Industrial control abnormity intelligent detection method based on deep learning

Abstract

The invention relates to the technical field of industrial control detection, in particular to an industrial control anomaly intelligent detection method based on deep learning, and the method comprises the steps: determining a preset threshold value corresponding to each type of data frame; dividing the data frames into qualified data frames or abnormal data frames; whether each data frame of the industrial personal computer is an abnormal data frame or not is determined, a corresponding detection mode for the industrial personal computer is selected according to the specific condition of the abnormal data frame, and whether detection parameters of the data frame are qualified or not is determined, so that the reliability of determination for the abnormal data frame is improved; the information interaction parameters of the risk terminal are adjusted, so that the detection efficiency of the industrial personal computer is improved while the safety of the industrial personal computer is improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial control detection technology, and in particular to an intelligent detection method for industrial control anomalies based on deep learning. Background Art

[0002] With the rapid development of information technology, industrial control networks are facing more and more risks. Industrial control systems control key production processes and equipment. Through detection, potential faults, anomalies and security vulnerabilities can be discovered in time, accidents can be prevented, personnel safety and equipment damage can be protected, thereby reducing production interruptions and property losses; to ensure the stability and uninterrupted operation of the industrial production process. Timely detection and resolution of problems can avoid production stagnation caused by system failures, improve production efficiency and delivery capabilities, and meet market demand. Monitoring of industrial computers is particularly important. With the development of the industrial Internet, industrial control systems are facing more and more risks of network attacks. Detection can provide information about system performance, help enterprises discover system bottlenecks and inefficient links, optimize and improve them, and improve resource utilization and production quality.

[0003] Chinese patent publication number: CN106487813A, discloses an industrial control network security detection system, wherein the test case module provides test cases to the fuzzy test engine; the fuzzy test engine generates test data packets and performs security detection on the detection target, and obtains test results including "normal", "other" and "suspected vulnerability"; the monitor monitors the status of the detection target in real time; the root cause analysis module drives the fuzzy test engine to replay the attack, and after the vulnerability verification is successful, the abnormal data packet is analyzed abnormally to obtain the root cause of the security vulnerability; the report generation engine generates a test report. The industrial control network security detection system is used for security detection; it can be seen that the above technical solution has the following problems: it does not consider whether each data frame of the industrial control computer is an abnormal data frame to determine, and does not consider selecting the corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, which affects the detection efficiency for the industrial control. Summary of the invention

[0004] To this end, the present invention provides an intelligent detection method for industrial control anomalies based on deep learning, which is used to overcome the problem that the prior art does not consider whether each data frame of the industrial control computer is an abnormal data frame, and does not consider selecting the corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, which affects the detection efficiency of the industrial control.

[0005] To achieve the above object, the present invention provides an intelligent detection method for industrial control anomalies based on deep learning, comprising:

[0006] S1, constructing a training set based on each industrial control data frame of the industrial control computer, dividing the data frame categories through the deep learning model, and determining the preset threshold corresponding to each category of data frame;

[0007] S2, building a training set based on each data frame of a single category, and using a deep learning model to simulate and predict each data frame of a single category in each detection cycle;

[0008] S3, classifying the data frame into a qualified data frame or an abnormal data frame based on the parameters contained in the data frame;

[0009] S4, determining a detection method for the central control machine based on the ratio of the number of abnormal data frames in a preset detection period to the total number of data frames detected in the preset detection period, including:

[0010] Determine whether the detection parameters for the data frame are qualified based on the comparison similarity;

[0011] Determining whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve;

[0012] Identify the abnormal area of ​​the log of the industrial computer, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether the operation of the industrial computer is abnormal based on the port traffic;

[0013] S5, when it is determined that there is an abnormality in the operation of the industrial computer, the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal, the information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0014] Furthermore, for a single data frame, several parameters contained therein are obtained, and whether the data frame is qualified is determined based on each parameter, including:

[0015] If all parameters are within the preset threshold, the single data frame is determined as a qualified data frame;

[0016] If there is a parameter that is not within the preset threshold, the single data frame is determined as an abnormal data frame.

