Data-driven equivalent space-based industrial control system replay attack detection method

Abstract

The invention discloses a data-driven replay attack detection method based on an equivalent space industrial control system. The method comprises the following steps: acquiring input quantity and output quantity data at a plurality of continuous moments from the industrial control system; constructing a historical data matrix, calculating a zero matrix, solving an optimal weight matrix, calculating an equivalent matrix, generating a system residual error, and designing a chi-square test, a generalized likelihood ratio test and corresponding thresholds thereof; partial model information is introduced to enhance the detection capability of an original system; and deploying the obtained detection system, acquiring input and output of the system online, generating a residual error, judging the operation condition of the system by using chi-square test and generalized likelihood ratio test, and when a test value is greater than a residual error threshold value, judging that the system is subjected to replay attack, and giving an alarm. According to the method, under the condition of not depending on system model parameters, the replay attack on the industrial control network based on the equipment operation historical data is detected through input and output of the system, meanwhile, the deployability is kept, and the system control performance is not sacrificed.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial process status monitoring, and in particular relates to a data-driven industrial control system replay attack detection method based on equivalent space. Background Art

[0002] Industrial processes generally use distributed control systems (DCS) or supervisory control and data acquisition (SCADA). These industrial control systems use a multi-layer, hierarchical, cooperative and autonomous structure and have been widely used in various industries such as electricity, metallurgy, and petrochemicals.

[0003] With the in-depth advancement of intelligent manufacturing and the rapid development of the industrial Internet, the risks of industrial control system network security are becoming increasingly severe. On the one hand, industrial control systems have become a popular target for cyber attacks due to their functional importance; on the other hand, due to the general low intelligence and low performance of the underlying hardware of current industrial control systems, the acceptance of large-scale hardware equipment upgrades and renovations is low, and traditional information security encryption and decryption solutions cannot be directly used for industrial control system security protection, which makes some hidden network attack methods difficult to detect, especially replay attacks.

[0004] Replay attacks can be achieved by tampering with the measurement data of industrial equipment during operation. Related residual detection-based technologies can detect attacks by determining whether the real-time measurement data meets the distribution of historical data. However, attackers can use the data collected when the device is working normally to make this method ineffective. At present, replay attack detection can be divided into model-based and non-model-based based on whether the system model knowledge is known. Model-based detection technology, such as replay attack detection based on watermark scheme, requires sacrificing the performance of the control system, and the watermark signal will bring a large burden to the control system actuator, shortening the life of the equipment. Another sliding target replay attack detection method amplifies the replay attack features by changing the control system hardware in real time, and then detects it, but this method requires large-scale hardware modification and has poor physical feasibility. There is also a simple and effective deployment of replay attack detection based on equivalent space, which generates residuals for the system time series and verifies the residuals to indirectly verify the replay attack. However, these model-based detection methods are heavily dependent on accurate model parameters, which are generally difficult to obtain in actual complex industrial systems. Non-model-based replay attack detection schemes, such as dynamic data encryption, although easy to implement, have high requirements on synchronization and encryption functions.

[0005] In summary, existing detection methods are heavily dependent on system model parameters that are difficult to obtain in practice or have great difficulties in actual deployment. There are also limitations such as the inability to maintain control system performance and hardware integrity in real time or the inability to get rid of the constraints on control system hardware investment and transformation. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a data-driven industrial control system replay attack detection method based on equivalent space, which can get rid of the dependence on system model parameters, maintain a low deployment cost, do not lose the control system performance, do not shorten the life of the control system hardware, realize the detection of replay attacks on industrial control systems, and ensure the continuous and stable operation of industrial control systems.

[0007] To achieve the above object, the technical solution adopted by the present invention is: a data-driven industrial control system replay attack detection method based on equivalent space, comprising the steps of:

[0008] S1: Set the order s of the equivalent space, the group length K of the historical data, and obtain the input and output data of 2 (s+K) consecutive moments from the industrial control system;

[0009] S2: Select whether to perform partial model information enhancement on the detection scheme; if yes, set critical model parameters and construct new input and output data based on historical input and output data; if no, there is no need to reconstruct new input and output data, and the original input and output data can be used directly;

[0010] S3: Identify the equivalent matrix according to the input and output data, use the equivalent matrix and the input and output data to obtain the residual, and obtain the chi-square test and the generalized likelihood ratio test, and determine the residual threshold and the generalized likelihood ratio test threshold respectively;

[0011] S4: Directly introduce partial model information to enhance the detection method based on the original system identification; set the critical stability filter parameters to be introduced, and then calculate the equivalent matrix and new residual threshold after partial model enhancement according to the equivalent matrix transformation method;

[0012] S5: Deploy the obtained detection system, obtain the input and output of the system online, generate residuals, and use the chi-square test and generalized likelihood ratio test to judge the system operation status; when the test value is greater than the residual threshold, it is judged as a replay attack and an alarm is issued.

