Industrial network security intelligent detection system

Abstract

The invention belongs to the technical field of network security detection, and discloses an industrial network security intelligent detection system, which comprises the following steps of: summarizing log data in an industrial control network, and auditing user behaviors and security events; establishing an intrusion blacklist model, detecting an access behavior in real time, and identifying an attack behavior based on a white list rule; and recording detailed information of the attack behavior, and giving an alarm according to a severity rule. By comprehensively analyzing the log data in the industrial network, deep analysis of the network content is realized, and the compliance of the operation content and the access behavior can be effectively evaluated; meanwhile, the user behavior characteristics are extracted from the operation log, a set of behavior baselines is constructed, the user behaviors can be monitored in real time, abnormal behaviors can be found and marked in time, the identification capability of potential security threats is remarkably improved, and a powerful guarantee is provided for maintaining stable operation of an industrial network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to an industrial network security intelligent detection system. Background Art

[0002] With the digital transformation of industrial control systems (ICS) and critical infrastructure, network security issues have become increasingly prominent. In enterprises such as aviation fuel companies that have extremely high security requirements, industrial control networks, as key technologies supporting modern industrial production, are directly related to the stability and continuity of industrial production. However, aviation fuel companies face a complex industrial control network environment, and network security threats emerge in an endless stream, including malware attacks, unauthorized access, internal threats, zero-day vulnerability exploits, etc. These threats may lead to production interruptions, data leaks, and equipment damage, which have a serious impact on the economic benefits and social image of the company.

[0003] In this context, aviation fuel companies are in urgent need of addressing the deficiencies of existing industrial control network security technologies while pursuing production efficiency and meeting regulatory requirements. Existing technical means often have difficulty in achieving in-depth analysis of logs and network content, and determining whether the operation content and access behavior are normal, resulting in limited ability to identify abnormal behavior; in addition, insufficient real-time monitoring and response capabilities, as well as inefficient security incident handling, are also major problems faced by existing technologies. These deficiencies have led aviation fuel companies to urgently need more advanced and more effective technical means to improve their security risk management capabilities in the face of increasingly complex network security challenges.

[0004] Therefore, how to provide an intelligent detection system for industrial network security is an urgent problem to be solved. Summary of the invention

[0005] The embodiment of the present invention provides an industrial network security intelligent detection system to solve the problems in the prior art.

[0006] In order to have a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended to be a general review, nor is it intended to identify key / important components or to delineate the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a preface to the detailed description that follows.

[0007] An industrial network security intelligent detection system, the industrial network security intelligent detection system comprising:

[0008] Log processing and behavior audit unit, used to aggregate log data within the industrial control network and audit user behavior and security events;

[0009] Model building and security monitoring unit, used to build intrusion blacklist models, detect access behaviors in real time, and identify attack behaviors based on whitelist rules;

[0010] The attack record and alarm response unit is used to record the detailed information of the attack behavior and issue an alarm according to the severity rules.

[0011] Preferably, the log processing and behavior auditing unit includes:

[0012] The log collection module is used to collect the operation logs of various security devices, servers, PLCs and host computers in the industrial control network;

[0013] Log analysis module, used to summarize and store collected operation logs;

[0014] The behavior audit module is used to audit user behavior and important security events and mark abnormal operation sequences.

[0015] Preferably, the auditing of user behaviors and important security events and marking of abnormal operation sequences includes:

[0016] Extract user behaviors based on operation logs, establish behavior baselines, and identify abnormal behaviors;

[0017] Based on the identified abnormal behaviors, important security events are marked and classified according to preset security rules;

[0018] Use data mining tools to analyze data on important security events and mark abnormal operation sequences based on the analysis results.

[0019] Preferably, extracting user behaviors based on operation logs, establishing a standard behavior baseline, and identifying abnormal behaviors include:

[0020] Extract the operation behavior characteristics of each user based on historical operation logs, including the user's behavior pattern, operation time pattern, common commands and operation frequency;

[0021] Based on the extracted operational behavior characteristics, a standard behavioral baseline for normal operations is established;

[0022] Based on the standard behavior baseline, the user operation logs collected in real time are compared and analyzed, and operations that deviate from the standard behavior baseline by more than a preset threshold are marked as abnormal behaviors.