[0017] Further, based on the ratio of the number of abnormal data frames in a preset detection period to the total number of data frames detected in the preset detection period, determining the detection method for the central control machine includes:

[0018] If the quantity ratio is zero, each data frame in a single detection cycle is compared with each predicted data frame to determine whether the detection parameters for the data frame are qualified according to the comparison similarity;

[0019] If the quantity ratio is less than or equal to the preset quantity ratio and is not zero, a parameter time domain curve is drawn based on the abnormal data frame, and whether the determination result for the single abnormal parameter is qualified is determined based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve;

[0020] If the quantity ratio is greater than the preset quantity ratio, the abnormal area of ​​the log of the industrial computer is identified, the port flow based on the time node corresponding to the abnormal area is determined, and whether there is an abnormality in the operation of the industrial computer is determined based on the port flow.

[0021] Further, each data frame in a single detection cycle is compared with each predicted data frame to determine the comparison similarity, and the byte ratio of the number of identical bytes to the total number of bytes of each data frame in a single detection cycle is solved to obtain the comparison similarity;

[0022] Determine whether the detection parameters for the data frame are qualified based on the comparison similarity, including:

[0023] If the comparison similarity is greater than the preset comparison similarity, the detection parameters for the data frame are determined to be qualified, and the corresponding preset threshold is continuously used to detect the single-type data frame in the next detection cycle;

[0024] If the comparison similarity is less than or equal to the preset comparison similarity, it is determined that the detection parameter for the data frame is unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the comparison similarity.

[0025] Furthermore, the corresponding preset threshold is adjusted to a corresponding value based on the comparison similarity, wherein:

[0026] The reduction range of the corresponding preset threshold determined based on the comparison similarity is negatively correlated with the comparison similarity.

[0027] Further, marking a parameter in a single abnormal data frame that is not within a preset threshold as an abnormal parameter, drawing a parameter time domain curve based on the abnormal data frame, and determining whether the determination result for the single abnormal parameter is qualified based on the absolute value of the slope of the parameter time domain curve under the abnormal parameter, including:

[0028] If the absolute value of the slope is less than or equal to the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the amount of data in a single detection cycle;

[0029] If the absolute value of the slope is greater than the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be qualified, and an alarm message for the abnormal data frame is issued.

[0030] Furthermore, the corresponding preset threshold is adjusted to a corresponding value based on the amount of data in a single detection cycle, wherein:

[0031] The increase range of the corresponding preset threshold determined based on the data volume in a single detection cycle is positively correlated with the data volume.

[0032] Further, identifying the abnormal area of ​​the log of the industrial computer, determining the port traffic at the time node corresponding to the abnormal area, and determining whether the operation of the industrial computer is abnormal based on the port traffic, including:

[0033] If the port flow is less than or equal to the preset port flow, it is determined that the operation of the industrial computer is normal, and an alarm message for abnormal data frames is issued;

[0034] If the port traffic is greater than the preset port traffic, the operation of the industrial computer is judged to be abnormal, and the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal. The information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0035] Furthermore, the abnormal proportion of the number of bytes in the abnormal area to the total number of bytes in the log adjusts the abnormal time interval to the corresponding value, where:

[0036] The increase in the abnormal time interval determined based on the abnormal proportion is positively correlated with the abnormal proportion.

[0037] Furthermore, when the adjustment of the abnormal time interval is completed, the adjusted abnormal time interval is compared with the preset maximum interval. If the adjusted abnormal time interval is less than or equal to the preset maximum interval, it is determined to use the adjusted abnormal time interval as the determination parameter of the risk terminal; if the adjusted abnormal time interval is greater than the preset maximum interval, it is determined to use the preset maximum interval as the determination parameter of the risk terminal, and the key length of the updated interaction key is adjusted to the corresponding value.

[0038] Compared with the prior art, the beneficial effect of the present invention lies in that it determines whether each data frame of the industrial computer is an abnormal data frame, and selects the corresponding detection method for the industrial computer according to the specific situation of the abnormal data frame, and determines whether the detection parameters of the data frame are qualified, so as to improve the reliability of the determination of the abnormal data frame. When it is determined that there is an abnormality in the industrial computer, the information interaction parameters of the risk terminal are adjusted, which improves the security of the industrial computer and improves the detection efficiency of the industrial computer.

