Industrial control weblog sequence anomaly detection method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an industrial control weblog sequence anomaly detection method and device. According to the method and the device, the obtained original logs are preprocessed, the preset structured information in each original log is extracted, the collected structured information is replaced by the preset wildcard characters, and the preset meaningless words in each original log are matched and deleted to form the structured log event sequence; further extracting log content corresponding to each data tag in each structured log event to form a log template; according to a set feature vector extraction rule, converting each log template into a feature vector; and finally, inputting the extracted feature vectors of the log templates into a neural network model for classification so as to detect whether the industrial control network is abnormal or not. Therefore, the original log information is processed more efficiently, and the accuracy of fault detection and classification is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of nuclear power, and in particular relates to a method and a device for detecting anomaly of an industrial control network log sequence. Background Art

[0002] Industrial control systems play a core role in modern manufacturing. Their network logs record the operation and event details of the system. As industrial control systems become increasingly complex, anomaly detection in network logs becomes particularly important. Traditional anomaly detection methods rely on rules and statistical models, and often have difficulty capturing deep abnormal patterns. As deep learning technology has made significant progress in the field of natural language processing, deep semantic extraction technology can more effectively understand and analyze complex data sequences. Using these technologies, potential anomalies in network logs can be deeply mined to improve the accuracy and efficiency of detection. Therefore, the industrial control network log sequence anomaly detection system based on deep semantic extraction can effectively enhance the security and stability of industrial control systems. Summary of the invention

[0003] In order to overcome the problems existing in the related art, a method and device for detecting anomaly in an industrial control network log sequence are provided.

[0004] According to one aspect of an embodiment of the present disclosure, a method for detecting anomalies in an industrial control network log sequence is provided, the method comprising:

[0005] Step 1: pre-process the acquired original logs, extract variable information in each original log, replace the collected variable information with a preset wildcard, and match and delete preset meaningless words in each original log to form a structured log event sequence;

[0006] Step 2: extracting semantic information corresponding to each data tag in each structured log event according to a plurality of preset data tags to form a log template;

[0007] Step 3: Convert the log template and variable information corresponding to each original log into a feature vector according to the set feature vector extraction rule;

[0008] Step 4: Input the extracted feature vectors of each log template into the neural network model for classification to obtain the label of the log event. The label of the log event is used to describe whether an abnormality occurs in the industrial control network and the type of abnormality.

[0009] In a possible implementation, the method further includes: step 5, constructing a log template tree based on the formed multiple log templates, including:

[0010] Step 51, for each log template, extract the query feature of the log template, the query feature corresponding to the second layer node is the length of the log template; the query feature corresponding to the third layer node is the prefix string of the log template, the prefix string is composed of the first letters of each digital label in the log template arranged in the order of the text; the query feature corresponding to the fourth layer node is the full text of the log template;

[0011] Step 52, insert the obtained log template into the log template tree. If the log template tree is an empty tree, create a new node in each layer and associate it with the query feature corresponding to the log template to form an initial tree structure; if there are already nodes in the log template tree, compare the query features associated with the nodes in each layer of the log template tree with the query features corresponding to the log template to see if they are the same. If the nodes in the previous layer of the log template tree are different from the query features corresponding to the log template, insert the query features of the log template into the current layer as a new node, and insert the query features corresponding to the log template into one or more sub-nodes under the new node; if there are nodes in the previous layer of the log template tree that are the same as the query features corresponding to the log template, compare the nodes in the next layer with the query features corresponding to the log template.

[0012] In one possible implementation, step 5 also includes: step 53, merging two nodes at the same level whose similarity exceeds a set threshold into a new node for the log template tree, and the value associated with the new node includes the values ​​associated with the two merged nodes. If the two merged nodes include leaf nodes, the leaf nodes of the new node include the leaf nodes of the two merged nodes.

[0013] For example, for the third layer of the log template tree, each third layer node is compared with the prefix strings corresponding to other third layer nodes for similarity. When a third layer node whose similarity exceeds a set threshold is detected, the two third layer nodes are merged into a new third layer node. The value associated with the new third layer node includes the prefix strings of the two similar third layer nodes, and the leaf nodes of the two similar third layer nodes are used as the leaf nodes of the new third layer node.

