Construction method of adaptive intelligent chemical engineering height control interaction honeypot based on digital twinning

Abstract

The invention discloses a construction method of an adaptive intelligent chemical control height interaction honeypot based on digital twinning, and the method comprises the steps: constructing each virtual node in an industrial control service module based on a min icps frame in a physical layer of a honeypot system; collecting sensor data and event logs of field equipment, and providing the sensor data and event logs to the digital twin module to model a physical process; the information is transmitted to the industrial control service module; in a digital twinborn layer of the honeypot system, historical data and real-time data of an original honeypot system are collected and stored in a storage library, twinborn bodies of the original honeypot system are constructed, a monitoring module, a simulation and test module and an intelligent analysis module are added, environment data and attacker behavior data of the honeypot system are collected through the monitoring module, and the environment data and the attacker behavior data of the honeypot system are analyzed through the intelligent analysis module. After being preprocessed, the information is sent to the intelligent analysis module to be analyzed to obtain a result, and guidance is provided for response and honeypot configuration modification. The embodiment of the invention can improve flexibility and expansibility, and can be widely applied to the technical field of industrial control systems.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control systems, and in particular to a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins. Background Art

[0002] As industry enters the 4.0 era, digital transformation has become a key driver for improving manufacturing efficiency and productivity. This transformation has not only introduced advanced automation and intelligent technologies, but also spawned highly interconnected industrial control systems (ICS) and Internet of Things (IoT) devices, thus forming a complex Industrial Internet (IIoT) ecosystem. However, this interconnectivity also exposes industrial infrastructure to unprecedented cybersecurity risks.

[0003] In response to the increasing number of industrial control security threats, traditional security defense mechanisms, such as firewalls, intrusion detection systems (IDS) and anti-virus software, can resist external attacks to a certain extent, but they often focus on prevention and detection, and are slow to respond to attackers who have already infiltrated the internal network, and it is difficult to obtain the attacker's detailed information and motivations. In order to have a deeper understanding of the attacker's strategy and operation mode, security experts need to use more sophisticated tools and technologies. In this case, honeypot technology, as an active defense method, plays an increasingly important role in the protection of industrial control systems due to its unique functions and advantages.

[0004] Honeypots are essentially a well-designed decoy system. Their core mission is not to simply defend, but to deliberately attract attackers by simulating a real network environment or system in order to monitor and study their actions. Honeypots can be divided into high-interaction honeypots and low-interaction honeypots according to the level of industrial service simulation. Among them, low-interaction honeypots mainly simulate specific service components in the system, which are relatively simple to develop, deploy and reinforce, and only provide a narrow attack surface. For example, Conpot is a popular open source low-interaction honeypot that is specifically used to simulate devices in SCADA systems, such as programmable logic controllers (PLCs) and human-machine interfaces (HMIs). In contrast, high-interaction honeypots are built on real operating systems, integrate real service components or accurately simulate key functions of the operating system, and provide a broad attack surface. In addition, they can be divided into two types according to the implementation method: virtual and physical. Physical honeypots are deployed on real physical hardware, which may include actual servers, workstations or other network devices, running real operating systems and applications. The advantage of this type of honeypot is that it has high authenticity and can provide a richer attack surface, but it is expensive and complex to maintain. Virtual honeypots simulate real operating systems, applications, and services through software. This type of honeypot is more complex because it requires higher simulation accuracy. It must be realistic enough to effectively confuse and attract advanced attackers. Virtual honeypots are low-cost and easy to deploy and manage, but they also face challenges in simulation accuracy.

[0005] Digital twins refer to the creation of accurate virtual models of physical objects in digital space to facilitate monitoring, analysis and optimization of physical objects. Digital twin technology uses real-time data streams and historical data, and through modeling and simulation technology, it can accurately reflect the status and behavior of physical entities in a virtual environment. The application of digital twin technology in the industrial field can help better understand the working status of equipment, predict potential problems, and simulate and make decisions before testing and verification in the actual environment. In industrial control honeypots, digital twins are also often used to model physical processes to improve the simulation level of honeypots.

[0006] At present, the research on industrial control honeypots focuses on improving the interaction level of honeypots and data capture. However, the relevant technologies still have the following shortcomings:

[0007] 1. The configuration of the honeypot is determined at the time of deployment, and the modification of the configuration during the subsequent operation is not considered, which is not flexible enough.