[0039] Furthermore, it is determined whether each data in the data frame meets the corresponding preset threshold requirements to detect the existence of abnormal tendencies in the data frame, mark each abnormal data frame, and periodically detect the central control computer. When there is no abnormal data frame in a single preset detection period, it is determined whether the identification of the abnormal data frame is abnormal due to abnormalities in the detection standards for each parameter, so as to ensure the accuracy and reliability of the detection of the industrial computer; the comparison similarity is determined, and the comparison similarity characterizes the deviation between the predicted data and the actual data. When the comparison similarity is less than or equal to the preset comparison similarity, the deviation is too large, and there is a potential risk of unrecognized abnormalities. In this case, the recognition standard for the abnormal data frame is adjusted to adaptively determine the detection standard based on the actual detection situation, thereby improving the reliability of the detection of the industrial computer and further improving the detection efficiency of the industrial computer.

[0040] Furthermore, when the quantity ratio is less than or equal to the preset quantity ratio and is not zero, there are a small number of abnormal data frames. In this case, the abnormal situation of the data frame is within the normal operation range of the industrial computer. At this time, the absolute value of the slope of the single abnormal parameter under the parameter time domain curve is obtained. When the absolute value of the slope is greater than the preset absolute value of the slope, the data frame is abnormal but the industrial computer does not have an abnormal situation. At this time, an alarm message for the abnormal data frame is issued, and a reminder is processed in time. While efficiently identifying and processing each data frame of the industrial computer, the detection efficiency of the industrial computer is further improved.

[0041] Furthermore, when the quantity ratio is greater than the preset quantity ratio, a large number of abnormal data frames appear in the industrial computer. In this case, the abnormal area of ​​the log of the industrial computer is identified, and it is determined whether there is an abnormality in the port traffic at the time node corresponding to the abnormal area. When the port traffic is greater than the preset port traffic, in this case, there is an abnormal access terminal that accesses the central control computer abnormally, resulting in a large number of abnormal frames appearing in the central control computer. At this time, the risk terminal is identified and the information interaction parameters with the risk terminal are adjusted, thereby improving the operating stability of the central control computer and the detection efficiency of the industrial computer. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flowchart of the steps of the method for intelligent detection of industrial control anomalies based on deep learning according to an embodiment of the present invention;

[0043] Figure 2 A logic decision diagram for determining whether a data frame is qualified based on various parameters in an embodiment of the present invention;

[0044] Figure 3 A logic decision diagram for determining a detection method for a central control machine based on a quantity ratio according to an embodiment of the present invention;

[0045] Figure 4This is a logic decision diagram for determining whether detection parameters for a data frame are qualified based on the comparison similarity according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0047] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0048] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0049] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0050] See also Figure 1 , Figure 2 , Figure 3 as well as Figure 4 As shown, they are respectively a step flow chart of an intelligent detection method for industrial control abnormalities based on deep learning according to an embodiment of the present invention, a logic decision diagram for determining whether a data frame is qualified based on various parameters, a logic decision diagram for determining a detection method for a central control machine based on a quantity ratio, and a logic decision diagram for determining whether a detection parameter for a data frame is qualified based on a comparison of similarities; an intelligent detection method for industrial control abnormalities based on deep learning according to an embodiment of the present invention comprises:

[0051] S1, constructing a training set based on each industrial control data frame of the industrial control computer, dividing the data frame categories through the deep learning model, and determining the preset threshold corresponding to each category of data frame;

[0052] S2, building a training set based on each data frame of a single category, and using a deep learning model to simulate and predict each data frame of a single category in each detection cycle;

[0053] S3, classifying the data frame into a qualified data frame or an abnormal data frame based on the parameters contained in the data frame;

[0054] S4, determining a detection method for the central control machine based on the ratio of the number of abnormal data frames in a preset detection period to the total number of data frames detected in the preset detection period, including:

[0055] Determine whether the detection parameters for the data frame are qualified based on the comparison similarity;

[0056] Determining whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve;

[0057] Identify the abnormal area of ​​the log of the industrial computer, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether the operation of the industrial computer is abnormal based on the port traffic;

[0058] S5, when it is determined that there is an abnormality in the operation of the industrial computer, the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal, the information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0059] Specifically, it is determined whether each data frame of the industrial computer is an abnormal data frame, and according to the specific situation of the abnormal data frame, the corresponding detection method for the industrial computer is selected, and it is determined whether the detection parameters of the data frame are qualified to improve the reliability of the determination of the abnormal data frame. When it is determined that the industrial computer has an abnormality, the information interaction parameters of the risk terminal are adjusted, which improves the security of the industrial computer and the detection efficiency of the industrial computer.