[0013] Furthermore, in step S1, initialization includes: modeling a discrete linear time-invariant system of a general industrial control system, whose input and output are u and y; and obtaining input and output data for 2 (s+K) consecutive moments from the industrial control system based on the selected equivalent space order s and the historical data group length K.

[0014] Furthermore, in step S2, if the answer is yes, firstly set the critical stability filter parameter A ζ With B ζ , using this part of model knowledge, construct new input and output data based on historical input and output data.

[0015] Furthermore, in step S2, the partial model information enhancement includes the steps of:

[0016] If the detection scheme is partially enhanced with model information, the critical stability filter configuration is selected, requiring A ζ is a critical stability matrix, and B ζ is a full rank matrix, and the new input and output generated using the original input and output u and y are:

[0017]

[0018] in: is the new system input at time k, which is numerically equal to the original system input u(k); is the new system output at time k, through the critical stability filter parameter A ζ , B ζ Constructed with the original system output y(k); is the new system output at time k-1.

[0019] Furthermore, in S3, the zeroing matrix N is identified according to the input and output data obtained in S2. s With product N s H u,s , select an optimization index J i And use data-driven methods to estimate the corresponding weight matrix M s , the weight matrix M s With the annihilation matrix N s Multiply to get the equivalent matrix Z s =M s N s ; Use the equivalent matrix and input and output data to obtain the residual;

[0020] Note s (k) is the residual generated by the system at time k:

[0021]

[0022] in:

[0023]

[0024] H u,s is the input transfer matrix, U s (k) is the system input matrix, Ys (k) is the system output matrix, is the kernel representation of the original system; u(k) is the input vector of the system at time k, and y(k) is the output vector of the system at time k;

[0025] Based on this design, the chi-square test Generalized likelihood ratio test And determine the chi-square test residual threshold and the generalized likelihood ratio test threshold J th,LR .

[0026] Furthermore, in step S3, the annihilation matrix identification includes:

[0027] First, get the input and output, including the original input and output or the newly constructed input and output, recorded as u and y, and arrange them into matrices in the following form:

[0028]

[0029] Where: Φ k,s is the system input and output data matrix at time k, which is obtained by specifically arranging the system input u and system output y obtained in the previous step; parameter s is the order of the equivalent space, and parameter K is the group length of the historical data;

[0030] Secondly, perform SVD decomposition:

[0031]

[0032] in: is the input and output data matrix transpose of the system at time k-ε-1; after SVD decomposition, the left singular matrix [U1 U2] and the right singular matrix are obtained And the singular value matrix

[0033] U1 is the front part of the left singular matrix, U2 is the back part of the left singular matrix, is the transpose of the front part of the right singular matrix, is the transpose of the rear part of the right singular matrix, ∑1 is the front part of the singular value matrix, and ∑2 is the rear part of the singular value matrix;

[0034] Finally, after decomposition, take ∑2 approximately as 0 and get the corresponding U2, then:

[0035]

[0036] When splitting: Then the annihilation matrix

[0037] in, is the intersection of the state transfer matrices, is the output equivalent matrix, is the input equivalent matrix.

[0038] Furthermore, in step S3, the data-driven weight matrix includes

[0039] There are different weight matrix designs for different optimization indicators.

[0040] Positive definite part optimization, the corresponding weight matrix M s For: M s =Λ -1 U T ;

[0041] Among them, Λ and U come from SVD decomposition is the covariance matrix of the residual under normal circumstances, U is the left singular matrix, Λ is the non-zero singular value matrix, V T Transpose of the right singular matrix;

[0042] The cumulative sum ratio is optimized to yes The largest generalized eigenvector of ; therefore, solve for the parameter T Δ,Σ and After that, various weight matrices can be calculated;

[0043] in, is the weight matrix M s = the covariance of the residuals at I; and T Δ,∑ is the weight matrix M when a replay attack occurs s =The change of residual covariance generated under I;