[0008] 2. The related technologies use physical honeypots, which rely on actual hardware devices, have limited migration and scalability, and are difficult to modify in configuration. At the same time, the related methods identify threats based on historical data and preset models, and have limitations in their response and adaptability to new attack patterns. Summary of the invention

[0009] The main purpose of the embodiment of the present invention is to propose a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, so as to improve the flexibility and scalability of deployment, and to improve the response speed and adaptability to new attack modes.

[0010] To achieve the above purpose, one aspect of an embodiment of the present invention proposes a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, comprising the following steps:

[0011] In the physical layer of the honeypot system, each virtual node in the industrial control service module is constructed based on the mini icps framework; the sensor data and event logs of the field equipment are collected; the sensor data and event logs of the field equipment are provided to the digital twin module, and the digital twin module models the physical process; and the digital twin module transmits the physical process data to the industrial control service module to provide the attacker with industrial control services with a high degree of simulation;

[0012] In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical data of the original honeypot system and storing real-time data in the repository. Additional monitoring modules, simulation and testing modules, and intelligent analysis modules are added. The monitoring module collects environmental data of the honeypot system and attacker behavior data. The collected data is pre-processed and sent to the intelligent analysis module for analysis to obtain results, and guidance is provided for responses and modifications to the honeypot configuration.

[0013] In some embodiments, the sensor data of the field device includes sensor readings, operation logs, and maintenance records; providing the sensor data and event logs of the field device to the digital twin module, and the digital twin module modeling the physical process, includes the following steps:

[0014] Sensor readings, operation logs, and maintenance records are collected through sensors and data acquisition systems to create an accurate digital representation of the physical process;

[0015] Using advanced mathematical models and simulation technology, the collected data is transformed into a virtual model;

[0016] Maintain real-time synchronization between the digital twin and the physical entity, and reflect changes in the physical world in the digital model to provide attackers with a highly realistic view of the industrial site;

[0017] Among them, the virtual nodes include HMI modules and PLC modules.

[0018] In some embodiments, in the step of collecting historical data from the original honeypot system and storing real-time data in a repository, the real-time data includes system environment, configuration data, and network traffic.

[0019] In some embodiments, the model training process of the intelligent analysis module includes the following steps:

[0020] Use historical data to train the model offline and build a basic model;

[0021] The basic model is learned online using real-time data, model parameters are updated in real time, and an intelligent analysis module is obtained through training.

[0022] In some embodiments, the method further comprises:

[0023] By collecting the attacker's attack behavior data and honeypot environment data, the attacker's target host and the protocol used are predicted, and the network topology and the protocols opened by the target host are modified according to the prediction results;

[0024] Use network traffic analysis tools to extract attack features from the attacker's scanning packets;

[0025] The extracted attack features are preprocessed and converted into digital types as input features of the model.

[0026] In some embodiments, the honeypot environment data includes operating system version, hardware resources, network status, network topology, and open protocol services.

[0027] In some embodiments, the method further comprises the following steps:

[0028] According to the prediction results of the model in the intelligent analysis module, the open industrial control services and network topology in the original honeypot system are adjusted.

[0029] In some embodiments, adjusting the open industrial control services and network topology in the original honeypot system according to the prediction results of the model in the intelligent analysis module includes the following steps:

[0030] After the intelligent analysis module makes a prediction based on the current attacker's behavior and the honeypot environment, it sends the prediction results and the required historical data to the SDN controller in the original honeypot system;

[0031] When the SDN controller receives the prediction of attack behavior, it dynamically modifies the configuration;

[0032] The SDN controller opens the corresponding protocols and ports in the industrial control service module based on the predicted attack protocols that the honeypot may be subject to.

[0033] In some embodiments, after the SDN controller receives the prediction of the attack behavior, the dynamic modification of the configuration includes the following steps:

[0034] The SDN controller receives the prediction results and opens the corresponding protocols and ports based on the prediction results;

[0035] Determine whether the target host that may be attacked is predicted. If so, add other nodes connected to the target host, extract relevant traffic from historical data and inject it into the target host, thereby completing the configuration modification of the honeypot system; if not, do not modify the topology.