[0060] Specifically, the specific process of simulating and predicting each data frame of a single category in each detection cycle through a deep learning model is not limited. It can be to continuously collect single-category data frames from an industrial computer, and clean, denoise and normalize these data to ensure the quality and consistency of the data; extract features from the input data frames, including mean, variance, maximum, minimum, statistical features, frequency features and time series features. Through the deep learning model, the data frames can be trained by but not limited to recurrent neural networks (RNN), long short-term memory networks (LSTM) and gated recurrent units (GRU), taking historical data frames as input and the corresponding data frames of the next detection cycle as output targets, which will not be elaborated here.

[0061] Specifically, in S1, different data frames are collected from the industrial control computer, and the collected industrial control data frames are sorted and organized for subsequent deep learning model training; the deep learning model is used, and the deep learning model can be but not limited to convolutional neural network (CNN) and recurrent neural network (RNN), to classify these data frames based on the information and source contained in the data frames; in the classification process, each classification category is set with a preset threshold, which will not be repeated here.

[0062] Specifically, for a single data frame, several parameters contained therein are obtained, and whether the data frame is qualified is determined based on the parameters, including:

[0063] If all parameters are within the preset threshold, the single data frame is determined as a qualified data frame;

[0064] If there is a parameter that is not within the preset threshold, the single data frame is determined as an abnormal data frame.

[0065] Specifically, there is no limitation on the preset threshold value, and it can be understood that a specific value can be set according to a specific data frame type, which will not be elaborated here.

[0066] Specifically, the detection method for the central control machine is determined based on the ratio of the number of abnormal data frames in the preset detection period to the total number of data frames detected in the preset detection period, including:

[0067] If the quantity ratio is zero, each data frame in a single detection cycle is compared with each predicted data frame to determine whether the detection parameters for the data frame are qualified according to the comparison similarity;

[0068] If the quantity ratio is less than or equal to the preset quantity ratio and is not zero, a parameter time domain curve is drawn based on the abnormal data frame, and whether the determination result for the single abnormal parameter is qualified is determined based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve;

[0069] If the quantity ratio is greater than the preset quantity ratio, the abnormal area of ​​the log of the industrial computer is identified, the port flow at the time node corresponding to the abnormal area is determined, and whether the operation of the industrial computer is abnormal is determined based on the port flow. Specifically, the preset quantity ratio is selected within the interval [0.05, 0.1].

[0070] Specifically, each data frame in a single detection cycle is compared with each predicted data frame to determine the comparison similarity, and the byte ratio of the number of identical bytes to the total number of bytes of each data frame in a single detection cycle is solved to obtain the comparison similarity;

[0071] Determine whether the detection parameters for the data frame are qualified based on the comparison similarity, including:

[0072] If the comparison similarity is greater than the preset comparison similarity, the detection parameters for the data frame are determined to be qualified, and the corresponding preset threshold is continuously used to detect the single-type data frame in the next detection cycle;

[0073] If the comparison similarity is less than or equal to the preset comparison similarity, it is determined that the detection parameter for the data frame is unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the comparison similarity.

[0074] Specifically, the preset comparison similarity S0 is selected within the interval [0.78, 0.85].

[0075] Specifically, determine whether each data in the data frame meets the corresponding preset threshold requirements to detect the existence of abnormal tendencies in the data frame, mark each abnormal data frame, and periodically detect the central control computer. When there is no abnormal data frame in a single preset detection period, determine whether the identification of the abnormal data frame is abnormal due to abnormalities in the detection standards for each parameter, so as to ensure the accuracy and reliability of the detection of the industrial computer; determine the comparison similarity, which characterizes the deviation between the predicted data and the actual data. When the comparison similarity is less than or equal to the preset comparison similarity, the deviation is too large and there is a potential risk of unrecognized abnormalities. In this case, the identification standard for the abnormal data frame is adjusted to adaptively determine the detection standard based on the actual detection situation, thereby improving the reliability of the detection of the industrial computer and further improving the detection efficiency of the industrial computer.