[0023] Preferably, the model building and safety monitoring unit includes:

[0024] Security model building module, used to build and train intrusion blacklist models and conduct online real-time analysis;

[0025] Whitelist management module, which is used to collect threat intelligence in real time, update the intrusion blacklist model, and maintain whitelist rules;

[0026] The anomaly monitoring module is used to monitor and report abnormal behaviors based on whitelist rules.

[0027] Preferably, the establishing and training of the intrusion blacklist model and performing online real-time analysis includes:

[0028] Based on historical access logs, extract key features, including source IP, destination IP, access time, access frequency, and request type;

[0029] A training set is constructed based on the extracted features, and normal traffic data in the training set is marked as positive examples, and abnormal traffic data is marked as negative examples;

[0030] An intrusion blacklist model is trained based on the labeled training set, and the trained intrusion blacklist model is used to detect access behavior in real time.

[0031] Preferably, the real-time collection of threat intelligence to update the intrusion blacklist model and maintain the whitelist rules includes:

[0032] Search cybersecurity databases to obtain malware samples, network attack patterns, vulnerability information, and botnet activity information;

[0033] Based on the information obtained, extract threat intelligence features, including the attacker's IP address, the type of malware used, the target of the attack, and the attack method;

[0034] Integrate the extracted threat intelligence features into the intrusion blacklist model and use the incremental learning algorithm to update the model;

[0035] Adjust whitelist rules, including adding new trusted IP addresses, removing known compromised IP addresses, and updating access permissions.

[0036] Preferably, the attack record and alarm response unit includes:

[0037] Attack behavior recording module, used to record detailed information of attack behavior, including attack source IP address, attack type, attack target and attack time;

[0038] A severity assessment module, used to assess the severity of the recorded attack behavior according to preset assessment criteria, wherein the preset assessment criteria include the scope of attack impact and the probability of attack success;

[0039] The alarm generation response module is used to generate corresponding alarm information and take response measures based on the results of severity assessment.

[0040] Preferably, the severity assessment of the recorded attack behavior according to the preset assessment criteria includes:

[0041] Determine the types and number of systems affected by the attack, and make an initial score based on the impact scope scoring rules;

[0042] Determine the attacker's technical capabilities and the sophistication of their attack tools, and perform a secondary score based on the success probability scoring rules;

[0043] A comprehensive evaluation score is calculated based on the initial and secondary scores, and the severity level of the attack behavior is determined according to the severity level classification rules.

[0044] Preferably, generating corresponding alarm information based on the result of severity assessment and taking response measures include:

[0045] Determine the alarm level based on the results of the severity assessment;

[0046] Generate corresponding alarm information based on the alarm level, including description of attack behavior, affected systems and recommended countermeasures;

[0047] Execute corresponding response measures according to the alarm level, and send alarm information based on predefined distribution rules.

[0048] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0049] 1. The present invention realizes in-depth analysis of network content by comprehensively analyzing log data in the industrial network, and can effectively evaluate the compliance of operation content and access behavior; at the same time, the present invention can comprehensively collect operation logs from security devices, servers, PLCs and host computers, and integrate and store these data through advanced log analysis modules; in addition, the present invention extracts user behavior features from the operation logs to construct a set of behavior baselines, and uses this as a benchmark to monitor user behavior in real time, discover and mark abnormal behaviors in a timely manner, significantly improve the ability to identify potential security threats, and provide a strong guarantee for maintaining the stable operation of industrial networks.

[0050] 2. The present invention establishes an intrusion blacklist model through model building and security monitoring units, and performs real-time detection of access behaviors and identification of attack behaviors based on whitelist rules, which helps to improve the security of industrial networks and prevent malicious attacks and unauthorized access. At the same time, the present invention can also collect threat intelligence in real time, update the intrusion blacklist model, and maintain whitelist rules to ensure the real-time and accuracy of the industrial network.