[0044] remember For the system in k i The residual when the moment is subjected to a replay attack, where the replay attack occurs at the αth moment in the detection window, that is,

[0045] is the input matrix during the replay attack, is the output matrix during replay attack;

[0046] in:

[0047] Where: τ is the time of replaying data, s is the order of the equivalent space;

[0048] Repeat this replay attack n t Round, calculate:

[0049]

[0050] in: Is the system in k i The residual when the moment is attacked by replay, is the covariance of the system residual when no replay attack is received, n t is the number of observations of the residuals in the generalized likelihood ratio test;

[0051] Further statistics:

[0052]

[0053] in: is the residual covariance change caused by the replay attack occurring at the αth moment in the detection window, It is the average change of the residual covariance in the detection window for s moments.

[0054] Furthermore, in step S3, the residual detection method includes:

[0055] Using Chi-Square Test Generalized likelihood ratio test To detect the residual error;

[0056] Based on the weight matrix M s , the statistical characteristics of the system residual are

[0057] Among them, Θ s is the covariance matrix of the system residuals, represents a mean of 0 and a covariance of Θ s Gaussian distribution of

[0058] Define the chi-square test:

[0059]

[0060] Define the generalized likelihood ratio test:

[0061]

[0062] in

[0063] Among them, n r is the number of observations of the residual in the generalized likelihood ratio test, det is the determinant operation, r s (ki) is the residual at time ki.

[0064] Furthermore, in step S4: if the original system identification is performed, that is, no new input and output data are constructed in S2, and the original input and output data are used for identification in S3, then through this step, part of the model information can be directly introduced on the basis of the original system identification to enhance the detection method without repeated identification work, thus keeping the amount of calculation low. First, the critical stability filter parameter A to be introduced is set ζ With B ζ Then, the annihilation matrix after partial model enhancement is calculated according to the equivalent matrix transformation method. And calculate the new residual covariance based on the residual relationship and derive the new weight matrix And calculate the new equivalent matrix with the new residual threshold;

[0065] In step S4, the partial model information enhances the original system, including the following steps:

[0066] Select the critical stability matrix A ζ With the full rank matrix B ζ , and construct the following matrix:

[0067]

[0068] Solve the equation and get the matrix D: Then the new zeroing matrix is: Then the residual generation of the partial model information enhancement system can be expressed as: in And for the estimated value of the system residual covariance enhanced by some models, we have: is the new weight matrix.

[0069] Furthermore, in step S5, the equivalent space residual perception alarm strategy includes the steps of:

[0070] The M involved in the original equivalent space replay attack detection scheme s , U s (k) and Y s (k), and some of the model information enhancement schemes involved and Unified as M s , U s (k) and Y s (k);

[0071] This method is deployed in an actual industrial control system by obtaining the system input and output online and generating residuals: The residual test value is generated through the chi-square test and the generalized likelihood ratio test. If the test value is greater than the corresponding test threshold, it is judged as a replay attack and an alarm is issued.

[0072] The beneficial effects of adopting this technical solution are:

[0073] The data-driven replay attack detection based on equivalent space of the present invention covers residual generation, residual evaluation and detection performance optimization. It can generate residuals based on the input and output data of the system using the equivalent space method and identify the dynamic internal characteristics of the system through residual inspection and detection performance optimization, thereby effectively detecting whether the system is under replay attack and improving the detection performance. Compared with the prior art, this method mainly relies on the historical data of equipment operation, does not require the system model parameters that are difficult to obtain in practice, and maintains easy deployment, does not need to sacrifice system control performance but does not require any additional equipment, and has made a contribution to solving the replay attack detection problem of industrial systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 A schematic flow chart of a data-driven, equivalent space-based industrial control system replay attack detection method of the present invention;

[0075] Figure 2 is a residual change diagram when the system in the embodiment of the present invention is subjected to a replay attack;

[0076] Figure 3 is a graph of the detection rate of a general original system replay attack in an embodiment of the present invention;

[0077] Figure 4 is a comparison chart of the replay attack detection rate of the enhanced system in an embodiment of the present invention; DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described below with reference to the accompanying drawings.

