Intelligent Detection Method for Industrial Control Anomalies Based on Deep Learning

Abstract

The present invention relates to the field of industrial control detection technology, and particularly relates to an intelligent detection method for industrial control anomalies based on deep learning, including: determining preset thresholds corresponding to various types of data frames; dividing the data frames into qualified data frames or abnormal data frames; determining whether each data frame of the industrial control computer is an abnormal data frame, so as to select a corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, and determining whether the detection parameters of the data frame are qualified, so as to improve the reliability of the determination of the abnormal data frame. When it is determined that the industrial control computer has an anomaly, the information interaction parameters of the risk terminal are adjusted, which improves the security of the industrial control computer and at the same time improves the detection efficiency of the industrial control computer.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control detection, and particularly to an intelligent detection method for industrial control anomalies based on deep learning. Background Art

[0002] With the rapid development of information technology, industrial control networks are facing more and more risks. Industrial control systems control key production processes and equipment. Through detection, potential faults, anomalies, and security vulnerabilities can be discovered in a timely manner, accidents can be prevented, the safety of personnel can be guaranteed, equipment damage can be avoided, and thus production interruptions and property losses can be reduced; to ensure the stable and uninterrupted operation of the industrial production process. Detecting and solving problems in a timely manner can avoid production stagnation caused by system failures, improve production efficiency and delivery capabilities, meet market demands, and it is particularly important to monitor industrial control computers. With the development of the industrial Internet, industrial control systems are facing more and more network attack risks. Detection can provide information about system performance, help enterprises discover bottlenecks and inefficiencies in the system, optimize and improve, and improve resource utilization and production quality.

[0003] Chinese Patent Publication No.: CN106487813A discloses an industrial control network security detection system. Among them, the test case module provides test cases to the fuzz testing engine; the fuzz testing engine generates test data packets and performs security detection on the detection target, and obtains test results including "normal", "other", and "suspected vulnerability"; the monitor monitors the state of the detection target in real time; the root cause analysis module drives the fuzz testing engine to perform attack replay, and performs anomaly analysis on the abnormal data packets after the vulnerability verification is successful to obtain the root cause of the security vulnerability; the report generation engine generates a test report. Using this industrial control network security detection system for security detection; it can be seen that the above technical solution has the following problems: it does not consider determining whether each data frame for the industrial control computer is an abnormal data frame, and does not consider selecting a corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, which affects the detection efficiency for industrial control. Summary of the Invention

[0004] Therefore, the present invention provides an intelligent detection method for industrial control anomalies based on deep learning to overcome the problems in the prior art that do not consider determining whether each data frame for the industrial control computer is an abnormal data frame, do not consider selecting a corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, and affect the detection efficiency for industrial control.

[0005] To achieve the above object, the present invention provides an intelligent detection method for industrial control anomalies based on deep learning, including:

[0006] S1. Construct a training set based on each industrial control data frame of the industrial control computer, divide the data frame categories through a deep learning model, and determine the preset thresholds corresponding to each category of data frames;

[0007] S2. Construct a training set based on each data frame of a single category, and simulate and predict each data frame of a single category within each detection period through a deep learning model;

[0008] S3. Divide the data frames into qualified data frames or abnormal data frames based on the parameters included in the data frames;

[0009] S4. Determine the detection method for the central control computer based on the ratio of the number of abnormal data frames within the preset detection period to the total number of detected data frames within the preset detection period, including:

[0010] Determine whether the detection parameters for the data frames are qualified based on the comparison similarity;

[0011] Determine whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter in the parameter time domain curve that is not within the preset threshold;

[0012] Identify the abnormal area of the log of the industrial control computer, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether there is an abnormality in the operation of the industrial control computer based on the port traffic;

[0013] S5. When it is determined that there is an abnormality in the operation of the industrial control computer, mark the terminals that interact with the industrial control computer within the abnormal time interval corresponding to the abnormal area as risk terminals, update the information interaction secret keys with the risk terminals, and adjust the abnormal time interval to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0014] Further, for a single data frame, obtain several parameters it contains, and determine whether the data frame is qualified based on each parameter, including:

[0015] If each parameter is within the preset threshold, determine the single data frame as a qualified data frame;

[0016] If there is a parameter that is not within the preset threshold, determine the single data frame as an abnormal data frame.

