False data injection and concealment test method, system and equipment for safety test of process industry system

Abstract

The invention discloses a false data injection and concealment inspection method, system and equipment for safety testing of a process industrial system, and belongs to the technical field of industrial control system automatic monitoring and process safety. The problem that safety testing and safety protection drilling are not comprehensive in safety detection of a process industrial system is solved. According to the method, historical data and online measurement data collected in an industrial process are analyzed, an attack vector is designed, a data sequence is generated by utilizing an online self-adaptive updating strategy, and then the data sequence is injected into an industrial control system running in real time. The state of the controlled system deviates from an expected value on the premise of not causing the detection system to generate additional alarm. According to the method, whether data injection has concealment or not is detected online, and whether the data injection is still valid or completely invalid or not can be judged from the perspective of defense of system security testing. The method is used for safety testing and safety protection drilling in safety detection of a process industry system.

Description

Technical Field

[0001] The present invention belongs to the technical field of automated monitoring of industrial control systems and process safety, and specifically relates to a covert false data injection method and a covertness inspection method for process industry system safety testing, as well as corresponding systems and equipment. Background Art

[0002] Industrial control systems (ICS) are widely used in key infrastructure of process industries such as petrochemicals and sewage treatment. Their security and reliability are increasingly receiving attention, and their stable operation is directly related to national security and social stability. With the popularization of smart sensors and the networking of a large number of physical devices, the physical devices and industrial processes controlled by ICS are more vulnerable to attacks and face more and more network security threats.

[0003] Traditional ICS security protection measures mainly rely on firewalls, intrusion detection systems, and anomaly detection systems. These protection measures can detect and isolate system failures while issuing alerts for external illegal behaviors such as denial of service attacks and spoofing attacks. However, when the network boundary defense is breached, the process control layer is directly faced with huge security and stability threats. Some carefully designed attacks can remain hidden from existing anomaly detection systems and not trigger alarms. Unlike spontaneous failures such as aging and damage of equipment, external attacks have clear intentions, and the attackers and defenders constitute a game relationship. In view of this background, the invention of a novel covert false data injection method and a concealment verification method is helpful in conducting ICS security protection drills and has important guiding significance for formulating targeted countermeasures. Summary of the invention

[0004] The present invention aims to solve the problem of incomplete safety testing and safety protection drills in process industry system safety detection.

[0005] A false data injection method for process industry system security testing comprises the following steps:

[0006] S100. For the controlled process of the process industry system, collect historical input and output data to build a training data set:

[0007] Step A1, sampling control instructions and sensor measurement data during a certain period of time under normal operating conditions, and recording the system input and system output column vector data corresponding to time k as u(k) and y(k), respectively;

[0008] Step A2: Set the equivalent vector ν in the equivalent space s The length is s, the time window size is N, and the Hankel data matrix Z corresponding to the past data is constructed p :

[0009]

[0010] Step A3: Based on time node k 0 , construct the future Hankel data matrix Z f :

[0011]

[0012] S200, Initialize attack vector:

[0013] Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix U Z (0), right singular matrix V Z (0) and the singular value matrix S Z (0), i.e. the matrix at the initial time k = 0;

[0014] Step B2: Take the left singular matrix U Z (0) The upper right corner submatrix, denoted as U Z12 , U Z12 The number of rows is s*m, and the number of columns is (s*mn); n is the number of state variables of the controlled process;

[0015] Step B3: Initialize the attack vector to

[0016] S400, Generate data sequence using attack vector:

[0017] Step D1, set a non-zero vector γ of arbitrary size;

[0018] Step D2: Calculate all data sequences, a s (k) = H a γ;

[0019] Step D3: Set the data injection sequence a corresponding to the qth sensor sq ; For q=1, 2, …, m, set a sq is a s (k) The vector consists of the (qs-s+1)th row to the qsth row;

[0020] S500, injecting the data sequence into the sensor output channel, including the following steps:

[0021] Step E1, finding the measurement value data packet in the sensor output network transmission channel and unpacking it;

[0022] Step E2: Inject data into sequence a sq The attacked measurement value is calculated by adding the original measurement value y(k) of the qth sensor data transmission channel in sequence. The tampered measurement value sequence is denoted as ysa (k);

[0023] Step E3: repackage the tampered data and resend it to the controller and fault detection system through the corresponding channel.

[0024] Furthermore, before performing the step of generating a data sequence using an attack vector in S400, if the attack adopts an adaptive strategy, it is necessary to collect online input and output data for the controlled process of the process industry system and update the attack vector, including the following steps:

[0025] Step C2: Obtain the input and output data sequences u(k-s+1), u(k-s+2), ..., u(k) and y(k-s+1), y(k-s+2), ..., y(k) at the latest s moments and construct a compact data format z s ;

[0026] Step C3, calculate the first-order perturbation matrix E(k), E(k) = z s (k)·z s (k) T , k represents the value of the matrix corresponding to the kth moment;

[0027] Step C4: Calculate the singular value update matrix U Z (k) is the left singular matrix, V Z (k) is a right singular matrix, k represents the value of the matrix corresponding to time k; the i-th element of the main diagonal of F(k) is f ii (k);

[0028] Step C5: According to F(k) and the singular value matrix S z The elements in (k) set the elements in the first updated auxiliary matrix G(k), for the element in the jth row and ith column:

[0029] If i≤j,

[0030] If i>j,

[0031] Among them, σ i (k) is S Z The i-th singular value in (k);

[0032] Similarly, according to F(k) and the singular value matrix S Z The elements in (k) set the elements in the second updated auxiliary matrix H(k): for the element in the jth row and ith column:

[0033] If i≤j,

[0034] If i>j,

[0035] Step C6: Update the singular value matrix S respectively Z (k+1), left singular matrix U z (k+1), right singular matrix V z (k+1), as follows:

[0036] S z (k+1)=diag{(σ i (k)+f ii (k))}

[0037] U Z (k+1)=U Z (k)(I+G(k))

[0038] V Z (k+1)=V Z (k)(I+H(k))

[0039] Where I is the identity matrix;

[0040] Step C7: Take the left singular matrix U Z (k+1) upper right corner submatrix, denoted as U z12 (k+1), the number of rows is s*m, and the number of columns is (s*mn);

[0041] Step C8: Set the attack vector to

[0042] Before step S400, if the adaptive strategy is adopted, then in the process of generating the data sequence using the latest calculated attack vector in S400, step D2 calculates all the data sequences a s (k) = H a H at γ a The calculation result in step C8 is adopted.

