Industrial control system real-time monitoring method based on illumination side channel analysis

Abstract

The invention relates to an industrial control system real-time monitoring method, in particular to an industrial control system real-time monitoring method based on illumination side channel analysis, and belongs to the technical field of industrial control system safety monitoring. The implementation method comprises the following steps of: 1, constructing a mapping relation between a normal state operation instruction set and a digital signal, wherein the mapping relation is used for industrial control system acquisition; further obtaining a digital signal set; 2, constructing and training a multi-classification neural network model; 3, applying the trained multi-classification neural network model to actual illumination signal acquisition and monitoring of the industrial control system; when the classification result of the actual illumination signal is not matched with the normal operation instruction set, an alarm is given abnormally; 4, repeating the step 3 to carry out continuous real-time industrial control system monitoring; compared with the prior art, the method physically isolates a monitoring system from an industrial control system and utilizes real-time monitoring to solve the problems of low attack frequency and difficulty in capturing Trojan viruses and the like, and machine learning is combined for monitoring and screening, so that the monitoring efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to a real-time monitoring method for an industrial control system, and in particular to a real-time monitoring method for an industrial control system based on illumination side channel analysis, and belongs to the technical field of industrial control system safety monitoring. Background Art

[0002] Viruses continue to wreak havoc on various industrial control systems. The common characteristics of these viruses are high intelligence and high concealment. Because of their strong influence and wide range of action, they are called cyber weapons by cyberspace security practitioners.

[0003] In recent years, traditional industrial control system monitoring technology has found it difficult to efficiently and accurately detect potential safety hazards in industrial control systems in real time. However, in real scenarios, industrial control system equipment will inevitably experience power leakage, electromagnetic radiation leakage, sound leakage, etc. These side information are closely related to the ongoing operations of the equipment. However, the current industrial control system monitoring technology based on side channel analysis has not been able to break through the limitations of efficiency, real time and accuracy.

[0004] Therefore, in the industrial control system environment, how to improve the real-time monitoring accuracy of the industrial control system and thus protect the normal operation of the industrial control system has become an urgent problem to be solved. Summary of the invention

[0005] The purpose of the present invention is to solve the technical problem of improving the real-time monitoring accuracy of existing industrial control systems and to propose a real-time monitoring method for industrial control systems based on illumination side channel analysis.

[0006] The technical solution of the present invention is: pre-collecting the illumination signal of the industrial control system equipment when it is working normally, and inputting it into the neural network model for training, and then continuously collecting the illumination signal of the industrial control system equipment to be monitored in real time to determine whether the industrial control system equipment has abnormal instruction behavior.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] A real-time monitoring method for an industrial control system based on illumination side channel analysis of the present invention is applied in a safety monitoring environment of the industrial control system, and comprises the following steps:

[0009] Step 1: Construct a mapping relationship between a normal state operation instruction set and a digital signal for industrial control system acquisition, and then obtain a digital signal set;

[0010] Step 1.1: Construct a normal state operation instruction set for industrial control system acquisition, use a photoelectric sensor to collect the illumination signal of the industrial control system equipment, and then obtain the illumination signal;

[0011] Step 1.2: Amplify the illumination signal using a signal amplifier to obtain an amplified signal;

[0012] Step 1.3: Use an oscilloscope to convert the amplified signal into a digital signal;

[0013] Step 1.4: Use the traversal acquisition method to traverse the operation instructions, build a mapping relationship between the operation instructions and the digital signal, and then obtain a digital signal set;

[0014] Step 2: Build and train a multi-classification neural network model;

[0015] Step 2.1: Build a neural network model suitable for multi-classification;

[0016] Step 2.2: Perform frequency decomposition on the digital signal set obtained in step 1 to obtain a frequency data set, and input the frequency data set into a multi-classification neural network model for training;

[0017] Step 2.2.1: Apply Fourier transform to the digital signal set obtained in step 1 to convert the time domain signal into a frequency domain signal to obtain a frequency data set after frequency decomposition;

[0018] Step 2.2.2: Use the running instruction set as the label set; use the frequency dataset as the feature set;

[0019] Step 2.2.3: Input the feature set and label set into the multi-classification neural network model for training;

[0020] Step 2.3: Iterate step 2.2 to obtain the trained multi-classification neural network model;

[0021] Step 3: Apply the trained multi-classification neural network model to the actual illumination signal acquisition and monitoring of the industrial control system; when the classification result of the actual illumination signal does not match the normal operation instruction set, an abnormal alarm is issued;

[0022] Step 4: Repeat step 3 to perform uninterrupted real-time industrial control system monitoring;

[0023] Beneficial effects:

[0024] Compared with the prior art, the present invention has the following effects:

[0025] 1. Compared with the traditional industrial control system monitoring method, the monitoring system in this monitoring method is physically isolated from the industrial control system, and Trojan viruses that invade the industrial control system cannot further control the monitoring system;