[0017] Further, determine the detection method for the central control computer based on the ratio of the number of abnormal data frames within the preset detection period to the total number of detected data frames within the preset detection period, including:

[0018] If the ratio is zero, compare each data frame within a single detection period with the predicted data frames to determine whether the detection parameters for the data frames are qualified according to the comparison similarity;

[0019] If the quantity ratio is less than or equal to the preset quantity ratio and is not zero, then draw a parameter time-domain curve based on the abnormal data frame, and determine whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter in the parameter time-domain curve that is not within the preset threshold;

[0020] If the quantity ratio is greater than the preset quantity ratio, then identify the abnormal area of the industrial control computer's log, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether there is an abnormality in the operation of the industrial control computer based on the port traffic.

[0021] Furthermore, compare each data frame within a single detection period with the predicted data frames to determine the comparison similarity, and solve the byte ratio of the same number of bytes to the total number of bytes of each data frame within a single detection period to obtain the comparison similarity;

[0022] Determine whether the detection parameters for the data frame are qualified based on the comparison similarity, including:

[0023] If the comparison similarity is greater than the preset comparison similarity, then determine that the detection parameters for the data frame are qualified, and continue to use the corresponding preset threshold to detect a single type of data frame in the next detection period;

[0024] If the comparison similarity is less than or equal to the preset comparison similarity, then determine that the detection parameters for the data frame are unqualified, and adjust the corresponding preset threshold to the corresponding value based on the comparison similarity.

[0025] Furthermore, adjust the corresponding preset threshold to the corresponding value based on the comparison similarity, where:

[0026] The reduction amplitude of the corresponding preset threshold determined based on the comparison similarity is negatively correlated with the comparison similarity.

[0027] Furthermore, mark the parameters in a single abnormal data frame that are not within the preset threshold as abnormal parameters, draw a parameter time-domain curve based on the abnormal data frame, and determine whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter time-domain curve at the abnormal parameter, including:

[0028] If the absolute value of the slope is less than or equal to the preset absolute value of the slope, then determine that the determination result for a single abnormal parameter is unqualified, and adjust the corresponding preset threshold to the corresponding value based on the data volume within a single detection period;

[0029] If the absolute value of the slope is greater than the preset absolute value of the slope, then determine that the determination result for a single abnormal parameter is qualified, and send an alarm message for the abnormal data frame.

[0030] Furthermore, adjust the corresponding preset threshold to the corresponding value based on the data volume within a single detection period, where:

[0031] The increase amplitude of the corresponding preset threshold determined based on the data volume within a single detection period is positively correlated with the data volume.

[0032] Furthermore, identify the abnormal area of the industrial control computer's log, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether there is an abnormality in the operation of the industrial control computer based on the port traffic, including:

[0033] If the port traffic is less than or equal to the preset port traffic, it is determined that the operation of the industrial control computer is normal, and an alarm message for the abnormal data frame is issued;

[0034] If the port traffic is greater than the preset port traffic, it is determined that the operation of the industrial control computer is abnormal, and the terminals that interact with the industrial control computer within the abnormal time interval corresponding to the abnormal area are recorded as risk terminals, the information interaction key with the risk terminals is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0035] Furthermore, the abnormal proportion of the number of bytes in the abnormal area to the total number of bytes in the log adjusts the abnormal time interval to the corresponding value, where:

[0036] The increase amplitude of the abnormal time interval determined based on the abnormal proportion is positively correlated with the abnormal proportion.