[0043] Further, step C2, constructing a compact data format z s as follows:

[0044]

[0045] A concealment inspection method is provided, which performs concealment inspection on false data injected by using a false data injection method for process industry system security testing; the concealment inspection process comprises:

[0046] Step F1, take H a The first row of the matrix is ​​denoted by ν s ; Take the left singular matrix U ZThe lower right corner submatrix has s*l rows and (s*mn) columns. The submatrix is ​​denoted as U Z22 ,Pick The first row of the matrix is ​​denoted by ν Hs ;

[0047] Step F2: Read the sensor measurement value sequence y that has been tampered with sa (k) The control input sequence at the corresponding sampling time is denoted as u s (k);

[0048] Step F3: Calculate the estimated value of the residual vector

[0049] Step F4: Perform residual evaluation and calculate the evaluation index T 2 Test statistic The covariance matrix of the residuals is Σ r Obtained through offline estimation;

[0050] Step F5: Conduct concealment determination:

[0051] Setting the threshold J based on the chi-square test statistic th = x α (n) / 2, where χ α (n) is the chi-square test statistic corresponding to the significance level α and the degrees of freedom n; if the evaluation index J is less than J th , the data injection attack implemented is concealed; otherwise, it is not concealed.

[0052] A false data injection system for process industry system security testing, comprising:

[0053] Historical data set construction module: For the controlled process of the process industry system, historical input and output data are collected to build a training data set. The specific process includes:

[0054] Step A1, sampling control instructions and sensor measurement data during a certain period of time under normal operating conditions, and recording the system input and system output column vector data corresponding to time k as u(k) and y(k), respectively;

[0055] Step A2: Set the equivalent vector ν in the equivalent space s The length is s, the time window size is N, and the Hankel data matrix Z corresponding to the past data is constructed p :

[0056]

[0057] Step A3: Based on time node k 0 , construct the future Hankel data matrix Z f :

[0058]

[0059] Attack vector initialization module: used to initialize the attack vector. The specific process includes:

[0060] Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix U Z (0), right singular matrix V Z (0) and the singular value matrix S Z (0), i.e. the matrix at the initial time k = 0;

[0061] Step B2: Take the left singular matrix U Z (0) The upper right corner submatrix, denoted as U Z12 , U Z12 The number of rows is s*m, and the number of columns is (s*mn); n is the number of state variables of the controlled process;

[0062] Step B3: Initialize the attack vector to

[0063] Attack data generation module: Generates data sequences using attack vectors. The specific process includes:

[0064] Step D1, set a non-zero vector γ of arbitrary size;

[0065] Step D2: Calculate all data sequences, a s (k) = H a γ;

[0066] Step D3: Set the data injection sequence a corresponding to the qth sensor sq ; For q=1,2,...,m, set a sq is a s (k) The vector consists of the (qs-s+1)th row to the qsth row;

[0067] Data injection module: Injects the data sequence into the sensor output channel, including the following steps:

[0068] Step E1, finding the measurement value data packet in the sensor output network transmission channel and unpacking it;

[0069] Step E2: Inject data into sequence a sq The attacked measurement value is calculated by adding the original measurement value y(k) of the qth sensor data transmission channel in sequence. The tampered measurement value sequence is denoted as y sa (k);

[0070] Step E3: repackage the tampered data and resend it to the controller and fault detection system through the corresponding channel.

[0071] Furthermore, the false data injection system for process industry system security testing also includes an online data update module;

[0072] Before the attack data generation module generates a data sequence using the attack vector, if the attack adopts an adaptive strategy, the online data update module is required to update the attack vector based on the online input and output data for the controlled process of the process industry system, including the following steps:

[0073] Step C2: Obtain the input and output data sequences u(k-s+1), u(k-s+2), ..., u(k) and y(k-s+1), y(k-s+2), ..., y(k) at the latest s moments and construct a compact data format z s ;

[0074] Step C3, calculate the first-order perturbation matrix E(k), E(k) = z s (k)·z s (k) T , k represents the value of the matrix corresponding to the kth moment;

[0075] Step C4: Calculate the singular value update matrix U Z (k) is the left singular matrix, V Z (k) is a right singular matrix, k represents the value of the matrix corresponding to time k; the i-th element of the main diagonal of F(k) is fi i (k);

[0076] Step C5: According to F(k) and the singular value matrix S Z The elements in (k) set the elements in the first updated auxiliary matrix G(k), for the element in the jth row and ith column:

[0077] If i≤j,

[0078] If i>j,

[0079] Among them, σ i (k) is S Z The i-th singular value in (k);

[0080] Similarly, according to F(k) and the singular value matrix S Z The elements in (k) set the elements in the second updated auxiliary matrix H(k): for the element in the jth row and ith column:

[0081] If i≤j,

[0082] If i>j,

[0083] Step C6: Update the singular value matrix S respectively Z (k+1), left singular matrix U Z (k+1), right singular matrix V Z (k+1), as follows:

[0084] S Z (k+1)=diag{(σ i (k)+f ii (k))}

[0085] U Z (k+1)=U Z (k)(I+G(k))

[0086] VZ(k+1)=VZ(k)(I+H(k))

[0087] Where I is the identity matrix;

[0088] Step C7: Take the left singular matrix U Z (k+1) upper right corner submatrix, denoted as U Z12 (k+1), the number of rows is s*m, and the number of columns is (s*mn);

[0089] Step C8: Set the attack vector to

[0090] In this case, the attack data generation module generates a data sequence using the latest calculated attack vector. Step D2 calculates all data sequences a s (k) = H a H at γ a The calculation result in step C8 is adopted.

