Industrial control network adaptive abnormal behavior detection response method

Abstract

The invention discloses a self-adaptive abnormal behavior detection response method for an industrial control network, and particularly relates to the technical field of industrial control network security, and the method comprises the following steps: collecting state change information of the industrial control network to obtain a first information set, and generating a state change monitoring index based on the first information set; acquiring network attack information of the industrial control network to obtain an information set II, and generating a network attack threat index based on the information set II; judging and dynamically selecting different detection algorithms based on the state change monitoring index and the network attack threat index to realize real-time detection and response of abnormal behaviors; when the type of the detection algorithm is selected, the application set of the detection algorithm of the type is adaptively optimized and applied at the same time; according to the method, the detection resources can be reasonably allocated under different network states and security threat conditions, and the industrial control network is more flexible to deal with sudden security threats by dynamically adjusting the detection strategy, so that the security and the operation continuity of the industrial control network can be ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network security, and more specifically, to an industrial control network adaptive abnormal behavior detection and response method. Background Art

[0002] With the widespread application of industrial control networks (ICS), industrial control systems have become the core link of various industrial production. However, due to their openness, distribution and connection with external networks, industrial control networks are facing more and more security threats. Common abnormal behaviors include abnormal traffic surges, port scanning, unauthorized access, etc. These abnormal behaviors may cause the performance of industrial control networks to degrade, and even be used by attackers to tamper with data or destroy the system, posing a serious threat to the security and stability of industrial production.

[0003] Existing industrial control systems mostly use static anomaly detection methods, such as rule-based detection methods, statistical anomaly detection methods, and machine learning-based detection methods. However, a single detection method is difficult to meet the adaptive needs of industrial control networks under different states and threat conditions. For example, although the rule-based method is efficient, it is difficult to deal with unknown attacks; and although the machine learning-based method has high detection accuracy, it consumes a lot of computing resources and is difficult to respond in real time under resource constraints.

[0004] Therefore, there is an urgent need for an abnormal behavior detection and response method that can adaptively select and optimize the detection algorithm according to the actual operating status and security threat level of the industrial control network to improve the security and reliability of the industrial control network. The industrial control network adaptive abnormal behavior detection and response method proposed in the present invention dynamically selects the appropriate detection algorithm type based on the real-time monitored state change monitoring index and network attack threat index, and adaptively optimizes its application set to achieve real-time detection and response to abnormal behavior of the industrial control network. Summary of the invention

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] An industrial control network adaptive abnormal behavior detection and response method comprises the following steps:

[0007] Collecting state change information of the industrial control network to obtain information set 1, and generating a state change monitoring index based on the information set 1;

[0008] Collecting network attack information of the industrial control network to obtain information set 2, and generating a network attack threat index based on the information set 2;

[0009] Based on the state change monitoring index and network attack threat index, different detection algorithms are judged and dynamically selected to achieve real-time detection and response of abnormal behaviors;

[0010] When the type of detection algorithm is selected, an application set of the type of detection algorithm is adaptively optimized and applied.

[0011] In a preferred implementation, the state change monitoring index is calculated through the total flow, response time and equipment load of the industrial control network in information set 1, reflecting the state fluctuation degree of the industrial control network.

[0012] In a preferred embodiment, the network attack threat index is calculated based on abnormal traffic, port scanning behavior and unauthorized access times of the industrial control network in the second information set to quantify the attack threat level of the current network.

[0013] In a preferred embodiment, when making a judgment based on the state change monitoring index and the network attack threat index, fuzzy logic is used to judge the combination of the state change monitoring index and the network attack threat index to generate a corresponding detection algorithm selection signal.

[0014] There are three detection algorithm selection signals, corresponding to three types of detection algorithms, namely: rule-based detection algorithm, statistics-based detection algorithm, and machine learning-based detection algorithm.