[0014] In a possible implementation, the feature vector extraction rule in step 3 includes: extracting N keywords for each log template, the N keywords include a subject, a predicate, an object and a preset value, extracting a variable value for each log template, and forming a feature vector of the log template according to the keywords and variable values ​​of each log template; the difference between the length of each keyword in the log template and the median of the number of words in the log template is within a preset threshold.

[0015] In a possible implementation, step 1 includes: step 11 to step 14;

[0016] Step 11, presetting regular expressions corresponding to commonly used variables in industrial control networks, and storing data labels corresponding to the regular expressions of various variables;

[0017] Step 12: Scan and detect the original log using the regular expressions corresponding to the variables. When a variable matching the regular expression is detected, replace the variable and the special symbols carrying semantics in the original log with a preset wildcard, and increase the weight of the data label corresponding to the variable in the variable library by one.

[0018] Step 13, matching and deleting meaningless function words and symbols that have no impact on semantics in the original log;

[0019] Step 14, checking whether multiple spaces or multiple wildcards appear continuously in the processed log string. If there are continuous spaces or wildcards in the processed log string, only one space or wildcard is retained.

[0020] In one possible implementation, in step 3, word2vec is used to obtain the feature vector of each log template keyword, the feature vector of each keyword is embedded into a low-dimensional vector, and the feature vectors of each keyword are connected according to the order in which the keywords appear in the corresponding original log to ensure the unique identification of each log template feature vector.

[0021] In a possible implementation, the neural network model includes: a Bi-LSTM module and a CRF module;

[0022] The Bi-LSTM module is used to extract features and semantics from the input log template feature vectors, and then send them to the anomaly detection module for training and testing. The anomaly detection task of the log is mapped into the scores generated by the supervised binary classification of the extracted semantic log template sequence data;

[0023] The CRF module is a probability graph module that uses the scores generated by the Bi-LSTM module as the input of the CRF module, outputs the scores of multiple groups of labels, and determines the label of the log event based on the set of labels with the highest score of the log event.

[0024] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies in an industrial control network log sequence is provided, the device comprising:

[0025] The preprocessing module is used to preprocess the acquired original logs, extract the variable information in each original log, replace the collected variable information with a preset wildcard, and match and delete the preset meaningless words in each original log to form a structured log event sequence;

[0026] The first conversion module is used to extract semantic information corresponding to each data tag in each structured log event according to a plurality of preset data tags to form a log template;

[0027] The second conversion module is used to convert the log template and variable information corresponding to each original log into a feature vector according to the set feature vector extraction rule;

[0028] The classification module is used to input the extracted feature vectors of each log template into the neural network model for classification to obtain the label of the log event. The label of the log event is used to describe whether an abnormality occurs in the industrial control network and the type of abnormality.

[0029] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies in an industrial control network log sequence is provided, the device comprising:

[0030] processor;

[0031] a memory for storing processor-executable instructions;

[0032] Wherein, the processor is configured to execute the above method.

[0033] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0034] The beneficial effects of the present disclosure are as follows: the present disclosure pre-processes the acquired original logs, extracts the variable information in each original log, replaces the collected variable information with a preset wildcard, and matches and deletes the preset meaningless words in each original log to form a structured log event sequence; further extracts the log semantic content corresponding to each data tag in each structured log event to form a log template; according to the set feature vector extraction rule, the log template and variable information corresponding to each original log are converted into a feature vector; finally, the feature vectors of each log template obtained by extraction are input into a neural network model for classification, thereby detecting whether an abnormality occurs in the industrial control network. The present disclosure can effectively reduce the damage and accidental deletion of valid semantic information in the original log text by extracting and processing the semantic information and variable information of the original log respectively, thereby more efficiently processing the original log information and improving the accuracy of fault detection and classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The present invention is a flowchart of a method for detecting anomalies in an industrial control network log sequence according to an exemplary embodiment.