[0036] To achieve the above objective, another aspect of an embodiment of the present invention provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0037] To achieve the above objective, another aspect of an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned method is implemented.

[0038] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0039] The embodiment of the present invention includes at least the following beneficial effects: the present invention provides a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, in the physical layer of the honeypot system, the scheme constructs each virtual node in the industrial control service module based on the mini icps framework; collects sensor data and event logs of field equipment; provides the sensor data and event logs of field equipment to the digital twin module, and the digital twin module models the physical process; and the digital twin module transmits the physical process data to the industrial control service module to provide the attacker with industrial control services with a high degree of simulation; in the digital twin layer of the honeypot system, by collecting historical data and real-time data of the original honeypot system and storing them in the repository, the twin of the original honeypot system is constructed, and additional monitoring modules, simulation and testing modules and intelligent analysis modules are added, and the environmental data of the honeypot system and the attacker behavior data are collected through the monitoring module, and the collected data is pre-processed and sent to the intelligent analysis module for analysis to obtain the results, and the response and modification of the honeypot configuration are guided. The embodiment of the present invention can improve the flexibility and scalability of deployment, and can improve the response speed and adaptability to new attack modes. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0041] Figure 2 is a flow chart of overall steps provided by an embodiment of the present invention;

[0042] Figure 3 It is a schematic diagram of an adaptive intelligent industrial control high-interaction honeypot framework based on digital twins provided by an embodiment of the present invention;

[0043] Figure 4 It is a schematic diagram of the training process of the intelligent analysis model based on online learning provided by an embodiment of the present invention;

[0044] Figure 5 It is a flow chart of dynamic configuration of honeypot based on intelligent analysis provided by an embodiment of the present invention;

[0045] Figure 6 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present invention. They are only examples of devices and methods consistent with some aspects of the embodiments of the present invention as detailed in the attached claims.

[0047] It is understood that the terms "first", "second", etc. used in the present invention may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0048] The terms "at least one", "multiple", "each", "any", etc. used in the present invention, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the present invention.

[0050] The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins provided in an embodiment of the present invention relates to the field of computer technology. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins provided in an embodiment of the present invention can be applied to a terminal, can be applied to a server, or can be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured to provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, etc., but is not limited to the above forms.

[0051] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0052] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0053] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0054] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0055] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc. The terminal 102 may also be a vehicle-mounted terminal of various device types described above, but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment of the present invention.

[0056] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins. The following is explained using the example of applying the method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins to server 101. It can be understood that the method can also be applied to terminal 102.

[0057] Reference Figure 2 , Figure 2 A flowchart of a method for constructing a digital twin-based adaptive intelligent industrial control high-interaction honeypot for a server provided in an embodiment of the present invention. The execution subject of the method can be any of the aforementioned computer devices (including servers or terminals). Figure 2 , the method may include the following steps:

[0058] In the physical layer of the honeypot system, each virtual node in the industrial control service module is constructed based on the mini icps framework; the sensor data and event logs of the field equipment are collected; the sensor data and event logs of the field equipment are provided to the digital twin module, and the digital twin module models the physical process; and the digital twin module transmits the physical process data to the industrial control service module to provide the attacker with industrial control services with a high degree of simulation;

[0059] In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical data of the original honeypot system and storing real-time data in the repository. Additional monitoring modules, simulation and testing modules, and intelligent analysis modules are added. The monitoring module collects environmental data of the honeypot system and attacker behavior data. The collected data is pre-processed and sent to the intelligent analysis module for analysis to obtain results, and guidance is provided for responses and modifications to the honeypot configuration.

[0060] In some embodiments, the sensor data of the field device includes sensor readings, operation logs, and maintenance records; providing the sensor data and event logs of the field device to the digital twin module, and the digital twin module modeling the physical process, includes the following steps:

[0061] Sensor readings, operation logs, and maintenance records are collected through sensors and data acquisition systems to create an accurate digital representation of the physical process;

[0062] Using advanced mathematical models and simulation technology, the collected data is transformed into a virtual model;

[0063] Maintain real-time synchronization between the digital twin and the physical entity, and reflect changes in the physical world in the digital model to provide attackers with a highly realistic view of the industrial site;

[0064] Among them, the virtual nodes include HMI modules and PLC modules.