[0037] Furthermore, when the adjustment of the abnormal time interval is completed, compare the adjusted abnormal time interval with the preset maximum interval. If the adjusted abnormal time interval is less than or equal to the preset maximum interval, it is determined to use the adjusted abnormal time interval as the determination parameter for the risk terminal; if the adjusted abnormal time interval is greater than the preset maximum interval, it is determined to use the preset maximum interval as the determination parameter for the risk terminal, and the key length of the updated interaction key is adjusted to the corresponding value.

[0038] Compared with the prior art, the beneficial effects of the present invention are as follows: determine whether each data frame of the industrial control computer is an abnormal data frame, select the corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, determine whether the detection parameters of the data frame are qualified, so as to improve the reliability of determining the abnormal data frame. When it is determined that the industrial control computer has an abnormality, adjust the information interaction parameters of the risk terminal, which improves the security of the industrial control computer and at the same time improves the detection efficiency of the industrial control computer.

[0039] Further, determine whether each data in the data frame meets the corresponding preset threshold requirements to detect an abnormal tendency in the data frame, mark each abnormal data frame, and periodically detect the central control machine. When there is no abnormal data frame in a single preset detection period, determine whether the detection criteria for each parameter are abnormal, resulting in abnormal identification of abnormal data frames, so as to ensure the accuracy and reliability of the detection of the industrial control computer; determine the comparison similarity, which characterizes the deviation between the predicted data and the actual data. When the comparison similarity is less than or equal to the preset comparison similarity, the deviation is too large, and there is a potential abnormal risk that has not been identified. In this case, adjust the identification criteria for abnormal data frames to adaptively determine the detection criteria based on the actual detection situation, improving the reliability of the detection of the industrial control computer and further enhancing the detection efficiency of the industrial control computer.

[0040] Further, when the quantity ratio is less than or equal to the preset quantity ratio and is not zero, there are a small number of abnormal data frames. In this case, the abnormal situation of the data frame is within the normal operating range of the industrial control computer. At this time, obtain the absolute value of the slope of a single abnormal parameter under the parameter time-domain curve. When the absolute value of the slope is greater than the preset absolute value of the slope, the data frame is abnormal but the industrial control computer does not show an abnormal situation. At this time, send an alarm message for the abnormal data frame for timely reminder processing, further improving the detection efficiency of the industrial control computer while efficiently identifying and processing each data frame of the industrial control computer.

[0041] Further, when the quantity ratio is greater than the preset quantity ratio, the industrial control computer has a large number of abnormal data frames. In this case, identify the abnormal area of the log of the industrial control computer and determine whether there is an abnormality in the port traffic at the time node corresponding to the abnormal area. When the port traffic is greater than the preset port traffic, in this case, there is an abnormal access terminal that abnormally accesses the central control machine, resulting in a large number of abnormal data frames in the central control machine. At this time, identify the risk terminal and adjust the information interaction parameters with the risk terminal, improving the operating stability of the central control machine and the detection efficiency of the industrial control computer. Description of the Drawings

[0042] Figure 1 It is a step flow chart of the industrial control anomaly intelligent detection method based on deep learning according to an embodiment of the present invention;

[0043] Figure 2 It is a logical decision diagram for determining whether a data frame is qualified based on each parameter according to an embodiment of the present invention;

[0044] Figure 3 It is a logical decision diagram for determining the detection method for the central control machine based on the quantity ratio according to an embodiment of the present invention;

[0045] Figure 4This is a logic decision diagram for determining whether the detection parameters for a data frame are qualified based on the comparison similarity in the embodiments of the present invention. Detailed implementation manners

[0046] In order to make the objectives and advantages of the present invention clearer, the present invention will be further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0047] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present invention and do not limit the protection scope of the present invention.

[0048] It should be noted that in the description of the present invention, the terms indicating directions or positional relationships such as "upper", "lower", "left", "right", "inner", "outer", etc. are based on the directions or positional relationships shown in the drawings. This is only for convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention.