[0079] In this embodiment, see Figure 1 As shown, the present invention proposes a data-driven replay attack detection method for industrial control systems based on equivalent space, including equivalent space identification and optimization (steps S1 to S3), a replay attack detection enhancement scheme integrating model information and data information (S4), and an equivalent space residual perception alarm strategy (S5). Specifically, the following steps are included:

[0080] S1: Set the order s of the equivalent space, the group length K of the historical data, and obtain the input and output data of 2 (s+K) consecutive moments from the industrial control system;

[0081] S2: To further enhance the detection performance, you can choose whether to enhance some model information of the detection scheme. If you choose yes, first set the critical stability filter parameter A ζ With B ζ , use this part of model knowledge to construct new input and output data based on historical input and output data. If you select No, there is no need to reconstruct new input and output data, and you can use the original data directly.

[0082] S3: Identify the equivalent matrix according to the input and output data, use the equivalent matrix and the input and output data to obtain the residual, and obtain the chi-square test and the generalized likelihood ratio test, and determine the residual threshold and the generalized likelihood ratio test threshold respectively;

[0083] Specifically, the zeroing matrix N is identified based on the input and output data obtained from S2 s With product N s H u,s , select an optimization index J i And use data-driven methods to estimate the corresponding weight matrix M s , the weight matrix M s With the annihilation matrix N s Multiply to get the equivalent matrix Z s =M s N s ; Use the equivalent matrix and input and output data to obtain the residual;

[0084] Note s (k) is the residual generated by the system at time k:

[0085]

[0086] in:

[0087]

[0088] H u,s is the input transfer matrix, U s (k) is the system input matrix, Y s (k) is the system output matrix, is the kernel representation of the original system; u(k) is the input vector of the system at time k, and y(k) is the output vector of the system at time k;

[0089] Based on this design, the chi-square test Generalized likelihood ratio test And determine the chi-square test residual threshold and the generalized likelihood ratio test threshold J th,LR .

[0090] S4: Directly introduce partial model information to enhance the detection method based on the original system identification; set the critical stability filter parameters to be introduced, and then calculate the equivalent matrix after partial model enhancement and the new residual threshold according to the equivalent matrix transformation method.

[0091] Specifically, if the original system identification is performed, that is, no new input and output data are constructed in S2, and the original input and output data are used for identification in S3, then through this step, part of the model information can be directly introduced on the basis of the original system identification to enhance the detection method without repeated identification work, thus keeping the amount of calculation low. First, set the critical stability filter parameter A to be introduced ζ With B ζ Then, the annihilation matrix after partial model enhancement is calculated according to the equivalent matrix transformation method. And calculate the new residual covariance based on the residual relationship and derive the new weight matrix And calculate the new equivalent matrix with the new residual threshold.

[0092] S5: Deploy the obtained detection system, obtain the input and output of the system online, generate residuals, and use the chi-square test and generalized likelihood ratio test to judge the system operation status; when the test value is greater than the residual threshold, it is judged as a replay attack and an alarm is issued.

[0093] As an optimization scheme for the above embodiment, in step S1, initialization includes: modeling a discrete linear time-invariant system of a general industrial control system, whose input and output are u and y; according to the selected equivalent space order s and the historical data group length K, obtaining input and output data for 2 consecutive (s+K) moments from the industrial control system.

[0094] Specifically, a discrete linear time-invariant system model is performed for a general industrial control system, whose input and output are u and y. The equivalent space order s=8 and the historical data group length K=300 are selected, and the input and output data of 2(s+K)=616 consecutive moments are obtained from the normally operating industrial control system. The replay attack on the system is achieved by replacing the input and output data from t=500 to t=550 with the historical input and output data from t=300 to t=350.

[0095] As an optimization solution of the above embodiment, in step S2, in order to enhance the detection performance, the partial model information enhancement includes the steps of:

[0096] If the detection scheme is partially enhanced with model information, the critical stability filter configuration is selected, requiring A ζ is a critical stability matrix, and B ζ A is a full rank matrix.ζ =B ζ =I, which satisfies both simplicity and accuracy; using the original input and output u and y to generate new input and output is:

[0097]

[0098] in: is the new system input at time k, which is numerically equal to the original system input u(k); is the new system output at time k, through the critical stability filter parameter A ζ , B ζ Constructed with the original system output y(k); is the new system output at time k-1.