[0065] In some embodiments, in the step of collecting historical data from the original honeypot system and storing real-time data in a repository, the real-time data includes system environment, configuration data, and network traffic.

[0066] In some embodiments, the model training process of the intelligent analysis module includes the following steps:

[0067] Use historical data to train the model offline and build a basic model;

[0068] The basic model is learned online using real-time data, model parameters are updated in real time, and an intelligent analysis module is obtained through training.

[0069] In some embodiments, the method further comprises:

[0070] By collecting the attacker's attack behavior data and honeypot environment data, the attacker's target host and the protocol used are predicted, and the network topology and the protocols opened by the target host are modified according to the prediction results;

[0071] Use network traffic analysis tools to extract attack features from the attacker's scanning packets;

[0072] The extracted attack features are preprocessed and converted into digital types as input features of the model.

[0073] In some embodiments, the honeypot environment data includes operating system version, hardware resources, network status, network topology, and open protocol services.

[0074] In some embodiments, the method further comprises the following steps:

[0075] According to the prediction results of the model in the intelligent analysis module, the open industrial control services and network topology in the original honeypot system are adjusted.

[0076] In some embodiments, adjusting the open industrial control services and network topology in the original honeypot system according to the prediction results of the model in the intelligent analysis module includes the following steps:

[0077] After the intelligent analysis module makes a prediction based on the current attacker's behavior and the honeypot environment, it sends the prediction results and the required historical data to the SDN controller in the original honeypot system;

[0078] When the SDN controller receives the prediction of attack behavior, it dynamically modifies the configuration;

[0079] The SDN controller opens the corresponding protocols and ports in the industrial control service module based on the predicted attack protocols that the honeypot may be subject to.

[0080] In some embodiments, after the SDN controller receives the prediction of the attack behavior, the dynamic modification of the configuration includes the following steps:

[0081] The SDN controller receives the prediction results and opens the corresponding protocols and ports based on the prediction results;

[0082] Determine whether the target host that may be attacked is predicted. If so, add other nodes connected to the target host, extract relevant traffic from historical data and inject it into the target host, thereby completing the configuration modification of the honeypot system; if not, do not modify the topology.

[0083] The implementation process of the present invention in a specific application scenario is described in detail below in conjunction with the accompanying drawings of the specification:

[0084] The existing industrial control honeypot solutions have the following main disadvantages:

[0085] (1) Insufficient adaptability to changes in system environment and behavior

[0086] Existing honeypot systems mainly focus on simulating specific network attack scenarios. The configuration of the honeypot system may have been determined at the time of deployment, which is difficult to modify in the subsequent process and lacks the ability to adapt to environmental changes. First, industrial control systems are dynamic and often adjust their configurations according to operational requirements or environmental conditions. For example, the configurations of PLCs and HMIs may change according to the needs of the production process. If the existing honeypot system cannot simulate this dynamicity, it will not be able to provide an interactive experience similar to that of a real system. Secondly, the existing fixed-configuration honeypot system can only simulate specific defense strategies, but cannot adapt to the attacker's ever-changing attack methods, which limits the breadth and depth of the system's defense capabilities.

[0087] (2) Lack of intelligent analysis

[0088] Existing honeypot systems have certain limitations in improving interactivity with attackers and intelligent analysis. Although traditional honeypots can collect attacker behavior data, they often require manual intervention to update configurations and adjust policies. This means that the response speed and adaptability of honeypot systems are limited when faced with ever-changing attack patterns. In addition, honeypots can usually only passively record attack activities and lack the ability to actively learn and self-optimize.

[0089] (3) Insufficient scalability and portability of physical honeypots

[0090] Physical honeypots have significant deficiencies in terms of scalability and portability, especially when it comes to data migration. Physical honeypots rely on actual hardware devices, which makes them complex and costly when it comes to expanding the capacity or functionality of the honeypot system. Adding new hardware or updating existing equipment requires time and expertise, which increases the difficulty of expansion. In addition, physical honeypots require specific location deployment, which means that if they need to be migrated to another place or network, hardware and network connections usually need to be reconfigured. Therefore, these data migration challenges increase the complexity and cost of migration, further limiting the capabilities of physical honeypots in terms of scalability and portability.