[0036] Figure 2 The figure is a flow chart showing a log template tree according to an exemplary embodiment.

[0037] Figure 3 The present invention is a block diagram of a device for detecting anomalies in an industrial control network log sequence according to an exemplary embodiment. DETAILED DESCRIPTION

[0038] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0039] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0040] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0041] Figure 1 The present invention is a flowchart of a method for detecting abnormality in an industrial control network log sequence according to an exemplary embodiment. The method can be applied to a terminal device, which can be, for example, a server, a workstation, a desktop computer or a laptop computer. The present disclosure does not limit the type of the terminal device. Figure 1 , the method comprising:

[0042] Step 1: pre-process the acquired original logs, extract the variable information in each original log, replace the collected variable information with a preset wildcard, and match and delete the preset meaningless words in each original log to form a structured log event sequence.

[0043] Log preprocessing is the basis for subsequent semantic feature extraction. Therefore, it is necessary to use log parsing algorithms to convert unstructured log files into structured log event sequences, from which log templates that can describe log information are extracted. Unprocessed raw logs often contain rich semantic information. For example, raw logs include IP information used to describe the source of the log or the interactive address of the log source program, and node name information used to identify industrial control network devices.

[0044] As an example of this embodiment, step 1 includes: step 11 to step 14.

[0045] Step 11, preset regular expressions corresponding to variables commonly used in industrial control networks, where the variables may be, for example, IP information, device information, etc., and establish a variable library to store data labels corresponding to the regular expressions of various variables.

[0046] Step 12, scan and detect the original log through the regular expression corresponding to each variable. When a variable matching the regular expression is detected, the variable and the special symbols carrying semantics are replaced with the preset wildcard "*" in the original log, and the weight of the data label corresponding to the variable in the variable library is increased by one.

[0047] Step 13, matching and deleting meaningless function words and symbols that have no impact on semantics in the original log.

[0048] Step 14: Check whether multiple spaces or multiple wildcards appear consecutively in the processed log string. If there are consecutive spaces or wildcards in the processed log string, only one space or wildcard is retained.

[0049] For example, the original log contains structured information, and the structured information can be extracted through regular matching. For example, for structured information such as time and IP address that are easy to match and extract and helpful for semantic feature extraction, regular matching is used to extract them. Then, the corresponding position mark "*" of the extracted information in the original log is filled as a wildcard, and the extracted information is counted into the variable library, which records multiple regular expressions pre-defined by the system and the corresponding data labels of the structured information. Each time a structured information is detected and extracted, the weight of the data label of the structured information in the variable library is increased by one. For example, when a log containing an IP address is detected, the weight of the data label of the IP information in the corresponding variable library will be increased by one. The variable library can be used to assist in selecting variable information with high weights during subsequent log semantic feature extraction.

[0050] In addition, the original logs often contain symbols without special meanings, such as "#", "$", and function words such as "a", "the", etc. These function words or symbols are meaningless for semantic extraction. Therefore, the meaningless function words or symbols in the original logs are deleted from the unstructured original logs, thereby simplifying the log structure without affecting the log semantics.

[0051] Step 2: extract the preset information of each structured log event to form a log template.

[0052] In a possible implementation, the method further includes step 5, constructing a log template tree, including the following steps:

[0053] Step 51 : for each log template, extract the query feature of the log template. For example, the query feature of the log template includes a prefix string formed by the first characters of each data tag in the log template and the length of the log template.

[0054] Step 52, insert the obtained log template into the log template tree. If the log template tree is an empty tree, a new node is created in each layer to associate the query feature corresponding to the log template to form an initial tree structure. For example, when the log template tree is an empty tree, the length of the log template is inserted into the root node of the log template tree to form a second-layer node, a prefix string is inserted into the second-layer node to form a third-layer node, and a complete log template is inserted into the third-layer node to form a fourth-layer node. If there are already nodes in the log template tree, compare whether the query features corresponding to the log template are the same at each layer of the nodes in the log template tree. If the nodes in the previous layer of the log template tree are different from the query features corresponding to the log template, insert the query features of the log template into the current layer as a new node, and insert the query features corresponding to the log template into one or more sub-nodes under the new node. If there are nodes in the previous layer of the log template tree that are the same as the query features corresponding to the log template, compare the nodes in the next layer with the query features corresponding to the log template. For example, if the length of the log template to be inserted is the same as a second-layer node, compare the prefix string of the log template with the third-layer node of the log template tree.