[0051] 3. The present invention can record detailed information of attack behaviors and issue alarms according to severity rules, which helps to respond to and cope with security incidents in a timely manner and reduce potential damage. The attack behavior recording module records detailed information of attack behaviors and performs severity assessment according to preset assessment standards. Based on the results of severity assessment, corresponding alarm information is generated and response measures are taken. This process helps to improve the response speed and efficiency of industrial networks and ensure the security and stability of industrial networks.

[0052] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0054] Figure 1 is a principle block diagram of an industrial network security intelligent detection system according to an exemplary embodiment;

[0055] Figure 2 The figure is a schematic diagram showing the structure of a computer device according to an exemplary embodiment. DETAILED DESCRIPTION

[0056] The following description and accompanying drawings fully illustrate the specific embodiments of this article so that those skilled in the art can practice them. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The scope of the embodiments of this article includes the entire scope of the claims, as well as all available equivalents of the claims. Herein, the terms "first", "second", etc. are only used to distinguish one element from another, without requiring or implying any actual relationship or order between these elements. In fact, the first element can also be called the second element, and vice versa. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the structure, device or equipment including a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also include elements inherent to such structure, device or equipment. In the absence of more restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the structure, device or equipment including the elements. Each embodiment is described in a progressive manner herein, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the embodiments can be referred to each other.

[0057] The terms "longitudinal", "lateral", "upper", "lower", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc. in this document indicate the orientation or position relationship based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing this document and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In the description of this document, unless otherwise specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a mechanical connection or an electrical connection, it can also be the internal communication of two elements, it can be a direct connection, or it can be an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0058] As used herein, the term "plurality" means two or more than two, unless otherwise specified.

[0059] In this document, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0060] In this article, the term "and / or" is a description of the association relationship between objects, indicating that three relationships may exist. For example, A and / or B means: A or B, or, A and B.

[0061] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0062] Each module in the industrial network security intelligent detection system of the present application can be implemented in whole or in part by software, hardware, or a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0063] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0064] Figure 1An embodiment of the industrial network security intelligent detection system of the present invention is shown.

[0065] In this optional embodiment, the industrial network security intelligent detection system includes:

[0066] The log processing and behavior audit unit 101 is used to aggregate the log data in the industrial control network and audit user behaviors and security events;

[0067] Model building and security monitoring unit 103, used to build an intrusion blacklist model, detect access behavior in real time, and identify attack behavior based on whitelist rules;

[0068] The attack record and alarm response unit 105 is used to record the detailed information of the attack behavior and issue an alarm according to the severity rule.

[0069] In this optional embodiment, the log processing and behavior auditing unit 101 includes:

[0070] The log collection module is used to collect the operation logs of various security devices, servers, PLCs and host computers in the industrial control network;

[0071] Specifically, determine the specific models and quantities of security devices, servers, PLCs and host computers that need to be monitored in the industrial control network; deploy log collection agents on these devices, and the agents are responsible for regularly collecting operation logs from the devices; the collection agent sends the collected log data to the log analysis module of the log processing and behavior audit unit 101.

[0072] Log analysis module, used to summarize and store collected operation logs;

[0073] Specifically, the log analysis module receives the operation log data from the log collection module, and pre-processes the received log data, including formatting, deduplication, and timestamp calibration; and stores the pre-processed log data in the log database.

[0074] The behavior audit module is used to audit user behavior and important security events and mark abnormal operation sequences.

[0075] In this optional embodiment, the auditing of user behaviors and important security events and marking of abnormal operation sequences includes:

[0076] Extract user behaviors based on operation logs, establish behavior baselines, and identify abnormal behaviors;

[0077] Based on the identified abnormal behaviors, important security events are marked and classified according to preset security rules;

[0078] Use data mining tools to analyze data on important security events and mark abnormal operation sequences based on the analysis results.

[0079] In this optional embodiment, extracting user behavior based on the operation log, establishing a standard behavior baseline, and identifying abnormal behavior include:

[0080] Extract the operation behavior characteristics of each user based on historical operation logs, including the user's behavior pattern, operation time pattern, common commands and operation frequency;

[0081] Based on the extracted operational behavior characteristics, a standard behavioral baseline for normal operations is established;

[0082] Based on the standard behavior baseline, the user operation logs collected in real time are compared and analyzed, and operations that deviate from the standard behavior baseline by more than a preset threshold are marked as abnormal behaviors.