[0076] Specifically, the corresponding preset threshold is adjusted to a corresponding value based on the comparison similarity, where:

[0077] The reduction range of the corresponding preset threshold determined based on the comparison similarity is negatively correlated with the comparison similarity.

[0078] In this embodiment, optionally,

[0079] Comparing the comparison similarity with a first preset similarity comparison threshold and a second preset similarity comparison threshold;

[0080] If the comparison similarity is less than or equal to the first preset similarity comparison threshold, the corresponding preset threshold is adjusted to 0.73 times the initial corresponding preset threshold;

[0081] If the comparison similarity is less than or equal to the second preset similarity comparison threshold and greater than the first preset similarity comparison threshold, the corresponding preset threshold is adjusted to 0.82 times the initial corresponding preset threshold;

[0082] If the comparison similarity is greater than the second preset similarity comparison threshold, the corresponding preset threshold is adjusted to 0.91 times the initial corresponding preset threshold;

[0083] The first preset similarity comparison threshold is 0.45S0, and the second preset similarity comparison threshold is 0.77S0.

[0084] Specifically, it can be understood that the reduction of the corresponding preset threshold is the reduction of the overall range of the threshold. The center value of the corresponding preset threshold is used as the benchmark, and the two end values ​​of the interval are moved closer to the benchmark to narrow the range until the reduced range is the corresponding proportion of the initial corresponding preset threshold.

[0085] Specifically, a parameter in a single abnormal data frame that is not within a preset threshold is marked as an abnormal parameter, a parameter time domain curve is drawn based on the abnormal data frame, and based on the absolute value of the slope of the parameter time domain curve under the abnormal parameter, whether the determination result for the single abnormal parameter is qualified is determined, including:

[0086] If the absolute value of the slope is less than or equal to the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the amount of data in a single detection cycle;

[0087] If the absolute value of the slope is greater than the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be qualified, and an alarm message for the abnormal data frame is issued.

[0088] Specifically, when the quantity ratio is less than or equal to the preset quantity ratio and is not zero, there are a small number of abnormal data frames. In this case, the abnormal situation of the data frame is within the normal operation range of the industrial computer. At this time, the absolute value of the slope of a single abnormal parameter under the parameter time domain curve is obtained. When the absolute value of the slope is greater than the preset absolute value of the slope, the data frame is abnormal but the industrial computer does not have an abnormal situation. At this time, an alarm message for the abnormal data frame is issued, and a reminder is processed in time. While efficiently identifying and processing each data frame of the industrial computer, the detection efficiency of the industrial computer is further improved.

[0089] Specifically, the preset slope absolute value Y0 is selected within the interval [1.3K0, 1.7K0], and K0 is the average slope of the parameter time domain curve.

[0090] Specifically, the corresponding preset threshold is adjusted to a corresponding value based on the amount of data in a single detection cycle, where:

[0091] The increase range of the corresponding preset threshold determined based on the data volume in a single detection cycle is positively correlated with the data volume.

[0092] In this embodiment, optionally,

[0093] Comparing the data volume in a single detection cycle with the first preset data volume and the second preset data volume;

[0094] If the data volume in a single detection cycle is less than or equal to the first preset data volume, the corresponding preset threshold is adjusted to 1.11 times the initial corresponding preset threshold;

[0095] If the data volume in a single detection cycle is less than or equal to the second preset data volume and greater than the first preset data volume, the corresponding preset threshold is adjusted to 1.21 times the initial corresponding preset threshold;

[0096] If the data volume in a single detection cycle is greater than the second preset data volume, the corresponding preset threshold is adjusted to 1.33 times the initial corresponding preset threshold;

[0097] The first preset data volume is 1.5J0, and the second preset data volume is 3.7J0, where J0 is the average value of each data volume corresponding to each detection cycle in the historical data.