[0055] Building log templates based on structured log sequences requires querying, matching, and replacing a large number of log texts. When the log sequence size is small, it has little impact on the system, but when faced with multiple logs in a complex industrial control network, it is necessary to optimize the search process and reduce the time for searching and comparing existing templates, so that log anomalies can be discovered more promptly in the industrial control network.

[0056] The present disclosure adopts a tree structure to store log templates, which can effectively reduce the complexity of searching. Figure 2 is a flow chart showing a log template tree according to an exemplary embodiment. Figure 2As shown in the figure, in the initial state, the log template tree is an empty tree with only one empty node as the root node. In the subsequent process of extracting log templates based on structured log sequences, nodes are continuously inserted into the log template tree, nodes are added, and the tree level and number of nodes are expanded. Subsequent parsing to obtain similar templates may further optimize the tree by deleting nodes. In the process of constructing the log template tree, the maximum depth of the log template tree can be set to 4. The first layer of the log template tree is the root node, the second layer is the length of the log template, that is, the number of words contained in the log template, and the third layer extracts the first characters of each data label in the log template, and connects these characters to form a prefix string. The fourth layer is the complete log template.

[0057] After extracting log templates and building log template trees for log sequences, when the number of logs increases to a certain extent, even if the search step is optimized through the template tree, if the tree is large enough, it is still inevitable that many comparisons will be performed in each search, wasting a lot of time and computing costs. In addition, when the number of logs is large, a large number of similar log templates will appear, which will also have a certain impact on the accuracy of anomaly detection. Therefore, it is necessary to quantify the semantic similarity between different templates, and then streamline the log template tree by merging similar templates to reduce the number of comparisons during search.

[0058] In one possible implementation, step 5 also includes: step 53, merging two nodes at the same level whose similarity exceeds a set threshold into a new node for the log template tree, and the value associated with the new node includes the values ​​associated with the two merged nodes. If the two merged nodes include leaf nodes, the leaf nodes of the new node include the leaf nodes of the two merged nodes.

[0059] From the construction process of the log template tree, we can see that when searching and comparing a log template, there will be two string matches. The first match is to match the prefix string of the third-level log template, and the second match is to match the full text of the fourth-level log template. Similarity calculation based on the prefix string and similarity calculation based on the full text of the log template can be used.

[0060] The prefix string is composed of the first letters of each data label in the log template. A prefix string such as "Rb*s*d*" contains uppercase and lowercase letters and the wildcard *. Because it is short and has a certain semantic representation ability, similar log templates can be found with a small amount of calculation by calculating the similarity of the prefix string. The similarity calculation between the prefix string and the full text of the log template can be calculated using calculation models such as Euclidean distance, cosine similarity, Hamming distance, and JW distance.

[0061] After the above algorithms and steps, the system will calculate the similarity of all templates of leaf nodes at each layer in the log template tree to be processed. In this way, the number of log template queries can be reduced, and the time complexity of the query can be reduced, thereby making the extraction of log templates more efficient.

[0062] In a possible implementation, the feature vector extraction rules in step 3 include: extracting N keywords for each log template, the N keywords include a subject, a predicate, an object and a preset value, extracting variable values ​​for each log template, and forming a feature vector of the log template according to the keywords and variable values ​​of each log template, thereby effectively extracting the semantics of the log template.

[0063] Since the overall semantic information of the log is mostly abstracted at the beginning, and function words such as "a" and "the" have been removed during template extraction, four keywords can be directly selected from the beginning of the log template as candidate semantic templates. After the word selection stage is completed, the industrial control management personnel can fine-tune the keywords to ensure that there is no semantic loss in this process. This method can ensure that the extracted keywords are accurate enough, while avoiding the need for manual work.