[0083] In this optional embodiment, the model building and safety monitoring unit 103 includes:

[0084] Security model building module, used to build and train intrusion blacklist models and conduct online real-time analysis;

[0085] Whitelist management module, which is used to collect threat intelligence in real time, update the intrusion blacklist model, and maintain whitelist rules;

[0086] Specifically, the latest threat intelligence is regularly retrieved from the network security database, including malware samples, network attack patterns, vulnerability information, and botnet activity information. Natural language processing (NLP) technology is used to extract key features of threat intelligence, including the attacker's IP address, the type of malware used, the attack target, and the attack method. The extracted threat intelligence features are integrated into the intrusion blacklist model, and the model is updated using an incremental learning algorithm to maintain the timeliness of the model. The whitelist rules are adjusted according to the updated model, including adding new trusted IP addresses and deleting known hacked IP addresses.

[0087] The anomaly monitoring module is used to monitor and report abnormal behaviors based on whitelist rules.

[0088] Specifically, network traffic is monitored in real time and online analysis is performed using an intrusion blacklist model. When abnormal traffic is detected, it is determined whether it is an attack based on the whitelist rules. If it is determined to be an attack, the attack details are recorded and an alarm is triggered.

[0089] In this optional embodiment, the establishment and training of the intrusion blacklist model and the online real-time analysis include:

[0090] Based on historical access logs, extract key features, including source IP, destination IP, access time, access frequency, and request type;

[0091] A training set is constructed based on the extracted features, and normal traffic data in the training set is marked as positive examples, and abnormal traffic data is marked as negative examples;

[0092] An intrusion blacklist model is trained based on the labeled training set, and the trained intrusion blacklist model is used to detect access behavior in real time.

[0093] Specifically, in this embodiment, the gradient boosting machine model (GBM) is selected as the basic model of the intrusion blacklist model because it has performed well in many data science competitions and practical applications. First, key features are extracted from historical access logs, including source IP, destination IP, access time, access frequency and request type, and model-based feature selection is used to reduce feature dimensions and improve model performance. Then, a training set is constructed, normal traffic data is marked as positive examples (labeled as 0), and abnormal traffic data is marked as negative examples (labeled as 1). The cross-validation method is used to divide the training set and the validation set to avoid overfitting. Then, the intrusion blacklist model is trained, the model parameters (learning rate) are adjusted, and the model performance is evaluated using the validation set. The model with the best performance is selected as the intrusion blacklist model.

[0094] In this optional embodiment, the real-time collection of threat intelligence to update the intrusion blacklist model and maintain the whitelist rules includes:

[0095] Search cybersecurity databases to obtain malware samples, network attack patterns, vulnerability information, and botnet activity information;

[0096] Based on the information obtained, extract threat intelligence features, including the attacker's IP address, the type of malware used, the target of the attack, and the attack method;

[0097] Integrate the extracted threat intelligence features into the intrusion blacklist model and use the incremental learning algorithm to update the model;

[0098] Adjust whitelist rules, including adding new trusted IP addresses, removing known compromised IP addresses, and updating access permissions.

[0099] In this optional embodiment, the attack record and alarm response unit 105 includes:

[0100] Attack behavior recording module, used to record detailed information of attack behavior, including attack source IP address, attack type, attack target and attack time;

[0101] A severity assessment module, used to assess the severity of the recorded attack behavior according to preset assessment criteria, wherein the preset assessment criteria include the scope of attack impact and the probability of attack success;

[0102] The alarm generation response module is used to generate corresponding alarm information and take response measures based on the results of severity assessment.

[0103] In this optional embodiment, the severity assessment of the recorded attack behavior according to the preset assessment criteria includes:

[0104] Determine the types and number of systems affected by the attack, and make an initial score based on the impact scope scoring rules;

[0105] Determine the attacker's technical capabilities and the sophistication of their attack tools, and perform a secondary score based on the success probability scoring rules;

[0106] A comprehensive evaluation score is calculated based on the initial and secondary scores, and the severity level of the attack behavior is determined according to the severity level classification rules.