[0091] Further, step C2, constructing a compact data format z s as follows:

[0092]

[0093] A false data injection device for process industry system safety testing, the device comprises a processor and a memory, the memory stores at least one instruction, the at least one instruction is loaded by the processor and runs the false data injection system for process industry system safety testing.

[0094] A concealment inspection system performs concealment inspection on false data injected by a false data injection system for process industry system security testing; the detection process of the concealment inspection system includes:

[0095] Step F1, take H a The first row of the matrix is ​​denoted by ν s ; Take the left singular matrix U Z The lower right corner submatrix has s*l rows and (s*mn) columns. The submatrix is ​​denoted as U Z22 ,Pick The first row of the matrix is ​​denoted by ν Hs ;

[0096] Step F2: Read the sensor measurement value sequence y that has been tampered with sa (k) The control input sequence at the corresponding sampling time is denoted as u s (k);

[0097] Step F3: Calculate the estimated value of the residual vector

[0098] Step F4: Perform residual evaluation and calculate the evaluation index T 2 Test statistic The covariance matrix of the residuals is Σ r Obtained through offline estimation;

[0099] Step F5: Conduct concealment determination:

[0100] Setting the threshold J based on the chi-square test statistic th = x α (n) / 2, where χ α (n) is the chi-square test statistic corresponding to the significance level α and the degrees of freedom n; if the evaluation index J is less than J th , the data injection attack implemented is concealed; otherwise, it is not concealed.

[0101] A concealment inspection device comprises a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded by the processor and runs the concealment inspection system.

[0102] The present invention has the following beneficial effects:

[0103] On the one hand, by forging or tampering with the system sensor data, the controlled process deviates from the ideal operating state without abnormal alarm. In order to improve the feasibility of actual deployment, the present invention adopts a data-driven method, which does not require the model parameters of the controlled system to be known in advance. The adaptive update of the attack vector is achieved through a recursive algorithm, thereby improving the online real-time performance. In addition, the present invention only needs to inject data on one side of the sensor output channel, which simplifies the complexity of implementing data injection.

[0104] On the other hand, the present invention also relates to a method for online verification of whether data injection is concealed, that is, whether the existing anomaly detection system can detect the behavior of data injection. From the perspective of the defender of the system security test, it can be determined whether it is still effective (can prompt abnormal behavior) or completely ineffective (the controlled industrial process still displays "no abnormality" when it is attacked). The main motivation of the present invention is to improve the overall security level of the process industry system, help identify and repair potential security vulnerabilities, and enhance the system's defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] Figure 1 It is a flowchart for false data injection and concealment inspection for process industry system security testing.

[0106] Figure 2 It is a structural block diagram of a process industry system.

[0107] Figure 3 It is a monitoring diagram showing the test statistic curve and the threshold value in the embodiment.

[0108] Figure 4 is the state variable curve of the controlled process in the embodiment. DETAILED DESCRIPTION

[0109] The present invention aims to solve the problem of incomplete safety testing and safety protection drills in process industry system safety detection, and proposes a novel covert false data injection method and a covertness verification method to help carry out system safety testing and safety protection drills, and improve the safety and protection capabilities of process industry systems.

[0110] The present invention provides an effective testing method for checking the security of process industrial systems. On the one hand, by forging or tampering with system sensor data, the controlled process deviates from the ideal operating state without abnormal alarms. Specifically, the present invention proposes a data-driven adaptive hidden data injection method. By analyzing the historical data and online measurement data collected in the industrial process, the attack vector is designed and the data sequence is generated by using the online adaptive update strategy, and then injected into the real-time industrial control system. Under the premise of not causing the detection system to generate additional alarms, the state of the controlled system deviates from the expected value. That is, by forging or tampering with the system sensor data, the controlled process deviates from the ideal operating state without abnormal alarms. In order to improve the feasibility of actual deployment, the present invention adopts a data-driven method, and does not need to know the model parameters of the controlled system in advance. The adaptive update of the attack vector is realized by a recursive algorithm, thereby improving the online real-time performance. In addition, the present invention only needs to inject data on one side of the sensor output channel, which simplifies the complexity of implementing data injection. In addition, on the other hand, the present invention also relates to a method for online testing whether data injection is concealed, that is, whether the existing abnormal detection system can detect the behavior of data injection. From the perspective of the defender of the system security test, it can be determined whether it is still effective (can prompt abnormal behavior) or completely ineffective (still displays "no abnormality" when the controlled industrial process is attacked). The following is an explanation in conjunction with a specific implementation method.

[0111] Specific implementation method 1: Combination Figure 1 and Figure 2 To explain this embodiment,

[0112] The implementation method is a false data injection and concealment verification method for process industry system security testing. This implementation method is aimed at the bottom layer of industrial control systems in process industries, and provides an easy-to-deploy and implement multi-stage method for its security protection drills, including a dormant design stage, a data injection stage, and a concealment verification stage.

[0113] In the dormant design phase, the input and output data sequences of the controlled process over a period of time are stolen to calculate the initial attack vector.

[0114] In the data injection phase, the attack vector is updated, the data sequence is generated, and the data sequence is injected.