[0049] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installation", "connection", and "connection" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, and it can be the communication inside two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0050] Please refer to Figure 1 、 Figure 2 、 Figure 3 and Figure 4 as shown, which are respectively the step flow chart of the industrial control anomaly intelligent detection method based on deep learning in the embodiments of the present invention, the logic decision diagram for determining whether a data frame is qualified based on various parameters, the logic decision diagram for determining the detection method for a central control unit based on the quantity ratio, and the logic decision diagram for determining whether the detection parameters for a data frame are qualified based on the comparison similarity; an industrial control anomaly intelligent detection method based on deep learning in the embodiments of the present invention includes:

[0051] S1. Construct a training set based on each industrial control data frame of the industrial control computer, divide the data frame categories through a deep learning model, and determine the preset thresholds corresponding to each category of data frames;

[0052] S2. Construct a training set based on each data frame of a single category, and simulate and predict each data frame of a single category in each detection period through a deep learning model;

[0053] S3. Divide the data frame into a qualified data frame or an abnormal data frame based on the parameters included in the data frame;

[0054] S4. Determine the detection method for the central control unit based on the ratio of the number of abnormal data frames within a preset detection period to the total number of data frames detected within the preset detection period, including:

[0055] Determine whether the detection parameters for the data frame are qualified based on the comparison similarity;

[0056] Determine whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter within the parameter time domain curve that is not within the preset threshold;

[0057] Identify the abnormal area of the industrial control computer's log, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether there is an abnormality in the operation of the industrial control computer based on the port traffic;

[0058] S5. When it is determined that there is an abnormality in the operation of the industrial control computer, mark the terminals that interact with the industrial control computer within the abnormal time interval corresponding to the abnormal area as risk terminals, update the information interaction secret keys with the risk terminals, and adjust the abnormal time interval to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0059] Specifically, determine whether each data frame of the industrial control computer is an abnormal data frame, so as to select the corresponding detection method for the industrial control computer according to the specific situation of the abnormal data frame, and determine whether the detection parameters for the data frame are qualified, so as to improve the reliability of the determination of abnormal data frames. When it is determined that the industrial control computer has an abnormality, adjust the information interaction parameters of the risk terminals, which improves the security of the industrial control computer and at the same time improves the detection efficiency of the industrial control computer.

[0060] Specifically, the specific process of simulating and predicting each data frame of a single category within each detection period through a deep learning model is not limited. It can continuously collect single-category data frames from the industrial control computer, and clean, denoise, and normalize these data to ensure the quality and consistency of the data; extract features from the input data frames, including mean, variance, maximum value, minimum value, statistical features, frequency features, and time series features. Through a deep learning model, such as but not limited to a recurrent neural network (RNN), a long short-term memory network (LSTM), and a gated recurrent unit (GRU), train the data frames, use the historical data frames as inputs, and the data frames of the corresponding next detection period as output targets, which will not be elaborated here.

[0061] Specifically, for different data frames collected from the industrial control computer in S1, the collected industrial control data frames are sorted and organized for subsequent deep learning model training; a deep learning model, which can be but is not limited to a convolutional neural network (CNN) or a recurrent neural network (RNN), is used to classify these data frames, and they are classified based on the information and sources contained in the sub-data frames; during the classification process, a preset threshold is set for each classification category, which will not be elaborated here.

[0062] Specifically, for a single data frame, several parameters it contains are obtained, and based on each parameter, it is determined whether the data frame is qualified, including:

[0063] If each parameter is within the preset threshold, the single data frame is determined to be a qualified data frame;

[0064] If there is a parameter not within the preset threshold, the single data frame is determined to be an abnormal data frame.

[0065] Specifically, no limitation is imposed on the preset threshold. It can be understood that specific values can be set according to the specific data frame type, which will not be elaborated here.