[0099] As an optimization solution of the above embodiment, in step S3, the annihilation matrix identification, weight matrix design and residual detection include the following steps:

[0100] (1) Annihilation matrix identification:

[0101] First, get the input and output, including the original input and output or the newly constructed input and output, recorded as u and y, and arrange them into matrices in the following form:

[0102]

[0103] Where: Φ k,s is the system input and output data matrix at time k, which is obtained by specifically arranging the system input u and system output y obtained in the previous step; parameter s is the order of the equivalent space, and parameter K is the group length of the historical data;

[0104] Secondly, perform SVD decomposition:

[0105]

[0106] in: is the input and output data matrix transpose of the system at time ks-1; after SVD decomposition, the left singular matrix [U1 U2] and the right singular matrix are obtained And the singular value matrix

[0107] U1 is the front part of the left singular matrix, corresponding to the singular values ​​that are not 0, and U2 is the back part of the left singular matrix, corresponding to the singular values ​​that are close to 0. is the transpose of the front part of the right singular matrix, corresponding to the non-zero singular values, is the transpose of the rear part of the right singular matrix, corresponding to the singular values ​​approximately equal to 0, ∑1 is the front part of the singular value matrix, containing non-zero singular values, ∑2 is the rear part of the singular value matrix, approximately equal to 0;

[0108] Finally, after decomposition, take ∑2 approximately as 0 and get the corresponding U2, then:

[0109]

[0110] When splitting: Then the annihilation matrix

[0111] in, is the intersection of the state transfer matrices, is the output equivalent matrix, is the input equivalent matrix.

[0112] (2) Data-driven weight matrix:

[0113] There are different weight matrix designs for different optimization indicators.

[0114] Positive definite part optimization, the corresponding weight matrix M s For: M s =Λ -1 U T ;

[0115] Among them, Λ and U come from SVD decomposition is the covariance matrix of the residual under normal circumstances, U is the left singular matrix, Λ is the non-zero singular value matrix, V T Transpose of the right singular matrix;

[0116] The cumulative sum ratio is optimized to yes The largest generalized eigenvector of ; therefore, solve for the parameter T Δ,∑ and After that, various weight matrices can be calculated;

[0117] in, is the weight matrix M s = covariance of the residuals when I, using To estimate; and T Δ,∑ is the weight matrix M when a replay attack occurs s =I, and uses data-driven learning to achieve the following by autonomously simulating the occurrence of replay attacks and calculating the changes in their residual covariance:

[0118] remember For the system in k i The residual when the moment is subjected to a replay attack, where the replay attack occurs at the αth moment in the detection window, that is,

[0119] is the input matrix during the replay attack, is the output matrix during replay attack;

[0120] in:

[0121] Where: τ is the time of replaying data, s is the order of the equivalent space;

[0122] Repeat this replay attack n t Round, calculate:

[0123]

[0124] in: Is the system in k i The residual when the moment is attacked by replay, is the covariance of the system residual when no replay attack is received, n t is the number of observations of the residuals in the generalized likelihood ratio test;

[0125] Further statistics:

[0126]

[0127] in: is the residual covariance change caused by the replay attack occurring at the αth moment in the detection window, It is the average change of the residual covariance in the detection window for s moments.

[0128] (3) Residual detection method:

[0129] Using Chi-Square Test Generalized likelihood ratio test To detect the residual error;

[0130] Based on the weight matrix M s , the statistical characteristics of the system residual are

[0131] Among them, Θ s is the covariance matrix of the system residuals, represents a mean of 0 and a covariance of Θ s Gaussian distribution of

[0132] Define the chi-square test:

[0133] Its threshold Obtained by querying the chi-square distribution table;

[0134] Define the generalized likelihood ratio test:

[0135]

[0136] in Its threshold can be calculated numerically;

[0137] Among them, n r is the number of observations of the residual in the generalized likelihood ratio test, det is the determinant operation, r s (ki) is the residual at time ki.

[0138] As an optimization solution of the above embodiment, in step S4, the partial model information enhances the original system including the following steps:

[0139] Select the critical stability matrix A ζ With the full rank matrix B ζ (Generally select A ζ =B ζ =I), and construct the following matrix:

[0140]

[0141] Solve the equation and get the matrix D: Then the new zeroing matrix is: Then the residual generation of the partial model information enhancement system can be expressed as: in And for the estimated value of the system residual covariance enhanced by some models, we have: is the new weight matrix.

[0142] As an optimization solution of the above embodiment, in step S5, the equivalent space residual perception alarm strategy includes the following steps:

[0143] For the convenience of representation, the M involved in the original equivalent space replay attack detection scheme is s , U s (k) and Y s (k), and some of the model information enhancement schemes involved and Unified as M s , U s (k) and Y s (k). This method is deployed in an actual industrial control system by obtaining the system input and output online and generating residuals: The residual test value is generated through the chi-square test and the generalized likelihood ratio test, and the deviation of the false alarm rate is less than 5%. If the test value is greater than its corresponding test threshold, it is judged as a replay attack and an alarm is issued.