[0015] In a preferred embodiment, the acquisition logic of the state change monitoring index is:

[0016] Assume the total flow of the industrial control network is F(t), the response time is R(t), the equipment load is L(t), and t is the time point;

[0017] Calculate the flow difference sequence ΔF(t): ΔF(t) = F(t) - F(t-1);

[0018] In order to reflect the flow fluctuation amplitude, the absolute value of the difference sequence in the time window W is accumulated and summed to obtain the cumulative deviation value of the difference sequence: i represents each time point from tW to t, t represents the current time point, Cum F is the cumulative deviation value;

[0019] The natural logarithm of the cumulative deviation is used to enhance the sensitivity to abnormal flow fluctuations, and the flow fluctuation coefficient is defined as: S F =ln(Cum F +1); S F is the flow fluctuation coefficient;

[0020] The response time is measured by the deviation rate method to measure the fluctuation. The response time deviation rate sequence ΔR(t) is obtained by calculating the change rate and standard deviation of the response time in the window:

[0021] The absolute value of the response time deviation rate is summed within the time window W to obtain the cumulative value of the response time fluctuation: Sum R is the cumulative value of response time fluctuation;

[0022] The response time fluctuation coefficient is defined as the ratio of the cumulative value of the response time fluctuation to the mean square error of the response time in the window W: S R is the response time fluctuation coefficient, σR is the mean square error of the response time in window W;

[0023] The fluctuation of equipment load is measured by relative proportion, that is, the ratio of load difference to maximum load, and the differential proportion sequence ΔL(t) is defined as: ∈ is a preset non-zero constant;

[0024] In the time window W, calculate the variance σL of the equipment load difference ratio 2 To obtain the load fluctuation degree: is the average value of the load difference ratio within the window W, and then defines the equipment load fluctuation coefficient S L is the variance of the equipment load differential ratio σL 2 The square root of

[0025] Calculate the equipment load fluctuation coefficient S L , flow fluctuation coefficient S F , and the geometric mean of the response time fluctuation coefficient S, and the state change monitoring index is obtained.

[0026] In a preferred embodiment, the logic for obtaining the network attack threat index is:

[0027] Assume that abnormal traffic is A(t), the number of port scanning behaviors is S(t), the number of unauthorized accesses is U(t), and t is the time point;

[0028] In the time window W, calculate the index and ExpSum of abnormal traffic A :

[0029]

[0030] The index and ExpSum of abnormal traffic A The ratio is processed with the average flow of window W to reflect the threat level of abnormal flow and obtain the abnormal flow fluctuation coefficient I A :

[0031] represents the average flow in window W;

[0032] In window W, take the logarithm of the number of port scan behaviors and accumulate them to get the cumulative port scan value LogSum S :

[0033] Calculate the port scanning behavior fluctuation coefficient I S : represents the average number of scanning behaviors of window W;

[0034] Calculate the cumulative unauthorized access value SqiareSum U :

[0035] Calculate the unauthorized access fluctuation coefficient I U : represents the average number of unauthorized accesses in window W;

[0036] Calculate the unauthorized access fluctuation coefficient I U , Abnormal flow fluctuation coefficient I A , and the port scanning behavior fluctuation coefficient I S The geometric mean of is used to obtain the network attack threat index.

[0037] In a preferred embodiment, fuzzy logic judgment refers to:

[0038] The state change monitoring index and the network attack threat index are obtained separately and used as input variables together. The type of detection algorithm used to detect abnormal behavior is used as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the fitness of the three types of detection algorithms under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to determine the type of detection algorithm used to detect abnormal behavior.

[0039] In a preferred embodiment, the type of the selected detection algorithm is the target algorithm, the target algorithm is preset with a basic set, and the optimized application set is obtained by the following steps:

[0040] Set an initial baseline threshold Nbase, and the optimized threshold is Y. The baseline threshold Nbase means that the rules selected from the basic set must meet a priority of at least Nbase. Nbase and Y are both percentages and meet the following requirements:

[0041] Y=Nbase+αk*w1*SZ+βk*w2*IZ; SZ is the state change monitoring index, IZ is the network attack threat index, w1 and w2 are the preset proportional coefficients, αk and βk are the preset adjustment coefficients corresponding to the type number k of the detection algorithm, and then the basic set is screened according to the optimized threshold Y to obtain the optimized application set.

[0042] Technical effects and advantages of the present invention:

[0043] The present invention dynamically selects the appropriate detection algorithm according to the real-time status and threat level of the industrial control network, so that the industrial control network can use a high-precision detection method in a high-risk environment, and select a detection method with lower resource consumption in a low-risk environment. This adaptive adjustment effectively improves the accuracy of detection and ensures that the industrial control network can quickly respond to various abnormal behaviors.

