted value of the sequence to be tested; Based on the detected value output by the abnormal traffic detection model and the predicted value, it is determined whether the system traffic data is abnormal; The detected value includes the number of abnormal traffic data entries; determining whether the system traffic data is abnormal based on the detected value output by the abnormal traffic detection model and the predicted value includes: In response to determining that the number of abnormal traffic data entries in the detected value is greater than the number of abnormal traffic data entries in the predicted value, the system traffic data is determined to be abnormal.

2. The abnormal flow detection method according to claim 1, characterized in that, The real-time acquisition of system flow data in the industrial control system includes: Real-time acquisition of kernel layer flow data in industrial control systems using the data plane development kit; Real-time acquisition of user-level traffic data in industrial control systems is achieved through XDP, which uses XML-based data encapsulation.

3. The abnormal flow detection method according to claim 1, characterized in that, Encoding all sub-data fields in the protocol data includes: The number of codes for a sub-data field is determined based on the number of changes in the sub-data field's value in the protocol data. All sub-data fields in the protocol data are encoded according to the number of encodings of the sub-data fields.

4. The abnormal flow detection method according to claim 1, characterized in that, The protocol data packet includes a Modbus protocol data packet; the Modbus protocol data packet includes one of the following: additional data and additional parameters, device address, function code, data address, and data quantity.

5. The abnormal flow detection method according to claim 1, characterized in that, The abnormal traffic identification model is a traffic threshold prediction model; The step of determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model includes: determining that the system traffic data is abnormal in response to determining that the traffic threshold output by the traffic threshold prediction model exceeds the threshold of the normal baseline.

6. An abnormal flow detection device, characterized in that, The device, used in industrial control systems, includes: The acquisition module is used to acquire system flow data in the industrial control system in real time; the system flow data includes kernel layer flow data and user layer flow data. The parsing module is used to identify and parse the system traffic data based on deep packet inspection technology to obtain protocol data in the system traffic data; the protocol data includes application information. The processing module is used to convert the protocol data and obtain the sequence to be tested based on the converted protocol data. The input module is used to input the sequence to be tested into the pre-trained abnormal traffic identification model; The judgment module is used to determine whether the system traffic data is abnormal based on the output of the abnormal traffic identification model. The step of identifying and parsing the system traffic data based on deep packet inspection technology to obtain the protocol data in the system traffic data includes: identifying the port number and packet structure in the system traffic data to obtain the corresponding protocol data packet in the system traffic data; and extracting the application information in the corresponding protocol data packet. The process of converting the protocol data and obtaining the test sequence based on the converted protocol data includes: encoding all sub-data fields in the protocol data to obtain status data; and sorting the status data within a preset time period according to time to obtain the test sequence. The abnormal traffic identification model is an abnormal traffic detection model; determining whether the system traffic data is abnormal based on the output of the abnormal traffic identification model includes: Obtain the predicted value of the sequence to be tested; Based on the detected value output by the abnormal traffic detection model and the predicted value, it is determined whether the system traffic data is abnormal; The detected value includes the number of abnormal traffic data entries. Determining whether the system traffic data is abnormal based on the detected value output by the abnormal traffic detection model and the predicted value includes: In response to determining that the number of abnormal traffic data entries in the detected value is greater than the number of abnormal traffic data entries in the predicted value, the system traffic data is determined to be abnormal.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as claimed in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1 to 5.

9. A computer program product comprising computer program instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 5.

Images