[0144] like Figure 2 As shown in the figure, we can see the changes in the system residuals under the chi-square test and the generalized likelihood ratio test. From 500 to 550, the system was attacked by a replay attack. The experiment was repeated 500 times, and the detection rate was statistically analyzed. The results are as follows: Figure 3 , we can see that this method has a high detection accuracy. Modify the system parameters and build a special system to make it more difficult to detect replay attacks. Use the original replay attack detection method and the replay attack detection method enhanced by some models to detect it. Repeat the experiment 500 times. The detection rate is as follows: Figure 4 ,We can see that the replay attack detection performance of some models has been greatly improved.

[0145] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A data-driven industrial control system replay attack detection method based on equivalent space, characterized in that: Includes steps: S1: Set the order s of the equivalent space, the group length K of the historical data, and obtain the input and output data of 2 (s+K) consecutive moments from the industrial control system; S2: Select whether to perform partial model information enhancement on the detection scheme; if yes, set critical model parameters and construct new input and output data based on historical input and output data; if no, there is no need to reconstruct new input and output data, and the original input and output data can be used directly; S3: Identify the equivalent matrix according to the input and output data, use the equivalent matrix and the input and output data to obtain the residual, and obtain the chi-square test and the generalized likelihood ratio test, and determine the residual threshold and the generalized likelihood ratio test threshold respectively; S4: Directly introduce partial model information to enhance the detection method based on the original system identification; set the critical stability filter parameters to be introduced, and then calculate the equivalent matrix and new residual threshold after partial model enhancement according to the equivalent matrix transformation method; S5: Deploy the obtained detection system, obtain the input and output of the system online, generate residuals, and use the chi-square test and generalized likelihood ratio test to judge the system operation status; when the test value is greater than the residual threshold, it is judged as a replay attack and an alarm is issued.

2. According to claim 1, a data-driven industrial control system replay attack detection method based on equivalent space is characterized in that: In the step S1, initialization includes: modeling a discrete linear time-invariant system of a general industrial control system, whose input and output are u and y; according to the selected equivalent space order s and the historical data group length K, obtaining input and output data for 2 consecutive (s+K) moments from the industrial control system.

3. According to claim 1, a data-driven industrial control system replay attack detection method based on equivalent space is characterized in that: In step S2, if the answer is yes, first set the critical stability filter parameter A ζ With B ζ , using this part of model knowledge, construct new input and output data based on historical input and output data.

4. According to claim 3, a data-driven industrial control system replay attack detection method based on equivalent space method is characterized in that: In step S2, the partial model information enhancement includes the steps of: If the detection scheme is partially enhanced with model information, the critical stability filter configuration is selected, requiring A ζ is a critical stability matrix, and B ζ is a full rank matrix, and the new input and output generated using the original input and output u and y are: in: is the new system input at time k, which is numerically equal to the original system input u(k); is the new system output at time k, through the critical stability filter parameter A ζ , B ζ Constructed with the original system output y(k); is the new system output at time k-1.

5. According to claim 1, a data-driven industrial control system replay attack detection method based on equivalent space is characterized in that: In S3, the zeroing matrix N is identified based on the input and output data obtained in S2. s With product N s H u,s , select an optimization index J i And use data-driven methods to estimate the corresponding weight matrix M s , the weight matrix M s With the annihilation matrix N s Multiply to get the equivalent matrix Z s =M s N s ; Use the equivalent matrix and input and output data to obtain the residual; Note s (k) is the residual generated by the system at time k: in: H u,s is the input transfer matrix, U s (k) is the system input matrix, Y s (k) is the system output matrix, is the kernel representation of the original system; u(k) is the input vector of the system at time k, and y(k) is the output vector of the system at time k; Based on this design, the chi-square test Generalized likelihood ratio test And determine the chi-square test residual threshold and the generalized likelihood ratio test threshold J th,LR .