[0066] Specifically, based on the ratio of the number of abnormal data frames within a preset detection period to the total number of data frames detected within the preset detection period, the detection method for the central control computer is determined, including:

[0067] If the ratio is zero, each data frame within a single detection period is compared with each predicted data frame to determine whether the detection parameters for the data frame are qualified according to the comparison similarity;

[0068] If the ratio is less than or equal to the preset ratio and not zero, a parameter time-domain curve is drawn based on the abnormal data frames, and based on the absolute value of the slope of the parameter not within the preset threshold in the parameter time-domain curve, it is determined whether the determination result for a single abnormal parameter is qualified;

[0069] If the ratio is greater than the preset ratio, the abnormal area of the industrial control computer's log is identified, the port traffic corresponding to the time node of the abnormal area is determined, and based on the port traffic, it is determined whether there is an abnormality in the operation of the industrial control computer. Specifically, the preset ratio is selected within the range [0.05, 0.1].

[0070] Specifically, each data frame within a single detection period is compared with each predicted data frame to determine the comparison similarity, and the byte ratio of the same number of bytes to the total number of bytes of each data frame within a single detection period is solved to obtain the comparison similarity;

[0071] Based on the comparison similarity, it is determined whether the detection parameters for the data frame are qualified, including:

[0072] If the comparison similarity is greater than the preset comparison similarity, it is determined that the detection parameters for the data frame are qualified, and the corresponding preset threshold is continuously used to detect the single-class data frame in the next detection cycle;

[0073] If the comparison similarity is less than or equal to the preset comparison similarity, it is determined that the detection parameters for the data frame are unqualified, and the corresponding preset threshold is adjusted to the corresponding value based on the comparison similarity.

[0074] Specifically, the preset comparison similarity S0 is selected within the range [0.78, 0.85].

[0075] Specifically, determine whether each data in the data frame meets the corresponding preset threshold requirements to detect whether the data frame has an abnormal tendency, mark each abnormal data frame, and periodically detect the central control machine. When there is no abnormal data frame in a single preset detection cycle, determine whether the abnormal data frame is not recognized due to abnormal detection criteria for each parameter, so as to ensure the accuracy and reliability of the industrial control computer detection; determine the comparison similarity, which characterizes the deviation between the predicted data and the actual data. When the comparison similarity is less than or equal to the preset comparison similarity, the deviation is too large and there is a potential abnormal risk that has not been recognized. In this case, the recognition criteria for abnormal data frames are adjusted to adaptively determine the detection criteria based on the actual detection situation, improving the reliability of the industrial control computer detection while further improving the detection efficiency of the industrial control computer.

[0076] Specifically, the corresponding preset threshold is adjusted to the corresponding value based on the comparison similarity, where:

[0077] The reduction amplitude of the corresponding preset threshold determined based on the comparison similarity is negatively correlated with the comparison similarity.

[0078] In this embodiment, optionally,

[0079] Compare the comparison similarity with the first preset similarity comparison threshold and the second preset similarity comparison threshold;

[0080] If the comparison similarity is less than or equal to the first preset similarity comparison threshold, the corresponding preset threshold is adjusted to 0.73 times the initial corresponding preset threshold;

[0081] If the comparison similarity is less than or equal to the second preset similarity comparison threshold and greater than the first preset similarity comparison threshold, the corresponding preset threshold is adjusted to 0.82 times the initial corresponding preset threshold;

[0082] If the comparison similarity is greater than the second preset similarity comparison threshold, the corresponding preset threshold is adjusted to 0.91 times the initial corresponding preset threshold;

[0083] The first preset similarity comparison threshold is set to 0.45S0, and the second preset similarity comparison threshold is set to 0.77S0.

[0084] Specifically, it can be understood that for the reduction of the corresponding preset threshold, it is a reduction of the overall range of the threshold. Based on the central value of the corresponding preset threshold, the two end values of the interval approach the benchmark to narrow the range until the reduced range is the corresponding proportion of the initial corresponding preset threshold.