[0115] The specific flow chart is as follows Figure 1 As shown, it is mainly achieved through the following steps:

[0116] Dormant Design Stage

[0117] The first step is to collect historical input and output data to build a training data set:

[0118] Step A1: For the controlled process of the process industry system, the control instructions and sensor measurement data are sampled and stored in the attacking server during a certain period of time under normal operating conditions. The control instructions are the system inputs, and the sensor measurement values ​​are the system outputs. The system input and system output column vector data corresponding to time k are recorded as u(k) and y(k), respectively. The number of rows of the system input and output column vectors are the number of control input quantities l and the number of output quantities m of the controlled system, respectively. The number of state variables of the controlled process is recorded as n.

[0119] Step A2: Set the equivalent vector v in the equivalent space s The length is s, the time window size is N, and the Hankel data matrix Z corresponding to the past data is constructed p (At a certain time node k in the past 0 As the boundary, the data before the node is taken as the past data, and the data after the node is taken as the future data. These data can be obtained from the historical database of industrial process operation):

[0120]

[0121] The parity space is a vector space composed of characteristic vectors under different fault modes of the system, which is used to characterize all possible fault states. The parity vector is a specific vector in the parity space, also called the parity vector, which represents the characteristic response of the system under a specific fault state and is used to identify and distinguish different fault modes.

[0122] Step A3: Set a positive integer k 0 , and construct the future Hankel data matrix Z f (At a certain time node k in the past 0 As the boundary, the data before the node is taken as the past data, and the data after the node is taken as the future data. These data can be obtained from the historical database of industrial process operation):

[0123]

[0124] Step 2: Initialize the attack vector:

[0125] Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix U Z (0), right singular matrix V Z (0) and the singular value matrix S Z (0), that is, the matrix at the initial time k = 0.

[0126] Step B2: Take the left singular matrix U Z (0) The upper right corner submatrix, denoted as U Z12, the number of rows is s*m, and the number of columns is (s*mn).

[0127] Step B3: Initialize the attack vector as

[0128] Data injection phase

[0129] Step 3: Collect online input and output data and update attack vectors:

[0130] Step C1: Based on the parameter changes, choose whether to enable the adaptive strategy. If enabled, execute steps C2 to C8; otherwise, go to step 4.

[0131] Step C2: Get the input and output data sequences u(k-s+1), u(k-s+2), ..., u(k) and y(k-s+1), y(k-s+2), ..., y(k) at the latest s moments, and construct a compact data format as follows:

[0132]

[0133] Step C3: Calculate the first-order perturbation matrix E(k), E(k) = z s (k)·z s (k) T , k represents the value of the matrix corresponding to time k.

[0134] Step C4: Calculate the singular value update matrix U Z (k) is the left singular matrix, V Z (k) is a right singular matrix, k represents the value of the matrix corresponding to time k; the i-th element of the main diagonal of F(k) is fi i (k);

[0135] Step C5: According to F(k) and the singular value matrix S Z The elements in (k) set the elements in the first updated auxiliary matrix G(k), for the element in the jth row and ith column:

[0136] If i≤j,

[0137] If i>j,

[0138] Among them, σ i (k) is S Z (k) is the i-th singular value in (k).

[0139] Similarly, according to F(k) and the singular value matrix S Z The elements in (k) set the elements in the second updated auxiliary matrix H(k): for the element in the jth row and ith column:

[0140] If i≤j,

[0141] If i>j,

[0142] Step C6: Update the singular value matrix S separately Z (k+1), left singular matrix U z (k+1), right singular matrix V Z (k+1), as follows:

[0143] S Z (k+1)=diag{(σ i (k)+f ii (k))}

[0144] U Z (k+1)=U Z (k)(I+G(k))

[0145] V Z (k+1)=V Z (k)(I+H(k))

[0146] Where I is the identity matrix.

[0147] Step C7: Take the left singular matrix U Z (k+1) upper right corner submatrix, denoted as U Z12 (k+1), the number of rows is s*m, and the number of columns is (s*mn).

[0148] Step C8: Set the attack vector to

[0149] Step 4: Generate a data sequence using the newly calculated attack vector:

[0150] Step D1: Set a non-zero vector γ of arbitrary size.

[0151] Step D2: Calculate all data sequences, a s (k) = H a γ, where if the adaptive strategy is started in step C1, then H a is the calculation result in step C8; if the adaptive strategy is not started in step C1, then H a is the calculation result in step B3.

[0152] Step D3: Set the data injection sequence a corresponding to the qth sensor sq For q=1, 2, ..., m, set a sq is a sThe (k) vector consists of the (qs-s+1)th row to the qsth row.

[0153] Step 5: Inject the data sequence into the sensor output channel:

[0154] Step E1: Find the measurement value data packet in the sensor output network transmission channel and unpack it.

[0155] Step E2: Inject data into sequence a sq The attacked measurement value is calculated by adding the original measurement value y(k) of the qth sensor data transmission channel in sequence. The tampered measurement value sequence is denoted as y sa (k).

[0156] Step E3: Repackage the tampered data and resend it to the controller and fault detection system through the corresponding channel.

[0157] Concealment inspection stage:

[0158] This part of the function is to check whether the data injection is concealed, that is, whether the existing anomaly detection system can detect the behavior of false data injection. From the perspective of the defender of the system security test, it can be determined whether it is still effective (can prompt abnormal behavior) or completely ineffective (the controlled industrial process still displays "no abnormality" when it is attacked). The specific steps of concealment inspection include:

[0159] Step F1: Get H a The first row of the matrix is ​​denoted by v s . Take the left singular matrix U Z The lower right corner submatrix has s*l rows and (s*mn) columns. The submatrix is ​​denoted as U Z22 ,Pick The first row of the matrix is ​​denoted by v Hs .

[0160] Step F2: Read the sensor measurement value sequence y that has been tampered with sa (k) The control input sequence at the corresponding sampling time is denoted as u s (k).

[0161] Step F3: Calculate the residual vector estimate

[0162] Step F4: Perform residual evaluation and calculate the evaluation index T 2 Test statistic The covariance matrix of the residuals is ∑ r Obtained through offline estimation.