[0064] In order to balance the size of the semantic vector and the computational time cost, and to ensure that the sizes of different template vectors are the same, the system chooses to set the keyword length of the log event to a fixed value, and requires this length to be close to the median number of words in a template, which helps to reduce the computational time cost. If the length of the filtered log template is less than this value, the empty position will be filled with a constant value.

[0065] After the above steps, the unstructured log will be converted into a combination of a keyword sequence and a variable value. In order to perform subsequent anomaly detection tasks, each log template is converted into a feature vector. The industrial control network administrator can set different features to be retained according to different industrial control network log types. For example, you can choose to retain the source IP (srcIP), destination IP (dstIP) and response ID (resID) as semantic features in the feature vector that will be selected if they appear in each log message, while also retaining the keywords extracted from the log template and other required semantic variables.

[0066] For example, in step 3, word2vec can be used to obtain the feature vector of each log template keyword, embed the feature vector of each keyword into a low-dimensional vector, and connect the feature vectors of each keyword in the order in which they appear in the corresponding original log to ensure the unique identification of each log template feature vector.

[0067] Introducing sequences not only helps preserve semantics, but also makes it easier to uniquely represent different log templates than using high-dimensional word vectors. The system encodes words into relatively low-dimensional vectors to keep the computational time cost low.

[0068] The extracted feature vectors of each log template are input into the neural network model for classification to obtain the labels of the log events.

[0069] Neural network models may include: Bi-LSTM model, CRF model.

[0070] Among them, after the Bi-LSTM model performs template extraction and semantic extraction on the industrial control network log, it is necessary to send the extracted ordered log semantic template sequence into the anomaly detection model for training and testing. Among them, the anomaly detection task of the log is mapped into the supervised binary classification of the extracted semantic log template sequence data. In the analysis of sequential data, the recurrent neural network (RNN) performs better than many deep learning methods due to the addition of learning of time series features. Among the variants of RNN, the long short-term memory (LSTM) solves the problems of gradient vanishing and gradient explosion in traditional RNN, and better captures and utilizes long-term dependencies, which can make full use of long-distance time series information. At the same time, compared with the early RNN model, the LSTM unit is improved by introducing three gates, which can discard the useless information converted from the previous unit, and then retain the useful information and pass it to the next unit. Generally, each time series action can be input into a unit for processing, and the sequence data knowledge can also be converted through this measure. Converting only useful information between units can reduce the learning burden of the model. Therefore, the system uses Bi-LSTM as the main model for log sequence anomaly detection.

[0071] In order to overcome the shortcomings of the RNN network, the LSTM network adds multiple gating mechanisms to its original network, mainly including: the forget gate, which controls the information in the memory state before forgetting, determines which information should be forgotten through the sigmoid function, combines the previous memory state with the current input information, and mainly controls the cell state to discard information; the input gate, which controls the update of the input information, determines which information needs to be updated through the sigmoid function, combines the new input information with the previous memory state, and mainly controls the cell state to add information; the output gate, which controls the output memory information, determines which information in the memory state should be output through the sigmoid function, and compresses the memory state through a tanh function to produce the final output, and mainly controls the cell state to output information. These gating mechanisms enable LSTM to effectively control the flow of information, selectively update, forget and output information. By adaptively learning the gating parameters, LSTM can learn complex time series patterns in the data and achieve good performance in various sequence tasks.

[0072] Although the use of unidirectional LSTM can achieve relatively high accuracy in dealing with some sequence analysis tasks, based on the design structure of LSTM, the use of unidirectional LSTM will ignore the impact of subsequent log events on previous log information when performing log anomaly analysis. Therefore, the system chooses to use bidirectional LSTM to extract more effective time series features from semantic template log sequences. Bi-LSTM network can obtain more effective information through network learning through more parameter input.