[0085] Specifically, the parameters not within the preset threshold in a single abnormal data frame are marked as abnormal parameters. Based on the abnormal data frame, a parameter time-domain curve is drawn. Based on the absolute value of the slope of the parameter time-domain curve under the abnormal parameters, it is determined whether the determination result for a single abnormal parameter is qualified, including:

[0086] If the absolute value of the slope is less than or equal to the preset absolute value of the slope, it is determined that the determination result for a single abnormal parameter is unqualified, and the corresponding preset threshold is adjusted to the corresponding value based on the data volume within a single detection period;

[0087] If the absolute value of the slope is greater than the preset absolute value of the slope, it is determined that the determination result for a single abnormal parameter is qualified, and an alarm message for the abnormal data frame is issued.

[0088] Specifically, when the quantity ratio is less than or equal to the preset quantity ratio and is not zero, there are a small number of abnormal data frames. In this case, the abnormal situation of the data frames is within the normal operation range of the industrial control computer. At this time, the absolute value of the slope of a single abnormal parameter under the parameter time-domain curve is obtained. When the absolute value of the slope is greater than the preset absolute value of the slope, the data frame is abnormal but the industrial control computer does not show an abnormal situation. At this time, an alarm message for the abnormal data frame is issued to perform a reminder process in a timely manner, while improving the detection efficiency of the industrial control computer while efficiently identifying and processing each data frame of the industrial control computer.

[0089] Specifically, the preset absolute value of the slope Y0 is selected within the interval [1.3K0, 1.7K0], where K0 is the average slope of the parameter time-domain curve.

[0090] Specifically, the corresponding preset threshold is adjusted to the corresponding value based on the data volume within a single detection period, where:

[0091] The increase amplitude of the corresponding preset threshold determined based on the data volume within a single detection period is positively correlated with the data volume.

[0092] In this embodiment, optionally,

[0093] The data volume within a single detection period is compared with the first preset data volume and the second preset data volume;

[0094] If the amount of data within a single detection period is less than or equal to the first preset amount of data, the corresponding preset threshold is adjusted to 1.11 times the initial corresponding preset threshold;

[0095] If the amount of data within a single detection period is less than or equal to the second preset amount of data and greater than the first preset amount of data, the corresponding preset threshold is adjusted to 1.21 times the initial corresponding preset threshold;

[0096] If the amount of data within a single detection period is greater than the second preset amount of data, the corresponding preset threshold is adjusted to 1.33 times the initial corresponding preset threshold;

[0097] The first preset amount of data is taken as 1.5J0, and the second preset amount of data is taken as 3.7J0, where J0 is the average value of the amounts of data corresponding to each detection period in the historical data.

[0098] Specifically, identify the abnormal area of the industrial control computer's log, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether there is an abnormality in the operation of the industrial control computer based on the port traffic, including:

[0099] If the port traffic is less than or equal to the preset port traffic, it is determined that the operation of the industrial control computer is normal, and an alarm message for abnormal data frames is issued;

[0100] If the port traffic is greater than the preset port traffic, it is determined that the operation of the industrial control computer is abnormal, the terminals that interact with the industrial control computer within the abnormal time interval corresponding to the abnormal area are recorded as risk terminals, the information interaction key with the risk terminals is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

[0101] Specifically, the specific method for identifying the abnormal area of the industrial control computer's log is not limited. It can perform data processing on the log data collected in the industrial control computer and parse the data through regular expressions, code analysis, machine learning, and natural language. An abnormal detection model for the log is established, the input data is determined to be the log information, and the output data is the abnormal area in the detected log data. The abnormal detection method can be abnormal detection based on a graph model, abnormal detection based on probability analysis, and abnormal detection based on machine learning. It can be understood that it is only necessary to identify the abnormal area of the industrial control computer's log, which is the prior art and will not be elaborated here.

[0102] Specifically, the preset port traffic D0 is selected within the range [2.3U0, 7.9U0], where U0 is the average value of the port traffic in each detection period of the obtained historical data.