[0026] 2. The monitored object is the underlying information of industrial control system equipment such as PLC. The behavior of Trojan virus cannot be hidden. This method greatly improves the accuracy of monitoring;

[0027] 3. This method conducts 24-hour real-time monitoring, effectively solving the problem of low frequency and difficulty in capturing Trojan viruses, and combines machine learning for monitoring and identification, greatly improving the efficiency of monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Schematic diagram of the analysis process;

[0029] Figure 2 It is the illumination signal of the normal operation instruction of the PLC of the industrial control system equipment;

[0030] Figure 3 The data is obtained by frequency decomposing the collected illumination signal of normal operation instructions;

[0031] Figure 4 It is a neural network model structure based on LSTM;

[0032] Figure 5 It is the illumination signal of the PLC of the industrial control system equipment collected in real time;

[0033] Figure 6 Compare the abnormal instructions and normal instructions illumination signals of the PLC of the industrial control system equipment;

[0034] Figure 7 The results are experimental comparisons between the present invention and the existing electromagnetic-based industrial control system monitoring method. DETAILED DESCRIPTION

[0035] In order to better illustrate the purpose and advantages of the present invention, the invention is further described below in conjunction with the accompanying drawings and examples. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the protection scope of the present invention.

[0036] This embodiment takes an industrial control system device PLC with abnormal instructions as an example to illustrate the technical solution of the present invention.

[0037] Example

[0038] like Figure 1 As shown, the real-time monitoring method of an industrial control system based on illumination side channel analysis of the present invention is specifically implemented in the following steps:

[0039] Step 1: Construct a mapping relationship between a normal state operation instruction set and a digital signal for industrial control system acquisition, and then obtain a digital signal set;

[0040] In the embodiment, all normal instructions of the PLC of the industrial control system equipment are traversed, and the illumination signal of the power indicator light when each normal instruction is executed is collected to obtain a signal set of normal instructions and corresponding illumination signals;

[0041] Step 1.1: Construct a normal state operation instruction set for industrial control system acquisition, use a photoelectric sensor to collect the illumination signal of the industrial control system equipment, and then obtain the illumination signal;

[0042] In the embodiment, all possible normal instructions of the PLC of the industrial control system equipment are traversed, and the photoelectric sensor is aimed at the power indicator light of the PLC. When the PLC runs the normal instruction, the illumination signal of the power indicator light is collected;

[0043] Step 1.2: Amplify the illumination signal using a signal amplifier to obtain an amplified signal;

[0044] In the embodiment, the illumination signal collected by the photoelectric sensor is transmitted to the signal amplifier, and the amplifier amplifies the signal to obtain an amplified signal;

[0045] Step 1.3: Use an oscilloscope to convert the amplified signal into a digital signal;

[0046] In the embodiment, the amplified signal is converted into a digital signal using an oscilloscope. The collected digital signal is as follows: Figure 2 As shown, the horizontal axis unit is points, the vertical axis unit is millivolts, and the signal waveforms of different colors represent the corresponding illumination signals collected when the PLC is running different normal instructions. The signal waveform has ups and downs, indicating that when the PLC is running instructions, the energy consumption will change, which will in turn affect the change of the illumination signal of the power indicator light;

[0047] Step 1.4: Use the traversal acquisition method to traverse the operation instructions, build a mapping relationship between the operation instructions and the digital signal, and then obtain a digital signal set;

[0048] In the embodiment, all normal instructions of the PLC of the industrial control system equipment are traversed, and the illumination signal of the power indicator light when each normal instruction is executed is collected to obtain a signal set of normal instructions and corresponding illumination signals;

[0049] Step 2: Build and train a multi-classification neural network model;

[0050] In the embodiment, a multi-classification neural network model based on LSTM is constructed and trained with the digital signal set obtained in step 1;

[0051] Step 2.1: Build a neural network model suitable for multi-classification;

[0052] In the embodiment, a multi-classification neural network model based on LSTM is constructed, and the structure is as follows Figure 4As shown, the illumination signal represents the digital signal set corresponding to the normal instructions collected in step 1, the LSTM layer represents that each neuron in this layer has the same structure as the LSTM basic neuron, and the network model contains multiple LSTM layers, the fully connected layer represents that there is a fully connected layer after multiple LSTM layers, and the output layer represents that this layer uses the softmax activation function to convert the output into predicted probability values ​​for multiple classifications;

[0053] Step 2.2: Perform frequency decomposition on the digital signal set obtained in step 1 to obtain a frequency data set, and input the frequency data set into a multi-classification neural network model for training;

[0054] In the embodiment, the digital signal set obtained in step 1 is subjected to frequency decomposition to obtain a frequency data set, such as Figure 3 As shown, signal waveforms of different colors represent frequency data obtained after low-pass filtering, and the frequency data set is input into a multi-classification neural network model based on LSTM for training;