[0107] Specifically, determine the types of systems affected by the attack, including control systems, monitoring systems, and data storage systems, and then evaluate the number of systems affected by the attack. According to the types and number of systems affected, score them using predefined impact range scoring rules. In this embodiment, the impact range scoring rule is that if the control system is affected, 3 points are awarded, if the monitoring system is affected, 2 points are awarded, and if the data storage system is affected, 1 point is awarded.

[0108] Specifically, the attacker's technical capabilities are analyzed, including whether the attacker is a professional hacker and whether the attacker has targeted attack tools. Then, the sophistication of the attack tools is evaluated, including whether it is the latest malware and whether it has the ability to bypass conventional protection measures. Then, according to the attacker's technical capabilities and the sophistication of the attack tools, a predefined success probability scoring rule is used to score. In this embodiment, the success probability scoring rule is: 3 points for professional hackers, 2 points for targeted attack tools, and 1 point for the latest malware.

[0109] Specifically, the impact scope assessment score and the attack success possibility assessment score are added to obtain a comprehensive assessment score. According to the comprehensive assessment score, the severity level of the attack behavior is determined using a predefined severity level classification rule. In this embodiment, the severity level classification rule is that a comprehensive assessment score between 0 and 5 points is low severity, 6 to 10 points is medium severity, and 11 points and above is high severity.

[0110] In this optional embodiment, generating corresponding alarm information based on the result of severity assessment and taking response measures include:

[0111] Determine the alarm level based on the results of the severity assessment;

[0112] Generate corresponding alarm information based on the alarm level, including description of attack behavior, affected systems and recommended countermeasures;

[0113] Execute corresponding response measures according to the alarm level, and send alarm information based on predefined distribution rules.

[0114] Specifically, the alarm level is determined according to the result of the severity assessment. In the above embodiment, low severity corresponds to early warning notification, medium severity corresponds to emergency alarm, and high severity corresponds to alarm for immediate action. According to the alarm level, the alarm information content is automatically generated, including a description of the attack behavior, the affected system, and recommended response measures. The alarm information is then formatted into versions suitable for different notification channels, including email, text messages, and system pop-ups.

[0115] Specifically, according to the predefined distribution rules, a suitable notification channel is selected. In the above embodiment, the distribution rules are: low severity is notified by email, medium severity is notified by SMS and email, and high severity is notified by all available channels; the alarm information is sent to designated recipients, including security operation center (SOC) staff, network administrators and senior management, and finally, it is ensured that the alarm information is received in a timely manner, and the receipt is recorded and confirmed.

[0116] Specifically, according to the alarm level and the predefined response process, the corresponding response measures are automatically executed or guided to be manually executed. In this embodiment, monitoring enhancement measures are initiated when the severity is low, the affected system is isolated when the severity is medium, and the emergency response plan is initiated when the severity is high; then the effects of the response measures are tracked and adjusted according to the actual situation. If the isolation measures fail to prevent the attack, it is necessary to further block the IP address of the attack source and disconnect the network connection; then the implementation of all response measures is recorded, including the time of execution of the measures, effect evaluation and follow-up action suggestions, so as to facilitate subsequent analysis and improvement.

[0117] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 2 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store static information and dynamic information data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in the above method embodiment are implemented.

[0118] Those skilled in the art will understand that Figure 2 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0119] In addition, the present invention also provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiment when executing the computer program.

[0120] In addition, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0122] The present invention is not limited to the structures which have been described above and shown in the drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. An industrial network security intelligent detection system, characterized in that: The industrial network security intelligent detection system includes: Log processing and behavior audit unit, used to aggregate log data within the industrial control network and audit user behavior and security events; Model building and security monitoring unit, used to build intrusion blacklist models, detect access behaviors in real time, and identify attack behaviors based on whitelist rules; The attack record and alarm response unit is used to record the detailed information of the attack behavior and issue an alarm according to the severity rules.