[0073] The CRF model is a probabilistic graphical model used to model and solve sequence labeling problems. CRF performs sequence labeling by establishing a conditional probability distribution between the input sequence and the output sequence. It is mainly used to label sequence data, such as named entity recognition, part-of-speech tagging, syntactic analysis and other tasks in natural language processing. It takes into account the correlation and dependency between each label in the sequence data, and learns how to best label the input sequence during the training process. CRF models the conditional probability distribution between the input sequence and the output sequence by defining feature functions and parameters. The feature function describes the correlation between the input sequence and the output sequence, and the parameters represent the weight of the feature function. By maximizing the log-likelihood function of the training data, the optimal parameter value can be learned. This system selects the linear chain conditional random field and the Bi-LSTM model for splicing.

[0074] By introducing the CRF layer after the Bi-LSTM, the scores generated by the Bi-LSTM network are used as the input of the CRF. The CRF layer outputs the scores of multiple sets of labels and determines the label of the log event based on the set of labels with the highest scores. The specific processing flow is as follows: First, the bottom layer of the model is each input window, and the log sequence in the window is input into the Bi-LSTM network to obtain a set of scores as the output result. Next, each set of scores is input into the CRF layer, and the CRF layer generates the final score by learning the constraints. Finally, the set with the highest score is selected as the output result, that is, the label of the log event is determined.

[0075] The present invention preprocesses the acquired original logs, extracts the variable information in each original log, replaces the collected variable information with a preset wildcard, and matches and deletes the preset meaningless words in each original log to form a structured log event sequence; further extracts the log semantic content corresponding to each data tag in each structured log event to form a log template; according to the set feature vector extraction rule, the log template and variable information corresponding to each original log are converted into a feature vector; finally, the feature vectors of each log template obtained by extraction are input into a neural network model for classification, thereby detecting whether an abnormality occurs in the industrial control network. The present invention can effectively reduce the damage and accidental deletion of effective semantic information in the original log text by respectively extracting and processing the semantic information and variable information of the original log, thereby more efficiently processing the original log information and improving the accuracy of fault detection and classification.

[0076] In a possible implementation, a device for detecting anomalies in an industrial control network log sequence is provided, the device comprising:

[0077] The preprocessing module is used to preprocess the acquired original logs, extract the variable information in each original log, replace the collected variable information with a preset wildcard, and match and delete the preset meaningless words in each original log to form a structured log event sequence;

[0078] The first conversion module is used to extract semantic information corresponding to each data tag in each structured log event according to a plurality of preset data tags to form a log template;

[0079] The second conversion module is used to convert the log template and variable information corresponding to each original log into a feature vector according to the set feature vector extraction rule;

[0080] The classification module is used to input the extracted feature vectors of each log template into the neural network model for classification to obtain the label of the log event. The label of the log event is used to describe whether an abnormality occurs in the industrial control network and the type of abnormality.

[0081] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0082] Figure 3 1900 is a block diagram of an industrial control network log sequence anomaly detection device according to an exemplary embodiment. For example, the device 1900 can be provided as a server. Figure 3 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0083] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0084] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0085] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0086] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0087] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0088] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0089] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0090] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0091] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0092] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0093] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting anomaly in industrial control network log sequences, characterized in that: The method comprises: Step 1: pre-process the acquired original logs, extract variable information in each original log, replace the collected variable information with a preset wildcard, and match and delete preset meaningless words in each original log to form a structured log event sequence; Step 2: extracting semantic information corresponding to each data tag in each structured log event according to a plurality of preset data tags to form a log template; Step 3: Convert the log template and variable information corresponding to each original log into a feature vector according to the set feature vector extraction rule; Step 4: Input the extracted feature vectors of each log template into the neural network model for classification to obtain the label of the log event. The label of the log event is used to describe whether an abnormality occurs in the industrial control network and the type of abnormality.