[0163] Step F5: Conduct concealment judgment. Set threshold J based on chi-square test statistic th = xα (n) / 2, where χ α (n) is the chi-square test statistic corresponding to a significance level of α (usually 0.01 or 0.05) and n degrees of freedom. th , then the implemented data injection attack is concealed, and return to the third step; otherwise, the implemented data injection attack is not concealed, and return to the first step.

[0164] The present invention has the following advantages:

[0165] 1. Use data-driven methods to design attack vectors and data sequences without the need for precise mathematical models of the controlled process;

[0166] 2. The implementation method of the present invention only performs data injection in the data transmission network at the output end of the sensor, without the need for synchronous coordination on both the input and output sides of the controlled system, thereby reducing the complexity of implementation;

[0167] 3. In the data injection phase, the recursive singular value decomposition method is used to update the attack vector, which solves the problem of large amount of computation for online decomposition of large matrices, thereby improving real-time performance and ensuring the efficiency of the testing process.

[0168] Example

[0169] This implementation case is aimed at the DTS-200 three-tank simulation system. The system platform has the typical configuration and composition of the process control system, simulates the liquid level control problem in process control, and is a typical benchmark test platform for process monitoring and fault diagnosis. The system consists of three connected water tanks, and there are two independent water pumps to fill water into the water tanks on both sides. The water pump is the actuator of the controlled system, and the water injection flow is the control input variable u of this system; the end water tank has a water outlet, and each water tank is equipped with a liquid level sensor, which can measure the liquid level height of the corresponding water tank in real time, which is the output variable y of this system. The field data is transmitted to the host computer through the data acquisition card. The host computer software runs the process monitoring algorithm based on the equivalent space method and displays the process monitoring graph curve. Simulate data injection in the measured data of the host computer software. The controlled process runs stably at the working point at the initial moment, that is, the expected heights of the three water tank liquid levels are set to 45cm, 15cm, and 30cm respectively. In this example, data was collected at 3,000 moments in the dormant design phase, and 16,000 moments in the data injection phase, and data injection and concealment tests were performed. Data injection was performed from the 6,000th to the 9,000th moment in the data injection phase, using a method of gradually increasing the attack sequence from zero; no data was injected at other moments.

[0170] Dormant Design Stage

[0171] The first step is to collect historical input and output data to build a training data set. The specific steps include:

[0172] Step A1: Sample the input and output data corresponding to time k=1, 2, ..., 3000 under normal operating conditions. The number of control input quantities of the controlled system is 2, the number of output quantities is 3, and the number of state variables is 3.

[0173] Step A2: Set the length of the equivalent vector to 4 and construct the past Hankel data matrix Z p .

[0174] Step A3: Set a positive integer k 0 =500, and construct the future Hankel data matrix Z f .

[0175] Step 2: Initialize the attack vector. The specific steps include:

[0176] Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix, right singular matrix and singular value matrix.

[0177] Step B2: Take the upper right corner sub-block of the left singular matrix, denoted as U Z12 .

[0178] Step B3: Initialize the attack vector as

[0179] Data injection phase

[0180] Step 3: Collect online input and output data and update the attack vector. The specific steps include:

[0181] Step C1: Since the operating point of the controlled process does not change, the adaptive strategy is not enabled and the fourth step is executed.

[0182] Step 4: Generate a data sequence using the latest calculated attack vector. The specific steps include:

[0183] Step D1: Set non-zero vector

[0184] Step D2: Calculate all data sequences,

[0185]

[0186] Step D3: Set the data injection sequence corresponding to each sensor,

[0187] Step 5: From the 6000th to the 9000th moment, the data sequence is injected into the sensor output channel. The attack sequence is gradually increased proportionally from zero, that is, starting from zero with a slope of 3*10 -4 Gradually increase the attack amplitude.

[0188] Step E1: Find the measured value data in the sensor output network transmission channel.

[0189] Step E2: Add the data injection sequence and the original measured value of each sensor data transmission channel to obtain the attacked (tampered) measured value.

[0190] Step E3: Resend the tampered data to the controller and the fault detection system.

[0191] Concealment test phase

[0192] Step 6: Concealment test. The specific steps include:

[0193] Step F1: Set ν Hs =10 -4 *[-0.55 -0.54 0.01 0.02 -0.004 -0.0006 0 0]ν s

[0194] =10 4

[0195] *[-2.17 -3.04 4.28 -85.35 -83.45 168.84 2.17 3.04 -4.28 -0.06 -0.100.12]

[0196] Step F2: Reading the control input sequence corresponding to the tampered sensor measurement value sequence.

[0197] Step F3: Calculate an estimate of the residual vector.

[0198] Step F4: Perform residual evaluation and calculate the value of the test statistic.

[0199] Step F5: Make a concealment judgment. Set the threshold value to J th =3.9. Figure 3 As shown in the figure, the monitoring diagram shows the changes in the test statistics. It can be seen that the online indicators before and after the attack are basically below the threshold and will not trigger additional alarms from the fault detection system, verifying the concealment of the data injection attack.

[0200] In addition, by Figure 4 As shown, the three state variables of the controlled process have changed, and the liquid levels in the three water tanks have increased, reflecting the impact of the attack. Specific implementation method 2:

[0202] The implementation method is a false data injection and concealment verification system for process industry system security testing, which includes a false data injection system and a concealment verification system, which can be an integrated system or two separate systems; at the same time, the two systems can be arranged in an integrated manner or in a distributed manner.