[0044] By adaptively selecting and optimizing the application set of detection algorithms, the present invention reasonably allocates detection resources under different network states and security threat conditions, and can start high-consumption detection algorithms only when necessary, and use lightweight algorithms when the network state is relatively stable, which significantly reduces computing resources and energy consumption, and improves the resource utilization efficiency of industrial control networks. The present invention can accurately monitor and respond to various abnormal behaviors (such as abnormal traffic, port scanning, unauthorized access, etc.) in industrial control networks, and effectively prevent potential network attacks and abnormal situations. By dynamically adjusting the detection strategy, the industrial control network is more flexible in responding to sudden security threats, which helps to ensure the security of the industrial control network and the continuity of operation.

[0045] The detection response method of the present invention can automatically adjust the detection algorithm according to the actual operating status of the network to adapt to different industrial control environment requirements. Whether it is a sudden surge in traffic or a long-term load change, it can intelligently adapt to different situations to ensure the detection effect, and is particularly suitable for the complex and changeable environmental requirements in industrial control industrial networks. Through the joint judgment of the state change monitoring index and the network attack threat index, the present invention can reduce unnecessary false alarms, thereby improving the accuracy of detection. Different types of detection algorithms are enabled in appropriate situations, avoiding the false alarm phenomenon that a single algorithm is prone to in a complex environment, making the detection effect more reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0047] Figure 1 The schematic diagram is a schematic diagram of an industrial control network adaptive abnormal behavior detection and response method in the present invention. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Reference Figure 1 The following embodiments are obtained:

[0050] Embodiment 1: A method for detecting and responding to abnormal behavior in an industrial control network, comprising the following steps:

[0051] The state change information of the industrial control network is collected to obtain information set one, and a state change monitoring index is generated based on the information set one; the network attack information of the industrial control network is collected to obtain information set two, and a network attack threat index is generated based on the information set two; based on the state change monitoring index and the network attack threat index, judgment is made and different detection algorithms are dynamically selected to achieve real-time detection and response of abnormal behaviors; when the type of detection algorithm is selected, the application set of the type of detection algorithm is adaptively optimized and applied.

[0052] By collecting the state change information and network attack information of the industrial control network, the state change monitoring index and network attack threat index are generated respectively, which can accurately reflect the real-time state fluctuations and attack threat levels of the industrial control network. This dual index provides a multi-dimensional quantification of the network operation status, which helps to accurately grasp the network health status and potential security threats. This method uses the combined results of the state change monitoring index and the network attack threat index to dynamically select different types of detection algorithms and realize adaptive detection of abnormal behaviors. Automatically switching the detection algorithm according to the real-time status helps to apply the most suitable detection strategy in different risk situations, which can not only ensure detection accuracy but also optimize the use of system resources.

[0053] After the detection algorithm is selected, the application set of the algorithm is adaptively optimized according to the current state. Specifically, for rule-based, statistical-based, or machine learning-based detection algorithms, the system automatically screens and adjusts the applicable rule subsets, statistical parameters, or feature sets. This adaptive optimization enhances the flexibility and sensitivity of the detection algorithm, enabling it to adapt to environmental changes in a timely manner and ensure that it remains efficient in different scenarios. Through this method, the security assurance mechanism of the industrial control network becomes more intelligent and automated, and can respond to complex security threats without additional human intervention. The real-time detection and response mechanism can effectively reduce the impact of potential anomalies and attacks on industrial control systems, improve the stability and continuous operation capabilities of the system, and ultimately reduce security risks and accident probabilities.

[0054] The state change monitoring index is calculated by the total traffic, response time and equipment load of the industrial control network in information set 1, reflecting the degree of state fluctuation of the industrial control network. The state change monitoring index can timely reflect information such as load fluctuation, response speed change and traffic fluctuation in the network. Any abnormal fluctuation (such as sudden traffic surge or response delay) can be captured in time through this index, thereby helping operators to quickly identify potential performance bottlenecks or equipment failures. This index provides basic data for abnormal behavior detection. When the state change monitoring index is high, it indicates that the network state fluctuates significantly, and the detection algorithm may need to be adjusted to increase sensitivity; conversely, when the index is low, it means that the network is relatively stable and a detection method with low resource consumption can be selected. This can optimize resource utilization and improve the efficiency and accuracy of detection.