[0091] The reasons for the above shortcomings are:

[0092] The main reasons for the above deficiencies include: (1) Existing honeypot systems are configured as static settings when deployed and are not designed to self-adjust based on real-time data or changing conditions; (2) Existing honeypot systems rely on manual intervention to perform configuration updates and policy adjustments, and do not use machine learning or artificial intelligence technology to automatically analyze and respond to attack patterns; (3) In order to improve the realism of existing honeypot systems, some methods choose to use physical honeypots, but physical honeypots rely on specific hardware devices, which limits their ability to migrate between different environments or networks. In addition, their cost and resource consumption are also high.

[0093] In view of the problems of adaptability, intelligent analysis capability, scalability and portability of existing industrial control honeypot systems, this paper uses digital twin technology and combines online learning to propose a highly adaptable, intelligent and easy-to-migrate highly interactive industrial control system honeypot. The system can respond to environmental changes in real time and automatically adjust the configuration to simulate a highly realistic industrial control system; it integrates advanced machine learning algorithms to achieve rapid identification and self-optimization of attack behaviors; at the same time, it eliminates the dependence on physical hardware through virtualization technology, reduces costs, and improves the flexibility and deployability of the system.

[0094] Compared with the prior art, the present invention is aimed at solving the following problems:

[0095] (1) Design of an adaptive intelligent industrial control high-interaction honeypot framework based on digital twins. It is necessary to establish a linkage between the original honeypot system and the twin of the honeypot system to meet the adaptability requirements of the original honeypot system to system environment changes and attack behaviors.

[0096] (2) Construction of digital twin models of the physical process of the industrial site and the original honeypot system. The physical process of the industrial site is twinned to improve the realism, and the original honeypot system is twinned to provide a highly realistic scenario for the simulation and testing modules and the intelligent analysis module.

[0097] (3) Construction of intelligent analysis model. Using machine learning algorithms, we analyze the environmental data and attacker behavior in the original honeypot system, explore methods to modify the configuration of the honeypot system, and implement dynamic configuration of the honeypot to improve the interactivity and authenticity of the honeypot system.

[0098] Specifically, the present invention applies digital twin technology to industrial control honeypots to increase the dynamics of the honeypots and improve their degree of interaction. Figure 3As shown, the framework of the adaptive intelligent industrial control high-interaction honeypot based on digital twin of the present invention mainly includes two layers of structure: 1) physical layer of honeypot system; 2) digital twin layer of honeypot system. Among them, the original honeypot system is simulated and implemented based on the minicps framework, and each node is a virtual node. By collecting sensor data and event log capture of field equipment, it is provided to the data twin module, and the digital twin module models the physical process. The digital twin module transmits the physical process data to the industrial control service module to provide the attacker with industrial control services with a high degree of simulation. In the digital twin layer, by collecting historical data and real-time data of the original honeypot system and storing them in the repository, the twin of the original honeypot system is constructed, and additional monitoring modules, simulation and testing modules and intelligent analysis modules are added. The environmental data of the honeypot system and the attacker behavior data are collected through the monitoring module, and the collected data is pre-processed and sent to the intelligent analysis module for analysis to obtain the results, and the response and modification of the honeypot configuration are guided.

[0099] The present invention uses digital twin technology to simulate the physical process of industrial field equipment on the one hand, improve the fidelity of the original honeypot system, and on the other hand, build a twin of the original honeypot system, in which monitoring, simulation and intelligent analysis model training are carried out, and then the response and modification of the honeypot configuration are selected according to the trained model, so as to increase the dynamics of the honeypot and improve its interactivity. The composition of the device of the present invention can be divided into the construction of a digital twin model, model training of intelligent analysis and a dynamic configuration scheme of the honeypot based on intelligent analysis.

[0100] The following is a detailed description of the construction process of the digital twin model:

[0101] The construction of the digital twin model is the basis of this invention, which includes two parts: one is the digital twin of the physical process of the field equipment, and the other is the digital twin of the original honeypot system. Digital twin technology creates an accurate virtual copy of the physical entity based on real-time data and advanced modeling tools. It realizes real-time monitoring, analysis and prediction of the state and behavior of physical objects by integrating sensor data, computational models and simulation software.