6. According to claim 5, a data-driven industrial control system replay attack detection method based on equivalent space is characterized in that: In step S3, the annihilation matrix identification includes: First, get the input and output, including the original input and output or the newly constructed input and output, recorded as u and y, and arrange them into matrices in the following form: Where: Φ k,s is the system input and output data matrix at time k, which is obtained by specifically arranging the system input u and system output y obtained in the previous step; the parameter s is the order of the equivalent space, and the parameter k is the group length of the historical data; Secondly, perform SVD decomposition: in: is the input and output data matrix transpose of the system at time ks-1; after SVD decomposition, the left singular matrix [U1 U2] and the right singular matrix are obtained And the singular value matrix U1 is the front part of the left singular matrix, U2 is the back part of the left singular matrix, is the transpose of the front part of the right singular matrix, is the transpose of the rear part of the right singular matrix, ∑1 is the front part of the singular value matrix, and ∑2 is the rear part of the singular value matrix; Finally, after decomposition, take ∑2 approximately as 0 and get the corresponding U2, then: When splitting: Then the annihilation matrix in, is the intersection of the state transfer matrices, is the output equivalent matrix, is the input equivalent matrix.

7. According to claim 6, a data-driven industrial control system replay attack detection method based on equivalent space is characterized in that: In step S3, the data-driven weight matrix includes There are different weight matrix designs for different optimization indicators. Positive definite part optimization, the corresponding weight matrix M s For: M s =Λ -1 U T ; Among them, Λ and U come from SVD decomposition is the covariance matrix of the residual under normal circumstances, U is the left singular matrix, Λ is the non-zero singular value matrix, V T Transpose of the right singular matrix; The cumulative sum ratio is optimized to yes The largest generalized eigenvector of ; therefore, solve for the parameter T Δ,Σ and Then various weight matrices are calculated; in, is the weight matrix M s = the covariance of the residuals at I; and T Δ,Σ is the weight matrix M when a replay attack occurs s =The change of residual covariance generated under I; remember For the system in k i The residual when the moment is subjected to a replay attack, where the replay attack occurs at the αth moment in the detection window, that is, is the input matrix during the replay attack, is the output matrix during replay attack; in: Where: τ is the time of replaying data, s is the order of the equivalent space; Repeat this replay attack n t Round, calculate: in: Is the system in k i The residual when the moment is attacked by replay, is the covariance of the system residual when no replay attack is received, n t is the number of observations of the residuals in the generalized likelihood ratio test; Further statistics: in: is the residual covariance change caused by the replay attack occurring at the αth moment in the detection window, It is the average change of the residual covariance in the detection window for s moments.

8. According to claim 7, a data-driven industrial control system replay attack detection method based on equivalent space is characterized in that: In step S3, the residual detection method includes: Using Chi-Square Test Generalized likelihood ratio test To detect the residual error; Based on the weight matrix M s , the statistical characteristics of the system residual are Among them, Θ s is the covariance matrix of the system residuals, represents a mean of 0 and a covariance of Θ s Gaussian distribution of Define the chi-square test: Define the generalized likelihood ratio test: in Among them, n r is the number of observations of the residual in the generalized likelihood ratio test, det is the determinant operation, r s (ki) is the residual at time ki.

9. According to claim 4, a data-driven industrial control system replay attack detection method based on equivalent space method is characterized in that: In step S4: if the original system identification is performed, that is, no new input and output data are constructed in S2, the original input and output data are used for identification in S3; first, the critical stability filter parameter A to be introduced is set. ζ With B ζ Then, the annihilation matrix after partial model enhancement is calculated according to the equivalent matrix transformation method. And calculate the new residual covariance based on the residual relationship and derive the new weight matrix And calculate the new equivalent matrix with the new residual threshold; In step S4, the partial model information enhances the original system, including the following steps: Select the critical stability matrix A ζ With the full rank matrix B ζ , and construct the following matrix: Solve the equation and get the matrix D: Then the new zeroing matrix is: Then the residual generation of the partial model information enhancement system is expressed as: in And for the estimated value of the system residual covariance enhanced by some models, we have: is the new weight matrix.

10. A data-driven industrial control system replay attack detection method based on equivalent space according to claim 9, characterized in that: In step S5, the equivalent space residual perception alarm strategy includes the following steps: The M involved in the original equivalent space replay attack detection scheme s , U s (k) and Y s (k), and some of the model information enhancement schemes involved and Unified as M s , U s (k) and Y s (k); This method is deployed in an actual industrial control system by obtaining the system input and output online and generating residuals: The residual test value is generated through the chi-square test and the generalized likelihood ratio test. If the test value is greater than the corresponding test threshold, it is judged as a replay attack and an alarm is issued.

Images