[0055] The network attack threat index is calculated based on the abnormal traffic, port scanning behavior and unauthorized access number of the industrial control network in information set 2, and quantifies the attack threat level of the current network. The network attack threat index can capture signs of malicious behavior in the industrial control network, such as abnormal traffic that may indicate an attack, frequent port scanning that may indicate that the network is being probed, and unauthorized access that may be an attacker's attempt to invade. The combination of these indicators helps to identify potential threats more comprehensively. When the network attack threat index is high, a more stringent detection algorithm is adaptively selected to increase the sensitivity to attack behavior; when the threat index is low, it can switch to a low sensitivity mode to save resources. Dynamic adjustment of the protection level ensures a balance between security protection and resource usage of the industrial control network.

[0056] When making judgments based on the state change monitoring index and the network attack threat index, fuzzy logic is used to judge the combination of the state change monitoring index and the network attack threat index to generate a corresponding detection algorithm selection signal.

[0057] There are three detection algorithm selection signals, corresponding to three types of detection algorithms, namely: rule-based detection algorithm, statistics-based detection algorithm, and machine learning-based detection algorithm.

[0058] Rule-based detection algorithms: detect known abnormal behaviors through predefined rules or characteristic patterns. These rules are usually formulated based on historical attack patterns, attack characteristics, and network protocols. For example, abnormal data traffic or frequent access requests on certain specific ports can trigger an alarm. The advantages of this type of algorithm are fast response, simple implementation, and low resource consumption. It is suitable for identifying known attack behaviors or abnormal activities that follow a specific pattern. Application scenarios: Applicable to environments where the attack pattern is relatively fixed and system resources are limited, such as basic network intrusion detection systems (IDS).

[0059] Statistical anomaly detection algorithm: Based on statistical methods, anomalies are identified by analyzing the statistical characteristics of normal behavior (such as mean, variance, distribution, etc.). The system will collect baseline data and establish a baseline model under normal conditions. Once the real-time data deviates from this baseline range, it will be marked as abnormal. For example, traffic-based statistical monitoring can detect abnormal behavior of traffic surges. Advantages: It can detect relatively subtle abnormal fluctuations, is not limited to fixed patterns, and is more flexible. Disadvantages: When the system state changes frequently or the network noise is large, the false alarm rate may be high. Application scenarios: Suitable for systems that need to detect subtle anomalies or dynamic changes, such as detecting a surge in network traffic.

[0060] Behavior detection algorithm based on machine learning: Use machine learning models to detect anomalies by learning normal behavior patterns. Common models include support vector machines (SVM), neural networks, decision trees, clustering algorithms, etc. Machine learning algorithms can adapt to dynamic environments and can detect unknown threats. For example, by using unsupervised learning algorithms (such as K-means clustering), network activities that are different from the past can be identified, thereby detecting unknown attacks. Advantages: high flexibility, ability to detect unknown attacks, suitable for complex environments. Disadvantages: large consumption of computing resources, the model training process may be more complicated, and high hardware requirements. Application scenarios: suitable for environments with large dynamic changes and the need to detect complex attack patterns, such as behavioral monitoring and advanced threat detection of industrial control networks.

[0061] The logic for obtaining the state change monitoring index is:

[0062] Assume the total flow of the industrial control network is F(t), the response time is R(t), the equipment load is L(t), and t is the time point;

[0063] Calculate the flow difference sequence ΔF(t): ΔF(t) = F(t) - F(t-1); reflects the flow change between time points t and t-1;

[0064] In order to reflect the flow fluctuation amplitude, the absolute value of the difference sequence in the time window W is accumulated and summed to obtain the cumulative deviation value of the difference sequence: i represents each time point from tW to t, t represents the current time point, Cum F is the cumulative deviation value;

[0065] The natural logarithm of the cumulative deviation is used to enhance the sensitivity to abnormal flow fluctuations, and the flow fluctuation coefficient is defined as: S F =ln(Cum F +1); S F is the flow fluctuation coefficient; the natural logarithm is used to increase the sensitivity of flow fluctuation so as to capture flow anomalies more accurately.