[0098] Specifically, the abnormal area of ​​the log of the industrial computer is identified, the port traffic corresponding to the time node of the abnormal area is determined, and whether the operation of the industrial computer is abnormal based on the port traffic is determined, including:

[0099] If the port flow is less than or equal to the preset port flow, it is determined that the operation of the industrial computer is normal, and an alarm message for abnormal data frames is issued;

[0100] If the port traffic is greater than the preset port traffic, the operation of the industrial computer is judged to be abnormal, and the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal. The information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0101] Specifically, there is no limitation on the specific method of identifying abnormal areas of the logs of industrial computers. The log data collected in the industrial computers can be processed and parsed through regular expressions, code analysis, machine learning and natural language. An abnormality detection model for logs is established, and the input data is determined to be log information, and the output data is the abnormal area in the detected log data. The abnormality detection method can be an abnormality detection based on a graph model, an abnormality detection based on probability analysis, and an abnormality detection based on machine learning. It can be understood that the abnormal area of ​​the log of the industrial computer can be identified. This is a prior art and will not be repeated.

[0102] Specifically, the preset port flow D0 is selected within the interval [2.3U0, 7.9U0], and U0 is the average value of the port flow in each detection cycle in the acquired historical data.

[0103] Specifically, when the quantity ratio is greater than the preset quantity ratio, a large number of abnormal data frames appear in the industrial computer. In this case, the abnormal area of ​​the log of the industrial computer is identified, and it is determined whether there is an abnormality in the port traffic at the time node corresponding to the abnormal area. When the port traffic is greater than the preset port traffic, in this case, there is an abnormal access terminal that accesses the central control computer abnormally, resulting in a large number of abnormal frames in the central control computer. At this time, the risk terminal is identified and the information interaction parameters with the risk terminal are adjusted, which improves the operating stability of the central control computer and the detection efficiency of the industrial computer.

[0104] Specifically, the abnormal proportion of the number of bytes in the abnormal area to the total number of bytes in the log adjusts the abnormal time interval to the corresponding value, where:

[0105] The increase in the abnormal time interval determined based on the abnormal proportion is positively correlated with the abnormal proportion.

[0106] In this embodiment, optionally,

[0107] comparing the abnormal proportion with the first preset abnormal proportion and the second preset abnormal proportion;

[0108] If the abnormal proportion is less than or equal to the first preset abnormal proportion, the abnormal time interval is adjusted to 1.13 times the initial abnormal time interval;

[0109] If the abnormal proportion is less than or equal to the second preset abnormal proportion and greater than the first preset abnormal proportion, the abnormal time interval is adjusted to 1.23 times the initial abnormal time interval;

[0110] If the abnormal proportion is greater than the second preset abnormal proportion, the abnormal time interval is adjusted to 1.33 times the initial abnormal time interval;

[0111] The first preset abnormal proportion is 0.44, and the second preset abnormal proportion is 0.78.

[0112] Specifically, when the adjustment of the abnormal time interval is completed, the adjusted abnormal time interval is compared with the preset maximum interval. If the adjusted abnormal time interval is less than or equal to the preset maximum interval, it is determined to use the adjusted abnormal time interval as the determination parameter of the risk terminal; if the adjusted abnormal time interval is greater than the preset maximum interval, it is determined to use the preset maximum interval as the determination parameter of the risk terminal, and the key length of the updated interaction key is adjusted to the corresponding value.

[0113] Specifically, optionally, when it is determined to use the preset maximum interval as the determination parameter of the risk terminal, the key length of the updated interactive key is adjusted to 1.2 times the initial key length.

[0114] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0115] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for intelligent detection of industrial control anomalies based on deep learning, characterized in that: include: S1, constructing a training set based on each industrial control data frame of the industrial control computer, dividing the data frame categories through the deep learning model, and determining the preset threshold corresponding to each category of data frame; S2, building a training set based on each data frame of a single category, and using a deep learning model to simulate and predict each data frame of a single category in each detection cycle; S3, classifying the data frame into a qualified data frame or an abnormal data frame based on the parameters contained in the data frame; S4, determining a detection method for the central control machine based on the ratio of the number of abnormal data frames in a preset detection period to the total number of data frames detected in the preset detection period, including: Determine whether the detection parameters for the data frame are qualified based on the comparison similarity; Determining whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve; Identify the abnormal area of ​​the log of the industrial computer, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether the operation of the industrial computer is abnormal based on the port traffic; S5, when it is determined that there is an abnormality in the operation of the industrial computer, the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal, the information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

2. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 1 is characterized in that: For a single data frame, several parameters contained in it are obtained, and whether the data frame is qualified is determined based on each parameter, including: If all parameters are within the preset threshold, the single data frame is determined as a qualified data frame; If there is a parameter that is not within the preset threshold, the single data frame is determined as an abnormal data frame.

3. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 2 is characterized in that: The detection method for the central control machine is determined based on the ratio of the number of abnormal data frames in a preset detection period to the total number of data frames detected in the preset detection period, including: If the quantity ratio is zero, each data frame in a single detection cycle is compared with each predicted data frame to determine whether the detection parameters for the data frame are qualified according to the comparison similarity; If the quantity ratio is less than or equal to the preset quantity ratio and is not zero, a parameter time domain curve is drawn based on the abnormal data frame, and whether the determination result for the single abnormal parameter is qualified is determined based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve; If the quantity ratio is greater than the preset quantity ratio, the abnormal area of ​​the log of the industrial computer is identified, the port flow based on the time node corresponding to the abnormal area is determined, and whether there is an abnormality in the operation of the industrial computer is determined based on the port flow.

4. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 3 is characterized in that: Compare each data frame in a single detection cycle with each predicted data frame to determine the comparison similarity, calculate the byte ratio of the number of identical bytes to the total number of bytes of each data frame in a single detection cycle, and obtain the comparison similarity; Determine whether the detection parameters for the data frame are qualified based on the comparison similarity, including: If the comparison similarity is greater than the preset comparison similarity, the detection parameters for the data frame are determined to be qualified, and the corresponding preset threshold is continuously used to detect the single-class data frame in the next detection cycle; If the comparison similarity is less than or equal to the preset comparison similarity, it is determined that the detection parameter for the data frame is unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the comparison similarity.

5. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 4 is characterized in that: Based on the comparison similarity, the corresponding preset threshold is adjusted to the corresponding value, where: The reduction range of the corresponding preset threshold determined based on the comparison similarity is negatively correlated with the comparison similarity.

6. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 5 is characterized in that: Marking a parameter in a single abnormal data frame that is not within a preset threshold as an abnormal parameter, drawing a parameter time domain curve based on the abnormal data frame, and determining whether a determination result for the single abnormal parameter is qualified based on an absolute value of a slope of the parameter time domain curve under the abnormal parameter, including: If the absolute value of the slope is less than or equal to the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the amount of data in a single detection cycle; If the absolute value of the slope is greater than the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be qualified, and an alarm message for the abnormal data frame is issued.

7. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 6 is characterized in that: Based on the amount of data in a single detection cycle, the corresponding preset threshold is adjusted to the corresponding value, where: The increase range of the corresponding preset threshold determined based on the data volume in a single detection cycle is positively correlated with the data volume.

8. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 7 is characterized in that: Identify the abnormal area of ​​the log of the industrial computer, determine the port traffic at the time node corresponding to the abnormal area, and determine whether the operation of the industrial computer is abnormal based on the port traffic, including: If the port flow is less than or equal to the preset port flow, it is determined that the operation of the industrial computer is normal, and an alarm message for abnormal data frames is issued; If the port traffic is greater than the preset port traffic, the operation of the industrial computer is judged to be abnormal, and the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal. The information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

9. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 8, characterized in that: The abnormal proportion of the number of bytes in the abnormal area to the total number of bytes in the log adjusts the abnormal time interval to the corresponding value, where: The increase in the abnormal time interval determined based on the abnormal proportion is positively correlated with the abnormal proportion.

10. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 9, characterized in that: When the adjustment of the abnormal time interval is completed, the adjusted abnormal time interval is compared with the preset maximum interval. If the adjusted abnormal time interval is less than or equal to the preset maximum interval, it is determined to use the adjusted abnormal time interval as the determination parameter of the risk terminal; if the adjusted abnormal time interval is greater than the preset maximum interval, it is determined to use the preset maximum interval as the determination parameter of the risk terminal, and the key length of the updated interaction key is adjusted to the corresponding value.

Images