2. The method according to claim 1, characterized in that The method further includes: step 5, constructing a log template tree based on the formed multiple log templates, including: Step 51, for each log template, extract the query feature of the log template, the query feature corresponding to the second layer node is the length of the log template; the query feature corresponding to the third layer node is the prefix string of the log template, the prefix string is composed of the first letters of each digital label in the log template arranged in the order of the text; the query feature corresponding to the fourth layer node is the full text of the log template; Step 52, insert the obtained log template into the log template tree. If the log template tree is an empty tree, create a new node in each layer and associate the query feature corresponding to the log template to form an initial tree structure; if there are nodes in the log template tree, compare the query features associated with the nodes in each layer of the log template tree with the query features corresponding to the log template. If the nodes in the previous layer of the log template tree are different from the query features corresponding to the log template, insert the query features of the log template into the current layer as a new node, and insert the query features corresponding to the log template into one or more sub-nodes under the new node; if there are nodes in the previous layer of the log template tree that are the same as the query features corresponding to the log template, compare the nodes in the next layer with the query features corresponding to the log template; Step 3 also includes: traversing the log template tree, and converting the traversed log template into a feature vector according to a set feature vector extraction rule.

3. The method according to claim 2, characterized in that Step 5 also includes: Step 53, merging two nodes at the same level whose similarity exceeds a set threshold into a new node in the log template tree, and the value associated with the new node includes the values ​​associated with the two merged nodes. If the two merged nodes include leaf nodes, the leaf nodes of the new node include the leaf nodes of the two merged nodes.

4. The method according to claim 1, characterized in that: The feature vector extraction rules in step 3 include: extracting N keywords for each log template, the N keywords include a subject, a predicate, an object and a preset value, extracting a variable value for each log template, and forming a feature vector of the log template according to the keywords and variable values ​​of each log template; the difference between the length of each keyword in the log template and the median of the number of words in the log template is within a preset threshold.

5. The method according to claim 1, characterized in that Step 1 includes: step 11 to step 14; Step 11, presetting regular expressions corresponding to commonly used variables in industrial control networks, and storing data labels corresponding to the regular expressions of various variables; Step 12: Scan and detect the original log using the regular expressions corresponding to the variables. When a variable matching the regular expression is detected, replace the variable and the special symbols carrying semantics in the original log with a preset wildcard, and increase the weight of the data label corresponding to the variable in the variable library by one. Step 13, matching and deleting meaningless function words and symbols that have no impact on semantics in the original log; Step 14, checking whether multiple spaces or multiple wildcards appear continuously in the processed log string. If there are continuous spaces or wildcards in the processed log string, only one space or wildcard is retained.

6. The method according to claim 1, characterized in that In step 3, word2vec is used to obtain the feature vector of each log template keyword, and the feature vector of each keyword is embedded into a low-dimensional vector. The feature vectors of each keyword are connected according to the order in which the keywords appear in the corresponding original log to ensure the unique identification of each log template feature vector.

7. The method according to claim 1, characterized in that The neural network model includes: Bi-LSTM module and CRF module; The Bi-LSTM module is used to extract features and semantics from the input log template feature vectors, and then send them to the anomaly detection module for training and testing. The anomaly detection task of the log is mapped into the scores generated by the supervised binary classification of the extracted semantic log template sequence data; The CRF module is a probability graph module that uses the scores generated by the Bi-LSTM module as the input of the CRF module, outputs the scores of multiple groups of labels, and determines the label of the log event based on the group of labels with the highest score of the log event.

8. An industrial control network log sequence anomaly detection device, characterized in that: The device comprises: The preprocessing module is used to preprocess the acquired original logs, extract the variable information in each original log, replace the collected variable information with a preset wildcard, and match and delete the preset meaningless words in each original log to form a structured log event sequence; The first conversion module is used to extract semantic information corresponding to each data tag in each structured log event according to a plurality of preset data tags to form a log template; The second conversion module is used to convert the log template and variable information corresponding to each original log into a feature vector according to the set feature vector extraction rule; The classification module is used to input the extracted feature vectors of each log template into the neural network model for classification to obtain the label of the log event. The label of the log event is used to describe whether an abnormality occurs in the industrial control network and the type of abnormality.

9. An industrial control network log sequence anomaly detection device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images