[0102] First, in the original honeypot system layer, a digital twin is constructed for the physical process of the field equipment. Relevant data of the field equipment is collected, including but not limited to sensor readings, operation logs, maintenance records, etc. These data are collected through sensors and data acquisition systems to establish an accurate digital representation of the physical process. Then, advanced mathematical models and simulation technologies are used to convert the collected data into a virtual model. Finally, the digital twin is synchronized with the physical entity in real time to ensure that any changes in the physical world can be reflected in the digital model in a timely manner to provide attackers with a more realistic view of the industrial site. The remaining nodes in the original honeypot system, such as HMI modules and PLC modules, are virtual nodes implemented by simulation using the mini icps framework, and the industrial control protocols include a variety of industrial control protocols implemented using scripts.

[0103] Next, the digital twin of the original honeypot system is constructed. The original honeypot system continuously collects information about its operating status, including configuration data, network traffic, etc., and sends this data to the database, which stores the historical data and real-time data of the original honeypot system for subsequent processing and analysis. Next, the digital twin uses the collected data to replicate the current status and characteristics of the original honeypot, including the real-time system environment, network configuration, and network traffic. Then, on the basis of the twin, the monitoring module, simulation and testing module, and intelligent analysis module are added. The monitoring module is responsible for monitoring the environment of the honeypot system and the behavior of the attacker and collecting the required data, while preprocessing the data. The intelligent analysis module uses the data sent by the monitoring module to continuously update the training model through online learning. The model has the ability to self-learn and update, and can automatically adjust its own parameters according to the new data to improve the prediction accuracy and adaptability. The simulation and testing module can simulate various types of network attacks, and perform corresponding simulation verification in the twin according to the strategy made by the intelligent analysis module.

[0104] The following is a detailed description of the model training process of the intelligent analysis module:

[0105] In order to realize the dynamic configuration of honeypot and enhance the authenticity and adaptability of honeypot, the present invention adopts an online learning-based method to dynamically update the configuration of the original honeypot system. First, the model is trained offline using historical data to establish a basic model. After that, the model is learned online using real-time data to update the model parameters in real time. As time goes by, the attack data keeps changing and increasing, which makes online learning more suitable for attack behavior prediction of honeypot system.

[0106] The present invention collects the attacker's attack behavior data and the honeypot's environmental data to predict the attacker's target host and the protocol used, and modifies the network topology and the protocol opened by the target host according to the prediction results. Honeypot environmental data, including deployment information such as operating system version, hardware resources, network status, network topology, open protocol services, etc., serves as honeypot environmental features. Attack features are extracted from the attacker's scanned data packets using network traffic analysis tools. Finally, the extracted features are preprocessed and converted into digital types as input features of the model. The specific intelligent analysis model training process based on online learning is as follows: Figure 4 First, the initial model is established through offline learning using historical data. Later, when the monitoring module detects new attack behaviors, the relevant real-time data will be fed back to the model. Through continuous updates and iterations, the model can achieve better prediction results.

[0107] The following is a detailed description of the dynamic configuration scheme of the honeypot based on intelligent analysis:

[0108] The present invention adopts a dynamic idea to improve the interactivity and adaptability of the honeypot system, and adjusts the open industrial control services and network topology in the original honeypot system according to the prediction results of the model in the intelligent module.

[0109] After the intelligent analysis module makes a prediction based on the current attacker's behavior and the honeypot environment, it sends the prediction results and the required historical data to the SDN controller in the original honeypot system. When the SDN controller receives the prediction of the attack behavior, the dynamic modification of the configuration is as follows: Figure 5 As shown, the SDN controller will open the corresponding protocols and ports in the industrial control service module according to the predicted attack protocols that the honeypot may be subject to.

[0110] At the same time, based on the predicted target host that the attacker may attack, the SDN controller can modify the network topology accordingly for the target host, such as adding more inbound and outbound connections to the predicted target host to make it look more important and realistic. Specifically, other industrial control service nodes connected to the target host can be added, and the traffic patterns related to the target host can be extracted from historical data, and then these traffic can be injected into the target host to make it look like a busy server.