[0203] in,

[0204] Inject false data into the system, including:

[0205] Historical data set construction module: For the controlled process of the process industry system, historical input and output data are collected to build a training data set. The specific process includes:

[0206] Step A1, sampling control instructions and sensor measurement data during a certain period of time under normal operating conditions, and recording the system input and system output column vector data corresponding to time k as u(k) and y(k), respectively;

[0207] Step A2: Set the equivalent vector ν in the equivalent space s The length is s, the time window size is N, and the Hankel data matrix Z corresponding to the past data is constructed p :

[0208]

[0209] Step A3: Based on time node k 0 , construct the future Hankel data matrix Z f :

[0210]

[0211] Attack vector initialization module: used to initialize the attack vector. The specific process includes:

[0212] Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix U Z (0), right singular matrix V Z (0) and the singular value matrix S Z (0), i.e. the matrix at the initial time k = 0;

[0213] Step B2: Take the left singular matrix U Z (0) The upper right corner submatrix, denoted as U Z12 , U Z12 The number of rows is s*m, and the number of columns is (s*mn); n is the number of state variables of the controlled process;

[0214] Step B3: Initialize the attack vector to

[0215] Online data update module: collects online input and output data, and determines whether to adopt an adaptive strategy. When an adaptive strategy is adopted, the attack vector is updated based on the online input and output data, including the following steps:

[0216] Step C2: Obtain the input and output data sequences u(k-s+1), u(k-s+2), ..., u(k) and y(k-s+1), y(k-s+2), ..., y(k) at the latest s moments and construct a compact data format z s ;

[0217]

[0218] Step C3, calculate the first-order perturbation matrix E(k), E(k) = z s (k)·z s (k) T , k represents the value of the matrix corresponding to the kth moment;

[0219] Step C4: Calculate the singular value update matrix U Z (k) is the left singular matrix, V Z (k) is a right singular matrix, k represents the value of the matrix corresponding to time k; the i-th element of the main diagonal of F(k) is f ii (k);

[0220] Step C5: According to F(k) and the singular value matrix S Z The elements in (k) set the elements in the first updated auxiliary matrix G(k), for the element in the jth row and ith column:

[0221] If i≤j,

[0222] If i>j,

[0223] Among them, σ i (k) is S Z The i-th singular value in (k);

[0224] Similarly, according to F(k) and the singular value matrix S Z The elements in (k) set the elements in the second updated auxiliary matrix H(k): for the element in the jth row and ith column:

[0225] If i≤j,

[0226] If i>j,

[0227] Step C6: Update the singular value matrix S respectively Z (k+1), left singular matrix U Z (k+1), right singular matrix V Z (k+1), as follows:

[0228] S Z (k+1)=diag{(σ i (k)+f ii (k))}

[0229] U Z (k+1)=U Z (k)(I+G(k))

[0230] V Z (k+1)=V Z (k)(I+H(k))

[0231] Where I is the identity matrix;

[0232] Step C7: Take the left singular matrix U Z (k+1) upper right corner submatrix, denoted as U Z12 (k+1), the number of rows is s*m, and the number of columns is (s*mn);

[0233] Step C8: Set the attack vector to

[0234] In this case, the attack data generation module generates a data sequence using the latest calculated attack vector. Step D2 calculates all data sequences a s (k) = H a H at γ a The calculation result in step C8 is adopted.

[0235] Attack data generation module: Generates data sequences using attack vectors. The specific process includes:

[0236] Step D1, set a non-zero vector γ of arbitrary size;

[0237] Step D2: Calculate all data sequences, a s (k) = H a γ; if the adaptive strategy is activated, then H a is the calculation result in step C8; if the adaptive strategy is not started, then H a is the calculation result in step B3;

[0238] Step D3: Set the data injection sequence a corresponding to the qth sensor sq ; For q=1,2,...,m, set asq is a s (k) The vector consists of the (qs-s+1)th row to the qsth row;

[0239] Data injection module: Injects the data sequence into the sensor output channel, including the following steps:

[0240] Step E1, finding the measurement value data packet in the sensor output network transmission channel and unpacking it;

[0241] Step E2: Inject data into sequence a sq The attacked measurement value is calculated by adding the original measurement value y(k) of the qth sensor data transmission channel in sequence. The tampered measurement value sequence is denoted as y sa (k);

[0242] Step E3: repackage the tampered data and resend it to the controller and fault detection system through the corresponding channel.

[0243] The concealment inspection system performs concealment inspection on the false data injected by the false data injection system; the detection process of the concealment inspection system includes:

[0244] Step F1, take H a The first row of the matrix is ​​denoted by v s ; Take the left singular matrix U Z The lower right corner submatrix has s*l rows and (s*mn) columns. The submatrix is ​​denoted as U Z22 ,Pick The first row of the matrix is ​​denoted by v Hs ;

[0245] Step F2: Read the sensor measurement value sequence y that has been tampered with sa (k) The control input sequence at the corresponding sampling time is denoted as u s (k);

[0246] Step F3: Calculate the estimated value of the residual vector

[0247] Step F4: Perform residual evaluation and calculate the evaluation index T 2 Test statistic The covariance matrix of the residuals is ∑ r Obtained through offline estimation;

[0248] Step F5: Conduct concealment determination:

[0249] Setting the threshold J based on the chi-square test statistic th = x α (n) / 2, where χ α(n) is the chi-square test statistic corresponding to the significance level α and the degrees of freedom n; if the evaluation index J is less than J th , the data injection attack implemented is concealed; otherwise, it is not concealed. Specific implementation method three:

[0251] This embodiment is a false data injection device for process industry system security testing, the device includes a processor and a memory, it should be understood that including any device including a processor and a memory described in the present invention, the device may also include other units and modules that perform display, interaction, processing, control, etc. and other functions through signals or instructions;

[0252] The memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to provide a false data injection system for safety testing of a process industry system. Specific implementation method four:

[0254] This embodiment is a concealment inspection device, which includes a processor and a memory. It should be understood that the device includes any device including a processor and a memory described in the present invention, and the device may also include other units and modules that perform display, interaction, processing, control, etc. and other functions through signals or instructions;

[0255] At least one instruction is stored in the memory, and the at least one instruction is loaded by the processor to run a concealment inspection system.