[0066] The response time is measured by the deviation rate method to measure the fluctuation. The response time deviation rate sequence ΔR(t) is obtained by calculating the change rate and standard deviation of the response time in the window: The relative response time change between the two time points was calculated, using denominator smoothing to prevent zero value problems.

[0067] The absolute value of the response time deviation rate is summed within the time window W to obtain the cumulative value of the response time fluctuation: Sum R is the cumulative value of response time fluctuation;

[0068] The response time fluctuation coefficient is defined as the ratio of the cumulative value of the response time fluctuation to the mean square error of the response time in the window W: S R is the response time fluctuation coefficient, σR is the mean square error of the response time in the window W; the fluctuation is balanced by the cumulative deviation and the standard deviation, and the mean square error calculates the uniformity of the response time, which is reflected in the fluctuation within the window.

[0069] The fluctuation of equipment load is measured by relative proportion, that is, the ratio of load difference to maximum load, and the differential proportion sequence ΔL(t) is defined as: ∈ is a preset non-zero constant; the relative change of the equipment load is calculated with the maximum value as the benchmark, and ∈ is a very small positive number set to prevent the denominator from being zero.

[0070] In the time window W, calculate the variance σL of the equipment load difference ratio 2 To obtain the load fluctuation degree: is the average value of the load difference ratio within the window W, and then defines the equipment load fluctuation coefficient S L is the variance of the equipment load differential ratio σL 2 The square root of the variance is used to quantify the load fluctuation.

[0071] Calculate the equipment load fluctuation coefficient S L , flow fluctuation coefficient S F , and the geometric mean of the response time fluctuation coefficient S, the state change monitoring index is obtained. The geometric mean maintains the balanced contribution of each parameter to the overall fluctuation, reflecting the overall state fluctuation degree of the industrial control network.

[0072] The logic for obtaining the network attack threat index is as follows:

[0073] Assume that abnormal traffic is A(t), the number of port scanning behaviors is S(t), the number of unauthorized accesses is U(t), and t is the time point;

[0074] In the time window W, calculate the index and ExpSum of abnormal trafficA :

[0075] The exponential function is used to amplify the impact of abnormal traffic on the threat index, so as to more sensitively capture the increase of abnormal traffic.

[0076] The index and ExpSum of abnormal traffic A The ratio is processed with the average flow of window W to reflect the threat level of abnormal flow and obtain the abnormal flow fluctuation coefficient I A , which is used to quantify abnormal traffic fluctuations in the chemical control network and reflect the activity level of abnormal traffic in the current network.

[0077] represents the average flow in window W;

[0078] In window W, take the logarithm of the number of port scan behaviors and accumulate them to get the cumulative port scan value LogSum S : Smooth out the spikes in port scans using logarithmic processing to reduce the impact of extreme values.

[0079] Calculate the port scanning behavior fluctuation coefficient I S , which indicates the frequency of port scanning in industrial control networks. The threat level can be quantified by observing the frequency of port scanning. represents the average number of scanning behaviors of window W;

[0080] Calculate the cumulative unauthorized access value SqiareSum U : The impact of the number of unauthorized accesses is magnified through the squaring operation, so that the anomalies of frequent unauthorized accesses can be captured more clearly.

[0081] Calculate the unauthorized access fluctuation coefficient I U , used to measure the frequency of unauthorized access behaviors in industrial control networks to reflect the severity of security threats, represents the average number of unauthorized accesses in window W;

[0082] Calculate the unauthorized access fluctuation coefficient I U , Abnormal flow fluctuation coefficient I A , and the port scanning behavior fluctuation coefficient I S The geometric mean of the network attack threat index is obtained. The network attack threat index combines the fluctuation coefficients of abnormal traffic, port scanning and unauthorized access, and integrates this information in a geometric mean way to quantify the overall attack threat level of the current network.

[0083] Fuzzy logic judgment refers to:

[0084] The state change monitoring index and the network attack threat index are obtained separately and used as input variables together. The type of detection algorithm used to detect abnormal behavior is used as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the fitness of the three types of detection algorithms under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to determine the type of detection algorithm used to detect abnormal behavior.