[0111] Honeypot systems in the prior art are often statically configured and difficult to adapt to environmental changes. In addition, configuration updates and policy adjustments of honeypot systems also rely heavily on manual intervention and expert knowledge. Digital twin technology focuses more on simulation of physical processes and has not yet been fully utilized to provide a highly realistic simulation environment for modifying honeypot configurations. The present invention applies digital twin technology to honeypot systems and combines it with online learning algorithms to train intelligent analysis models to achieve automated attack behavior prediction and dynamic adjustment of honeypot configurations, thereby improving the authenticity and interactivity of industrial control system honeypots.

[0112] Compared with the prior art, the present invention has the following characteristics:

[0113] 1. An adaptive intelligent industrial control high-interaction honeypot framework based on digital twins is proposed. The framework is based on digital twin technology and consists of two main layers: the original honeypot system layer and the digital twin layer of the honeypot system. The original honeypot system layer is implemented based on the mini icps framework and uses virtual nodes to simulate the various components of the industrial control system. The digital twin layer builds a twin of the original honeypot system and integrates monitoring, simulation, and intelligent analysis modules.

[0114] 2. The construction of a digital twin model of the original honeypot system is proposed. The twin can accurately reflect the state and behavior of the honeypot system, thereby providing a highly realistic simulation environment for monitoring, simulation and intelligent analysis modules.

[0115] 3. Propose an intelligent analysis model based on online learning. Using historical data and real-time data, the present invention constructs an intelligent analysis model that can self-learn and optimize. Through the online learning algorithm, the model can automatically adjust its own parameters to improve prediction accuracy and adaptability.

[0116] 4. Propose a dynamic configuration process of honeypot based on intelligent analysis. According to the prediction results of the intelligent analysis module, the present invention proposes a dynamic configuration process of honeypot, which automatically adjusts the open industrial control services and network topology in the honeypot system through the SDN controller to improve the authenticity and interactivity of the honeypot.

[0117] In summary, the modification of the configuration of existing industrial control honeypots mostly relies on manual intervention and expert knowledge, and there are deficiencies in adaptability to changes in system environment and attack behavior, intelligent analysis and scalability. The present invention can produce the following benefits:

[0118] 1. The present invention constructs a digital twin of the honeypot system and uses an online learning algorithm to continuously update the honeypot configuration, so that the honeypot can self-adjust according to real-time environmental changes and attack behaviors, thereby improving the adaptability and dynamics of the honeypot system. This method is different from the statically configured honeypot system in the prior art, which cannot be adaptively adjusted according to the changing environment and attack behaviors.

[0119] 2. By integrating machine learning algorithms to achieve intelligent analysis, the present invention achieves rapid identification and self-optimization of attack behaviors. Compared with traditional honeypot systems that can only passively record attack activities, the present invention can actively learn and self-optimize, improving the interactivity and defense efficiency of the honeypot system.

[0120] 3. By utilizing virtualization technology and the mini ICPs framework, the present invention eliminates the reliance on physical hardware, reduces costs, and improves the flexibility and deployability of the system.

[0121] The embodiment of the present invention further provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method for constructing the above-mentioned adaptive intelligent industrial control high-interaction honeypot based on digital twins when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0122] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0123] See also Figure 6 , Figure 6 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0124] The processor 601 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present invention.

[0125] The memory 602 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 602 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 602, and the processor 601 calls and executes the method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins in the embodiment of the present invention;

[0126] Input / output interface 603, used to implement information input and output;

[0127] Communication interface 604, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0128] Bus 605 , which transmits information between various components of the device (e.g., processor 601 , memory 602 , input / output interface 603 , and communication interface 604 );

[0129] The processor 601 , the memory 602 , the input / output interface 603 and the communication interface 604 are connected to each other in communication within the device via a bus 605 .

[0130] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method for constructing the above-mentioned adaptive intelligent industrial control high-interaction honeypot based on digital twins.

[0131] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0132] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] It should be noted that in various specific embodiments of the present invention, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present invention needs to obtain the user's sensitive personal information, it will obtain the user's separate permission or consent through a pop-up window or jump to a confirmation page, and after clearly obtaining the user's separate permission or consent, it will obtain the necessary user-related data for the normal operation of the embodiment of the present invention.