[0256] Whether it is a false data injection device for process industry system security testing described in Specific Implementation Method 3, or a concealment inspection device described in Specific Implementation Method 4, a person skilled in the art should understand that at least one instruction stored is a computer program product corresponding to the method or system. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0257] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems, and computer program products according to the embodiments of the present application, and may also be used for corresponding devices. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0258] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The functions specified in one or more boxes. It should be understood that the memory includes any readable medium on which instructions are stored, which may include but is not limited to magnetic storage media, optical storage media; magneto-optical storage media include read-only memory ROM, random access memory RAM, erasable programmable memory (e.g., EPROM and EEPROM) and flash memory layer, or other types of media suitable for storing electronic instructions.

[0259] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0260] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0261] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

[0262] The above calculation examples of the present invention are only used to explain the calculation model and calculation process of the present invention in detail, and are not intended to limit the implementation methods of the present invention. For ordinary technicians in the relevant field, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation methods here. All obvious changes or modifications derived from the technical solution of the present invention are still within the scope of protection of the present invention.

Claims

1. A false data injection method for process industry system security testing, characterized in that: The following steps are involved: S100. For the controlled process of the process industry system, collect historical input and output data to build a training data set: Step A1, sampling control instructions and sensor measurement data during a certain period of time under normal operating conditions, and recording the system input and system output column vector data corresponding to time k as u(k) and y(k), respectively; Step A2: Set the equivalent vector ν in the equivalent space s The length is s, the time window size is N, and the Hankel data matrix Z corresponding to the past data is constructed p : Step A3: Based on time node k0, construct the future Hankel data matrix Z f : S200, Initialize attack vector: Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix U Z (0), right singular matrix V Z (0) and the singular value matrix S Z (0), i.e. the matrix at the initial time k = 0; Step B2: Take the left singular matrix U Z (0) The upper right corner submatrix, denoted as U Z12 , U Z12 The number of rows is s*m, and the number of columns is (s*mn); n is the number of state variables of the controlled process; Step B3: Initialize the attack vector to S400, Generate data sequence using attack vector: Step D1, set a non-zero vector γ of any size; Step D2: Calculate all data sequences, a s (k) = H a γ; Step D3: Set the data injection sequence a corresponding to the qth sensor sq ; For q=1, 2, …, m, set a sq is a s (k) The vector consists of the (qs-s+1)th row to the qsth row; S500, injecting the data sequence into the sensor output channel, including the following steps: Step E1, finding the measurement value data packet in the sensor output network transmission channel and unpacking it; Step E2: Inject data into sequence a sq The attacked measurement value is calculated by adding the original measurement value y(k) of the qth sensor data transmission channel in sequence. The tampered measurement value sequence is denoted as y sa (k); Step E3: repackage the tampered data and resend it to the controller and fault detection system through the corresponding channel.

2. A false data injection method for process industry system security testing according to claim 1, characterized in that: Before performing the step of generating a data sequence using the attack vector in S400, if the attack adopts an adaptive strategy, it is necessary to collect online input and output data for the controlled process of the process industry system and update the attack vector, including the following steps: Step C2: Obtain the input and output data sequences u(k-s+1), u(k-s+2), ..., u(k) and y(k-s+1), y(k-s+2), ..., y(k) at the latest s moments and construct a compact data format z s ; Step C3, calculate the first-order perturbation matrix E(k), E(k) = z s (k)·z s (k) T , k represents the value of the matrix corresponding to the kth moment; Step C4: Calculate the singular value update matrix U Z (k) is the left singular matrix, V Z (k) is a right singular matrix, k represents the value of the matrix corresponding to time k; the i-th element of the main diagonal of F(k) is f ii (k); Step C5: According to F(k) and the singular value matrix S Z The elements in (k) set the elements in the first updated auxiliary matrix G(k), for the element in the jth row and ith column: If i≤j, If i>j, Among them, σ i (k) is S Z The i-th singular value in (k); Similarly, according to F(k) and the singular value matrix S Z The elements in (k) set the elements in the second updated auxiliary matrix H(k): for the element in the jth row and ith column: If i≤j, If i>j, Step C6: Update the singular value matrix S respectively Z (k+1), left singular matrix U Z (k+1), right singular matrix V Z (k+1), as follows: S Z (k+1)=diag{(σ i (k)+f ii (k))} U Z (k+1)=U Z (k)(I+G(k)) V Z (k+1)=V Z (k)(I+H(k)) Where I is the identity matrix; Step C7: Take the left singular matrix U Z (k+1) upper right corner submatrix, denoted as U Z12 (k+1), the number of rows is s*m, and the number of columns is (s*mn); Step C8: Set the attack vector to Before step S400, if the adaptive strategy is adopted, then in the process of generating the data sequence using the latest calculated attack vector in S400, step D2 calculates all the data sequences a s (k) = H a H at γ a The calculation result in step C8 is adopted.

3. A false data injection method for process industry system security testing according to claim 2, characterized in that: Step C2: Construct a compact data format z s as follows:

4. A concealment inspection method, characterized in that: A concealment check is performed on false data injected by a false data injection method for process industry system security testing according to any one of claims 1 to 3; the concealment check process comprises: Step F1, take H a The first row of the matrix is ​​denoted by ν s ; Take the left singular matrix U Z The lower right corner submatrix has s*l rows and (s*mn) columns. The submatrix is ​​denoted as U X22 ,Pick The first row of the matrix is ​​denoted by ν Hs ; Step F2: Read the sensor measurement value sequence y that has been tampered with sa (k) The control input sequence at the corresponding sampling time is denoted as u s (k); Step F3: Calculate the estimated value of the residual vector Step F4: Perform residual evaluation and calculate the evaluation index T 2 Test statistic The covariance matrix of the residuals is Σ r Obtained through offline estimation; Step F5: Conduct concealment determination: Setting the threshold J based on the chi-square test statistic th = x α (n) / 2, where χ α (n) is the chi-square test statistic corresponding to the significance level α and the degrees of freedom n; if the evaluation index J is less than J th , the data injection attack implemented is concealed; otherwise, it is not concealed.