[0085] The input variables are the state change monitoring index and the network attack threat index. These two indexes represent the state fluctuation degree and security threat level of the network respectively. The numerical ranges of these two indexes are divided into fuzzy sets (such as "low", "medium" and "high"). For example, the state change monitoring index can be divided into three levels: low, medium and high to reflect the different network state stability. The network attack threat index can also be divided into three levels: low, medium and high to indicate the severity of the attack risk. By converting the numerical value into a fuzzy set, the specific numerical value is quantified into a fuzzy language description in order to deal with uncertainty and dynamic changes.

[0086] Output variable: Type of detection algorithm. The output variable indicates the type of detection algorithm that the system should select. Rule-based detection algorithm: Suitable for low state fluctuations and low threat index scenarios, used to quickly and efficiently identify known abnormal patterns. Statistics-based detection algorithm: Suitable for high state fluctuations but low threat index scenarios, used to detect subtle abnormal fluctuations. Machine learning-based detection algorithm: Suitable for high state fluctuations and high threat index scenarios, used to detect complex unknown threats.

[0087] Fuzzification: The selection of the three types of detection algorithms is converted into fuzzy sets, for example, the fitness is divided into "suitable", "general" and "unsuitable" levels, so that the appropriate algorithm can be selected according to the specific situation during the reasoning process.

[0088] Fuzzy rule definition: According to the combination of state change monitoring index and network attack threat index, a series of fuzzy rules are formulated to determine the appropriate detection algorithm type. For example:

[0089] If the state change monitoring index is "low" and the network attack threat index is "low", the "rule-based detection algorithm" is suitable.

[0090] If the state change monitoring index is "high" and the network attack threat index is "low", the "statistical-based detection algorithm" is suitable.

[0091] If the state change monitoring index is "high" and the network attack threat index is "high", then the "machine learning-based detection algorithm" is suitable.

[0092] Rule combination: Through different index combinations, a rule library is established to cover various possible input scenarios.

[0093] Reasoning process: Substitute the fuzzified input variables (state change monitoring index and network attack threat index) into the fuzzy rule base, and use the fuzzy reasoning process to derive the appropriate detection algorithm type.

[0094] Reasoning mechanism: Use fuzzy reasoning mechanisms such as "maximum-minimum reasoning" or "weighted average reasoning" to comprehensively calculate the fuzzy rules that meet the conditions and finally output a detection algorithm type with a higher degree of adaptability.

[0095] Example: Assuming that the state change monitoring index is "high" and the network attack threat index is "medium", the fuzzy rule base is used to infer that the "statistical-based detection algorithm" is most suitable for the current situation. The detection algorithm type obtained by inference is clarified and converted from a fuzzy set to a specific detection algorithm type as the final selection result.

[0096] Finally, through fuzzy logic judgment, the most suitable detection algorithm type is selected in the current situation. According to the real-time changes in status and threat index, fuzzy logic judgment can be re-run at any time to dynamically select the appropriate detection algorithm type to better deal with abnormal behavior.

[0097] The type of the selected detection algorithm is the target algorithm, and the target algorithm is preset with a basic set. The optimized application set is obtained through the following steps:

[0098] Set an initial baseline threshold Nbase, which is the basic reference value for application set screening to ensure that the screened rules meet at least certain baseline requirements. The optimized threshold is Y, which is used to determine the optimized application set. The baseline threshold Nbase refers to the priority of the rules screened from the basic set that must meet at least Nbase. Nbase and Y are both percentages and meet the following requirements:

[0099] Y=Nbase+αk*w1*SZ+βk*w2*IZ; SZ is the state change monitoring index, IZ is the network attack threat index, w1 and w2 are preset proportional coefficients, specifically: they are the proportional coefficients of the state change monitoring index and the network attack threat index, reflecting the relative importance of the two indexes in the adjustment process, αk and βk are the preset adjustment coefficients corresponding to the type number k of the detection algorithm, which are used to adjust the adaptability of different detection algorithms. Different algorithms may have different adjustment coefficients to meet the needs of different scenarios, and then the basic set is screened according to the optimized threshold Y to obtain the optimized application set. This formula combines the state change monitoring index and the network attack threat index, and balances their influence through the adjustment coefficient and the proportional coefficient to calculate the threshold Y of the optimized application set. When the state fluctuates or the threat index is high, a stricter application set will be selected to improve the sensitivity and accuracy of detection.