[0055] Step 2.2.1: Apply Fourier transform to the digital signal set obtained in step 1 to convert the time domain signal into a frequency domain signal to obtain a frequency data set after frequency decomposition;

[0056] In the embodiment, Fourier transform is applied to the digital signal set obtained in step 1 to convert the time domain signal into a frequency domain signal to obtain a frequency data set after frequency decomposition;

[0057] Step 2.2.2: Use the running instruction set as the label set; use the frequency dataset as the feature set;

[0058] In the embodiment, the normal instruction set of the PLC is used as the label set, and the frequency data set corresponding to the normal instructions is used as the feature set;

[0059] Step 2.2.3: Input the feature set and label set into the multi-classification neural network model for training;

[0060] In the embodiment, the feature set and the label set are input into a LSTM-based multi-classification neural network model for training;

[0061] Step 2.3: Iterate step 2.2 to obtain the trained multi-classification neural network model;

[0062] In the embodiment, step 2.2 is iterated in a loop to obtain a trained LSTM-based multi-classification neural network model;

[0063] Step 3: Apply the trained multi-classification neural network model to the actual illumination signal acquisition and monitoring of the industrial control system; when the classification result of the actual illumination signal does not match the normal operation instruction set, an abnormal alarm is issued;

[0064] In the embodiment, the trained LSTM-based multi-classification neural network model is applied to the actual illumination signal acquisition and monitoring of the industrial control system equipment PLC. The illumination signal collected in real time is as follows: Figure 5 As shown, the horizontal axis unit is microseconds, the vertical axis unit is millivolts, and the blue waveform signal is the power indicator light illumination signal collected in real time for the PLC; the illumination signal comparison between abnormal PLC operation instructions and normal instructions is shown in Figure 1. Figure 6 As shown, the blue one is the illumination signal of the abnormal PLC operation instruction, and the yellow one is the illumination signal of the normal PLC operation instruction. When the classification result of the actual illumination signal does not match the normal operation instruction set, an abnormal alarm is issued;

[0065] Step 4: Repeat step 3 to perform uninterrupted real-time industrial control system monitoring;

[0066] In the embodiment, step 3 is repeated to perform uninterrupted real-time industrial control system monitoring on the PLC;

[0067] In order to verify the effectiveness of the present invention, the present invention is experimentally compared with the existing electromagnetic-based industrial control system monitoring method to verify the effectiveness and accuracy of the present invention. The experimental samples use the electromagnetic radiation and illumination signals of the industrial control system PLC, single-chip microcomputer and microcontroller in the real environment when they are running, and the classification recognition rate of abnormal operation is used as the monitoring indicator.

[0068] like Figure 7 As shown in the figure, in terms of classification recognition rate, the experimental results of the present invention on industrial control system PLC, single chip microcomputer and microcontroller have higher accuracy than the electromagnetic-based industrial control system monitoring method. The results show that the real-time monitoring method of industrial control system based on illumination side channel analysis proposed by the present invention can improve the real-time monitoring accuracy of existing industrial control systems.

[0069] The specific description above further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A real-time monitoring method for an industrial control system based on illumination side channel analysis, characterized in that: The following steps are included: Step 1: Construct a mapping relationship between a normal state operation instruction set and a digital signal for industrial control system acquisition; and then obtain a digital signal set; Step 2: Build and train a multi-classification neural network model; Step 2.1: Build a neural network model suitable for multi-classification; Step 2.2: Perform frequency decomposition on the digital signal set obtained in step 1 to obtain a frequency data set, and input the frequency data set into a multi-classification neural network model for training; Step 2.2.1: Apply Fourier transform to the digital signal set obtained in step 1 to convert the time domain signal into a frequency domain signal to obtain a frequency data set after frequency decomposition; Step 2.2.2: Use the running instruction set as the label set; use the frequency dataset as the feature set; Step 2.2.3: Input the feature set and label set into the multi-classification neural network model for training; Step 2.3: Iterate step 2.2 to obtain the trained multi-classification neural network model; Step 3: Apply the trained multi-classification neural network model to the actual illumination signal acquisition and monitoring of the industrial control system; when the classification result of the actual illumination signal does not match the normal operation instruction set, an abnormal alarm is issued; Step 4: Repeat step 3 to perform uninterrupted real-time industrial control system monitoring.

2. The method for real-time monitoring of an industrial control system based on illumination side channel analysis according to claim 1, characterized in that: Step 1 is implemented as follows: Step 1.1: Construct a normal state operation instruction set for industrial control system acquisition, use a photoelectric sensor to collect the illumination signal of the industrial control system equipment, and then obtain the illumination signal; Step 1.2: Amplify the illumination signal using a signal amplifier to obtain an amplified signal; Step 1.3: Use an oscilloscope to convert the amplified signal into a digital signal; Step 1.4: Use the traversal acquisition method to traverse the operating instructions, build a mapping relationship between the operating instructions and the digital signals, and then obtain a digital signal set.

Images