[0103] Specifically, when the quantity ratio is greater than the preset quantity ratio, a large number of abnormal data frames appear in the industrial control computer. In this case, the abnormal area of the log of the industrial control computer is identified, and it is determined whether there is an abnormality in the port traffic at the time node corresponding to the abnormal area. When the port traffic is greater than the preset port traffic, in this case, there is an abnormal access terminal that makes abnormal access to the central control computer, resulting in a large number of abnormal frames in the central control computer. At this time, the risk terminal is identified, and the information interaction parameters with the risk terminal are adjusted, improving the operation stability of the central control computer and the detection efficiency for the industrial control computer.

[0104] Specifically, the abnormal proportion of the number of bytes in the abnormal area to the total number of bytes in the log adjusts the abnormal time interval to the corresponding value, where:

[0105] The increase amplitude of the abnormal time interval determined based on the abnormal proportion is positively correlated with the abnormal proportion.

[0106] In this embodiment, optionally,

[0107] Compare the abnormal proportion with the first preset abnormal proportion and the second preset abnormal proportion;

[0108] If the abnormal proportion is less than or equal to the first preset abnormal proportion, adjust the abnormal time interval to 1.13 times the initial abnormal time interval;

[0109] If the abnormal proportion is less than or equal to the second preset abnormal proportion and greater than the first preset abnormal proportion, adjust the abnormal time interval to 1.23 times the initial abnormal time interval;

[0110] If the abnormal proportion is greater than the second preset abnormal proportion, adjust the abnormal time interval to 1.33 times the initial abnormal time interval;

[0111] The first preset abnormal proportion is taken as 0.44, and the second preset abnormal proportion is taken as 0.78.

[0112] Specifically, when the adjustment of the abnormal time interval is completed, compare the adjusted abnormal time interval with the preset maximum interval. If the adjusted abnormal time interval is less than or equal to the preset maximum interval, it is determined to use the adjusted abnormal time interval as the determination parameter for the risk terminal; if the adjusted abnormal time interval is greater than the preset maximum interval, it is determined to use the preset maximum interval as the determination parameter for the risk terminal, and the key length of the updated interactive key is adjusted to the corresponding value.

[0113] Specifically, optionally, when it is determined to use the preset maximum interval as the determination parameter for the risk terminal, the key length of the updated interactive key is adjusted to 1.2 times the initial key length.

[0114] So far, the technical solution of the present invention has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easily understood by those skilled in the art that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0115] The above are only the preferred embodiments of the present invention and are not used to limit the present invention; for those skilled in the art, the present invention can have various changes and modifications. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for intelligent detection of industrial control anomalies based on deep learning, characterized in that: include: S1, constructing a training set based on each industrial control data frame of the industrial control computer, dividing the data frame categories through the deep learning model, and determining the preset threshold corresponding to each category of data frame; S2, building a training set based on each data frame of a single category, and using a deep learning model to simulate and predict each data frame of a single category in each detection cycle; S3, classifying the data frame into a qualified data frame or an abnormal data frame based on the parameters contained in the data frame; S4, determining a detection method for the industrial computer based on a ratio of the number of abnormal data frames within a preset detection period to the total number of data frames detected within the preset detection period, including: Determine whether the detection parameters for the data frame are qualified based on the comparison similarity; Determining whether the determination result for a single abnormal parameter is qualified based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve; Identify the abnormal area of ​​the log of the industrial computer, determine the port traffic based on the time node corresponding to the abnormal area, and determine whether the operation of the industrial computer is abnormal based on the port traffic; S5, when it is determined that there is an abnormality in the operation of the industrial computer, the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal, the information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

2. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 1 is characterized in that: For a single data frame, several parameters contained in it are obtained, and whether the data frame is qualified is determined based on each parameter, including: If all parameters are within the preset threshold, the single data frame is determined as a qualified data frame; If there is a parameter that is not within the preset threshold, the single data frame is determined as an abnormal data frame.

3. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 2 is characterized in that: The detection method for the industrial computer is determined based on the ratio of the number of abnormal data frames in a preset detection period to the total number of data frames detected in the preset detection period, including: If the quantity ratio is zero, each data frame in a single detection cycle is compared with each predicted data frame to determine whether the detection parameters for the data frame are qualified according to the comparison similarity; If the quantity ratio is less than or equal to the preset quantity ratio and is not zero, a parameter time domain curve is drawn based on the abnormal data frame, and whether the determination result for the single abnormal parameter is qualified is determined based on the absolute value of the slope of the parameter that is not within the preset threshold in the parameter time domain curve; If the quantity ratio is greater than the preset quantity ratio, the abnormal area of ​​the log of the industrial computer is identified, the port flow based on the time node corresponding to the abnormal area is determined, and whether there is an abnormality in the operation of the industrial computer is determined based on the port flow.

4. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 3 is characterized in that: Compare each data frame in a single detection cycle with each predicted data frame to determine the comparison similarity, calculate the byte ratio of the number of identical bytes to the total number of bytes of each data frame in a single detection cycle, and obtain the comparison similarity; Determine whether the detection parameters for the data frame are qualified based on the comparison similarity, including: If the comparison similarity is greater than the preset comparison similarity, the detection parameters for the data frame are determined to be qualified, and the corresponding preset threshold is continuously used to detect the single-type data frame in the next detection cycle; If the comparison similarity is less than or equal to the preset comparison similarity, it is determined that the detection parameter for the data frame is unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the comparison similarity.

5. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 4 is characterized in that: Based on the comparison similarity, the corresponding preset threshold is adjusted to the corresponding value, where: The reduction range of the corresponding preset threshold determined based on the comparison similarity is negatively correlated with the comparison similarity.

6. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 5 is characterized in that: Marking a parameter in a single abnormal data frame that is not within a preset threshold as an abnormal parameter, drawing a parameter time domain curve based on the abnormal data frame, and determining whether a determination result for the single abnormal parameter is qualified based on an absolute value of a slope of the parameter time domain curve under the abnormal parameter, including: If the absolute value of the slope is less than or equal to the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be unqualified, and the corresponding preset threshold is adjusted to a corresponding value based on the amount of data in a single detection cycle; If the absolute value of the slope is greater than the preset absolute value of the slope, the determination result for the single abnormal parameter is determined to be qualified, and an alarm message for the abnormal data frame is issued.

7. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 6 is characterized in that: The corresponding preset threshold is adjusted to the corresponding value based on the amount of data in a single detection cycle, where: The increase range of the corresponding preset threshold determined based on the data volume in a single detection cycle is positively correlated with the data volume.

8. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 7 is characterized in that: Identify the abnormal area of ​​the log of the industrial computer, determine the port traffic at the time node corresponding to the abnormal area, and determine whether the operation of the industrial computer is abnormal based on the port traffic, including: If the port flow is less than or equal to the preset port flow, it is determined that the operation of the industrial computer is normal, and an alarm message for abnormal data frames is issued; If the port traffic is greater than the preset port traffic, the operation of the industrial computer is judged to be abnormal, and the terminal that interacts with the industrial computer within the abnormal time interval corresponding to the abnormal area is recorded as a risk terminal. The information interaction key with the risk terminal is updated, and the abnormal time interval is adjusted to the corresponding value based on the proportion of the number of bytes in the abnormal area to the total number of bytes in the log.

9. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 8, characterized in that: The abnormal time interval is adjusted to the corresponding value based on the abnormal proportion of the number of bytes in the abnormal area to the total number of bytes in the log, where: The increase in the abnormal time interval determined based on the abnormal proportion is positively correlated with the abnormal proportion.

10. The method for intelligent detection of industrial control anomalies based on deep learning according to claim 9, characterized in that: When the adjustment of the abnormal time interval is completed, the adjusted abnormal time interval is compared with the preset maximum interval. If the adjusted abnormal time interval is less than or equal to the preset maximum interval, it is determined to use the adjusted abnormal time interval as the determination parameter of the risk terminal; if the adjusted abnormal time interval is greater than the preset maximum interval, it is determined to use the preset maximum interval as the determination parameter of the risk terminal, and the key length of the updated interaction key is adjusted to the corresponding value.

Images