[0134] The embodiments described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. Those skilled in the art can appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0135] Those skilled in the art will appreciate that the technical solutions shown in the figures do not limit the embodiments of the present invention and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0136] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0137] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0138] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0139] It should be understood that in the present invention, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can represent: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0140] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0141] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0143] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store programs.

[0144] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the embodiments of the present invention is not limited thereby. Any modification, equivalent substitution and improvement made by those skilled in the art without departing from the scope and essence of the embodiments of the present invention shall be within the scope of the rights of the embodiments of the present invention.

Claims

1. A method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins, characterized in that: The following steps are involved: In the physical layer of the honeypot system, each virtual node in the industrial control service module is constructed based on the minicps framework; Collect sensor data and event logs of field devices; provide the sensor data and event logs of field devices to the digital twin module, which models the physical process; and transmit the physical process data to the industrial control service module by the digital twin module to provide the attacker with industrial control services with a high degree of simulation; In the digital twin layer of the honeypot system, a twin of the original honeypot system is constructed by collecting historical data of the original honeypot system and storing real-time data in the repository. Additional monitoring modules, simulation and testing modules, and intelligent analysis modules are added. The monitoring module collects environmental data of the honeypot system and attacker behavior data. The collected data is pre-processed and sent to the intelligent analysis module for analysis to obtain results, and guidance is provided for responses and modifications to the honeypot configuration.

2. According to claim 1, a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins is characterized in that: The sensor data of the field equipment includes sensor readings, operation logs, and maintenance records; providing the sensor data and event logs of the field equipment to the digital twin module, and the digital twin module modeling the physical process includes the following steps: Sensor readings, operation logs, and maintenance records are collected through sensors and data acquisition systems to create an accurate digital representation of the physical process; Using advanced mathematical models and simulation technology, the collected data is transformed into a virtual model; Maintain real-time synchronization between the digital twin and the physical entity, and reflect changes in the physical world in the digital model to provide attackers with a highly realistic view of the industrial site; Among them, the virtual nodes include HMI modules and PLC modules.

3. According to claim 1, a method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins is characterized in that: In the step of collecting historical data from the original honeypot system and storing real-time data in the repository, the real-time data includes system environment, configuration data, and network traffic.

4. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1 is characterized in that: The model training process of the intelligent analysis module includes the following steps: Use historical data to train the model offline and build a basic model; The basic model is learned online using real-time data, model parameters are updated in real time, and an intelligent analysis module is obtained through training.

5. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1 is characterized in that: The method further comprises: By collecting the attacker's attack behavior data and honeypot environment data, the attacker's target host and the protocol used are predicted, and the network topology and the protocols opened by the target host are modified according to the prediction results; Use network traffic analysis tools to extract attack features from the attacker's scanning packets; The extracted attack features are preprocessed and converted into digital types as input features of the model.

6. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 5 is characterized in that: The honeypot environment data includes operating system version, hardware resources, network status, network topology, and open protocol services.

7. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 1 is characterized in that: The method further comprises the following steps: According to the prediction results of the model in the intelligent analysis module, the open industrial control services and network topology in the original honeypot system are adjusted.

8. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 7 is characterized in that: The step of adjusting the open industrial control services and network topology in the original honeypot system according to the prediction results of the model in the intelligent analysis module includes the following steps: After the intelligent analysis module makes a prediction based on the current attacker's behavior and the honeypot environment, it sends the prediction results and the required historical data to the SDN controller in the original honeypot system; When the SDN controller receives the prediction of attack behavior, it dynamically modifies the configuration; The SDN controller opens the corresponding protocols and ports in the industrial control service module based on the predicted attack protocols that the honeypot may be subject to.

9. The method for constructing an adaptive intelligent industrial control high-interaction honeypot based on digital twins according to claim 8 is characterized in that: After receiving the prediction of the attack behavior, the SDN controller dynamically modifies the configuration, including the following steps: The SDN controller receives the prediction results and opens the corresponding protocols and ports based on the prediction results; Determine whether the target host that may be attacked is predicted. If so, add other nodes connected to the target host, extract relevant traffic from historical data and inject it into the target host, thereby completing the configuration modification of the honeypot system; if not, do not modify the topology.

10. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 9.

Images