[0100] The target algorithm is pre-set with a basic set. For example, a rule set is pre-set in a rule-based detection algorithm, a statistical parameter set is pre-set in a statistics-based detection algorithm, and a feature set is pre-set in a machine learning-based detection algorithm. The base threshold Nbase refers to the minimum priority that the rules selected from the basic set need to meet, and the priority here can indeed be understood as the degree of impact on the abnormal situation. Specifically, the priority reflects the importance or urgency of each rule in detecting abnormal behavior, and is usually associated with the degree of impact of the abnormal behavior that the rule responds to on the stability or security of the system.

[0101] To explain more specifically, here is an example of a rule set in a rule-based detection algorithm:

[0102] In a rule-based detection algorithm, a set of rules is pre-set, where each rule is used to detect a specific type of anomaly. For example, a rule set may contain the following detection rules:

[0103] Rule 1: Detect frequent unauthorized access attempts; Rule 2: Detect sudden increases in abnormal traffic; Rule 3: Detect the frequency of port scanning behavior; Rule 4: Detect long periods of high load operation; Rule 5: Detect repeated abnormal response times; Each rule has a priority, which indicates the potential impact of the abnormal situation corresponding to the rule on the system. For example: Rule 1 may have a higher priority because unauthorized access attempts may be a direct signal of an attacker trying to invade, which poses a greater threat to system security. Rule 2 may have a slightly lower priority, but still high, because an abnormal increase in traffic may indicate a traffic anomaly, which has a greater impact on system performance. Rule 5 may have a relatively low priority because the abnormal response time may only be a performance issue and has little impact on security.

[0104] The base threshold Nbase is used to filter out rules with a priority higher than or equal to Nbase in the rule set. For example, if Nbase=70%, only rules that meet at least 70% of the priority will be filtered into the detection application set. By setting the base threshold Nbase, the present invention can dynamically adjust the rule set to cope with different risks and needs: when the industrial control network is in a high-risk state, Nbase can be reduced to include more rules and expand the detection range. When the industrial control network is in a stable state, Nbase can be increased to reduce the interference of low-priority rules, thereby saving resources.

[0105] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0106] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0107] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0108] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0109] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for adaptive abnormal behavior detection and response in industrial control networks, characterized in that: The following steps are involved: Collecting state change information of the industrial control network to obtain information set 1, and generating a state change monitoring index based on the information set 1; Collecting network attack information of the industrial control network to obtain information set 2, and generating a network attack threat index based on the information set 2; Based on the state change monitoring index and network attack threat index, different detection algorithms are judged and dynamically selected to achieve real-time detection and response of abnormal behaviors; When the type of detection algorithm is selected, an application set of the type of detection algorithm is adaptively optimized and applied.

2. According to claim 1, a method for detecting and responding to abnormal behavior in an industrial control network is characterized in that: The state change monitoring index is calculated through the total traffic, response time and equipment load of the industrial control network in information set 1, reflecting the state fluctuation degree of the industrial control network.

3. The method for detecting and responding to industrial control network adaptive abnormal behavior according to claim 2, characterized in that: The network attack threat index is calculated based on the abnormal traffic, port scanning behavior and unauthorized access times of the industrial control network in information set 2, and quantifies the attack threat level of the current network.

4. The method for detecting and responding to industrial control network abnormal behavior according to claim 3, characterized in that: When making judgments based on the state change monitoring index and the network attack threat index, fuzzy logic is used to judge the combination of the state change monitoring index and the network attack threat index to generate a corresponding detection algorithm selection signal.

5. The method for detecting and responding to industrial control network adaptive abnormal behavior according to claim 4, characterized in that: There are three detection algorithm selection signals, corresponding to three types of detection algorithms, namely: rule-based detection algorithm, statistics-based detection algorithm, and machine learning-based detection algorithm.