2. The industrial network security intelligent detection system according to claim 1 is characterized in that: The log processing and behavior auditing unit includes: The log collection module is used to collect the operation logs of various security devices, servers, PLCs and host computers in the industrial control network; Log analysis module, used to summarize and store collected operation logs; The behavior audit module is used to audit user behavior and important security events and mark abnormal operation sequences.

3. The industrial network security intelligent detection system according to claim 2 is characterized in that: The audit of user behavior and important security events and marking of abnormal operation sequences include: Extract user behaviors based on operation logs, establish behavior baselines, and identify abnormal behaviors; Based on the identified abnormal behaviors, important security events are marked and classified according to preset security rules; Use data mining tools to analyze data on important security events and mark abnormal operation sequences based on the analysis results.

4. The industrial network security intelligent detection system according to claim 3 is characterized in that: Extracting user behaviors based on operation logs, establishing standard behavior baselines, and identifying abnormal behaviors include: Extract the operation behavior characteristics of each user based on historical operation logs, including the user's behavior pattern, operation time pattern, common commands and operation frequency; Based on the extracted operational behavior characteristics, a standard behavioral baseline for normal operations is established; Based on the standard behavior baseline, the user operation logs collected in real time are compared and analyzed, and operations that deviate from the standard behavior baseline by more than a preset threshold are marked as abnormal behaviors.

5. The industrial network security intelligent detection system according to claim 1 is characterized in that: The model building and safety monitoring unit includes: Security model building module, used to build and train intrusion blacklist models and conduct online real-time analysis; Whitelist management module, which is used to collect threat intelligence in real time, update the intrusion blacklist model, and maintain whitelist rules; The anomaly monitoring module is used to monitor and report abnormal behaviors based on whitelist rules.

6. The industrial network security intelligent detection system according to claim 5 is characterized in that: The establishment and training of the intrusion blacklist model and the online real-time analysis include: Based on historical access logs, extract key features, including source IP, destination IP, access time, access frequency, and request type; A training set is constructed based on the extracted features, and normal traffic data in the training set is marked as positive examples, and abnormal traffic data is marked as negative examples; An intrusion blacklist model is trained based on the labeled training set, and the trained intrusion blacklist model is used to detect access behavior in real time.

7. The industrial network security intelligent detection system according to claim 6 is characterized in that: The real-time collection of threat intelligence to update the intrusion blacklist model and maintain the whitelist rules include: Search cybersecurity databases to obtain malware samples, network attack patterns, vulnerability information, and botnet activity information; Based on the information obtained, extract threat intelligence features, including the attacker's IP address, the type of malware used, the target of the attack, and the attack method; Integrate the extracted threat intelligence features into the intrusion blacklist model and use the incremental learning algorithm to update the model; Adjust whitelist rules, including adding new trusted IP addresses, removing known compromised IP addresses, and updating access permissions.

8. The industrial network security intelligent detection system according to claim 1 is characterized in that: The attack record and alarm response unit includes: Attack behavior recording module, used to record detailed information of attack behavior, including attack source IP address, attack type, attack target and attack time; A severity assessment module, used to assess the severity of the recorded attack behavior according to preset assessment criteria, wherein the preset assessment criteria include the scope of attack impact and the probability of attack success; The alarm generation response module is used to generate corresponding alarm information and take response measures based on the results of severity assessment.

9. The industrial network security intelligent detection system according to claim 8, characterized in that: The severity assessment of the recorded attack behavior according to the preset assessment criteria includes: Determine the types and number of systems affected by the attack, and make an initial score based on the impact scope scoring rules; Determine the attacker's technical capabilities and the sophistication of their attack tools, and perform a secondary score based on the success probability scoring rules; A comprehensive evaluation score is calculated based on the initial and secondary scores, and the severity level of the attack behavior is determined according to the severity level classification rules.

10. The industrial network security intelligent detection system according to claim 9, characterized in that: Based on the result of the severity assessment, the corresponding alarm information is generated and the response measures are taken, including: Determine the alarm level based on the results of the severity assessment; Generate corresponding alarm information based on the alarm level, including description of attack behavior, affected systems and recommended countermeasures; Execute corresponding response measures according to the alarm level, and send alarm information based on predefined distribution rules.

Images