5. A false data injection system for process industry system security testing, characterized in that: include: Historical data set construction module: For the controlled process of the process industry system, historical input and output data are collected to build a training data set. The specific process includes: Step A1, sampling control instructions and sensor measurement data during a certain period of time under normal operating conditions, and recording the system input and system output column vector data corresponding to time k as u(k) and y(k), respectively; Step A2: Set the equivalent vector ν in the equivalent space s The length is s, the time window size is N, and the Hankel data matrix Z corresponding to the past data is constructed p : Step A3: Based on time node k0, construct the future Hankel data matrix Z f : Attack vector initialization module: used to initialize the attack vector. The specific process includes: Step B1: Matrix Perform singular value decomposition and calculate the left singular matrix U Z (0), right singular matrix V Z (0) and the singular value matrix S Z (0), i.e. the matrix at the initial time k = 0; Step B2: Take the left singular matrix U Z (0) The upper right corner submatrix, denoted as U Z12 , U Z12 The number of rows is s*m, and the number of columns is (s*mn); n is the number of state variables of the controlled process; Step B3: Initialize the attack vector to Attack data generation module: Generates data sequences using attack vectors. The specific process includes: Step D1, set a non-zero vector γ of any size; Step D2: Calculate all data sequences, a s (k) = H a γ; Step D3: Set the data injection sequence a corresponding to the qth sensor sq ; For q=1, 2, …, m, set a sq is a s (k) The vector consists of the (qs-s+1)th row to the qsth row; Data injection module: Injects the data sequence into the sensor output channel, including the following steps: Step E1, finding the measurement value data packet in the sensor output network transmission channel and unpacking it; Step E2: Inject data into sequence a sq The attacked measurement value is calculated by adding the original measurement value y(k) of the qth sensor data transmission channel in sequence. The tampered measurement value sequence is denoted as y sa (k); Step E3: repackage the tampered data and resend it to the controller and fault detection system through the corresponding channel.

6. A false data injection system for process industry system security testing according to claim 5, characterized in that: The system also includes an online data updating module; Before the attack data generation module generates a data sequence using the attack vector, if the attack adopts an adaptive strategy, the online data update module is required to update the attack vector based on the online input and output data for the controlled process of the process industry system, including the following steps: Step C2: Obtain the input and output data sequences u(k-s+1), u(k-s+2), ..., u(k) and y(k-s+1), y(k-s+2), ..., y(k) at the latest s moments and construct a compact data format z s ; Step C3, calculate the first-order perturbation matrix E(k), E(k) = z s (k)·z s (k) T , k represents the value of the matrix corresponding to the kth moment; Step C4: Calculate the singular value update matrix U Z (k) is the left singular matrix, V Z (k) is a right singular matrix, k represents the value of the matrix corresponding to time k; the i-th element of the main diagonal of F(k) is f ii (k); Step C5: According to F(k) and the singular value matrix S Z The elements in (k) set the elements in the first updated auxiliary matrix G(k), for the element in the jth row and ith column: If i≤j, If i>j, Among them, σ i (k) is S Z The i-th singular value in (k); Similarly, according to F(k) and the singular value matrix S Z The elements in (k) set the elements in the second updated auxiliary matrix H(k): for the element in the jth row and ith column: If i≤j, If i>j, Step C6: Update the singular value matrix S respectively Z (k+1), left singular matrix U Z (k+1), right singular matrix V Z (k+1), as follows: S Z (k+1)=diag{(σ i (k)+f ii (k))} U z (k+1)=U z (k)(I+G(k)) V Z (k+1)=V Z (k)(I+H(k)) Where I is the identity matrix; Step C7: Take the left singular matrix U Z (k+1) upper right corner submatrix, denoted as U Z12 (k+1), the number of rows is s*m, and the number of columns is (s*mn); Step C8: Set the attack vector to In this case, the attack data generation module generates a data sequence using the latest calculated attack vector. Step D2 calculates all data sequences a s (k) = H a H at γ a The calculation result in step C8 is adopted.

7. A false data injection system for process industry system security testing according to claim 6, characterized in that: Step C2: Construct a compact data format z s as follows:

8. A false data injection device for process industry system security testing, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to execute a false data injection system for process industry system security testing as described in any one of claims 5 to 7.

9. A concealment inspection system, characterized in that: Conducting a concealment check on false data injected by a false data injection system for process industry system security testing as described in any one of claims 5 to 7; The detection process of the concealment inspection system includes: Step F1, take H a The first row of the matrix is ​​denoted by ν s ; Take the left singular matrix U Z The lower right corner submatrix has s*l rows and (s*mn) columns. The submatrix is ​​denoted as U X22 ,Pick The first row of the matrix is ​​denoted by ν Hs ; Step F2: Read the sensor measurement value sequence y that has been tampered with sa (k) The control input sequence at the corresponding sampling time is denoted as u s (k); Step F3: Calculate the estimated value of the residual vector Step F4: Perform residual evaluation and calculate the evaluation index T 2 Test statistic The covariance matrix of the residuals is Σ r Obtained through offline estimation; Step F5: Conduct concealment determination: Setting the threshold J based on the chi-square test statistic th = x α (n) / 2, where χ α (n) is the chi-square test statistic corresponding to the significance level α and the degrees of freedom n; if the evaluation index J is less than J th , the data injection attack implemented is concealed; otherwise, it is not concealed.

10. A concealment inspection device, characterized in that: The device comprises a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to execute the concealment inspection system according to claim 9.

Images