6. The method for detecting and responding to industrial control network adaptive abnormal behavior according to claim 5, characterized in that: The logic for obtaining the status change monitoring index is: Assume the total flow of the industrial control network is F(t), the response time is R(t), the equipment load is L(t), and t is the time point; Calculate the flow difference sequence ΔF(t): ΔF(t) = F(t) - F(t-1); In order to reflect the flow fluctuation amplitude, the absolute value of the difference sequence in the time window W is accumulated and summed to obtain the cumulative deviation value of the difference sequence: i represents each time point from tW to t, t represents the current time point, Cum F is the cumulative deviation value; The natural logarithm of the cumulative deviation is used to enhance the sensitivity to abnormal flow fluctuations, and the flow fluctuation coefficient is defined as: S F =ln(Cum F +1); S F is the flow fluctuation coefficient; The response time is measured by the deviation rate method to measure the fluctuation. The response time deviation rate sequence ΔR(death) is obtained by calculating the change rate and standard deviation of the response time in the window: The absolute value of the response time deviation rate is summed within the time window W to obtain the cumulative value of the response time fluctuation: Sum R is the cumulative value of response time fluctuation; The response time fluctuation coefficient is defined as the ratio of the cumulative value of the response time fluctuation to the mean square error of the response time in the window W: S R is the response time fluctuation coefficient, σR is the mean square error of the response time in window W; The fluctuation of equipment load is measured by relative proportion, that is, the ratio of load difference to maximum load, and the differential proportion sequence ΔL(t) is defined as: ∈ is a preset non-zero constant; In the time window W, calculate the variance σL of the equipment load difference ratio 2 To obtain the load fluctuation degree: is the average value of the load difference ratio within the window W, and then defines the equipment load fluctuation coefficient S L is the variance of the equipment load differential ratio σL 2 The square root of Calculate the equipment load fluctuation coefficient S L , flow fluctuation coefficient S F , and the response time fluctuation coefficient S R The geometric mean of the state change monitoring index is obtained.

7. The method for detecting and responding to industrial control network abnormal behavior according to claim 6, characterized in that: The logic for obtaining the network attack threat index is as follows: Assume that abnormal traffic is A(t), the number of port scanning behaviors is S(t), the number of unauthorized accesses is U(t), and t is the time point; In the time window W, calculate the index and ExpSum of abnormal traffic A : The index and ExpSum of abnormal traffic A The ratio is processed with the average flow of window W to reflect the threat level of abnormal flow and obtain the abnormal flow fluctuation coefficient I A : represents the average flow in window W; In the window W, take the logarithm of the number of times each port scan is performed and accumulate to obtain the cumulative port scan value LogSum S : Calculate the port scanning behavior fluctuation coefficient I S : represents the average number of scanning behaviors of window W; Calculate the cumulative unauthorized access value SqiareSum U : Calculate the unauthorized access fluctuation coefficient I U : represents the average number of unauthorized accesses in window W; Calculate the unauthorized access fluctuation coefficient I U , Abnormal flow fluctuation coefficient I A , and the port scanning behavior fluctuation coefficient I S The geometric mean of is used to obtain the network attack threat index.

8. The method for detecting and responding to industrial control network adaptive abnormal behavior according to claim 7, characterized in that: Fuzzy logic judgment refers to: The state change monitoring index and the network attack threat index are obtained separately and used as input variables together. The type of detection algorithm used to detect abnormal behavior is used as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the fitness of the three types of detection algorithms under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to determine the type of detection algorithm used to detect abnormal behavior.

9. The method for detecting and responding to industrial control network adaptive abnormal behavior according to claim 8, characterized in that: The type of the selected detection algorithm is the target algorithm, and the target algorithm is preset with a basic set. The optimized application set is obtained through the following steps: Set an initial baseline threshold Nbase, and the optimized threshold is Y. The baseline threshold Nbase means that the rules selected from the basic set must meet a priority of at least Nbase. Nbase and Y are both percentages and meet the following requirements: Y=Nbase+αk*w1*SZ+βk*w2*IZ; SZ is the state change monitoring index, IZ is the network attack threat index, w1 and w2 are the preset proportional coefficients, αk and βk are the preset adjustment coefficients corresponding to the type number k of the detection algorithm, and then the basic set is screened according to the optimized threshold Y to obtain the optimized application set.

Images