An adaptive abnormal behavior detection and response method for industrial control networks

Abstract

The present invention discloses a method for adaptively detecting and responding to abnormal behavior in an industrial control network, which specifically relates to the technical field of industrial control network security. The method comprises the following steps: collecting state change information of the industrial control network to obtain information set one, and generating a state change monitoring index based on the information set one; collecting network attack information of the industrial control network to obtain information set two, and generating a network attack threat index based on the information set two; making judgments based on the state change monitoring index and the network attack threat index and dynamically selecting different detection algorithms to achieve real-time detection and response of abnormal behavior; when selecting the type of detection algorithm, adaptively optimizing the application set of the detection algorithm of this type and applying it; the present invention can reasonably allocate detection resources under different network states and security threat conditions, and by dynamically adjusting the detection strategy, the industrial control network is more flexible in responding to sudden security threats, which helps to ensure the security of the industrial control network and the continuity of operation.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network security, and more specifically, to an industrial control network adaptive abnormal behavior detection and response method. Background Art

[0002] With the widespread adoption of industrial control systems (ICS), they have become a core component of various industrial production processes. However, due to their openness, distribution, and connection to external networks, ICS networks face increasing security threats. Common abnormal behaviors include unusual traffic surges, port scanning, and unauthorized access. These abnormal behaviors can cause ICS network performance degradation and even be exploited by attackers to tamper with data or disrupt systems, posing a serious threat to the security and stability of industrial production.

[0003] Existing industrial control systems mostly use static anomaly detection methods, such as rule-based, statistical, and machine learning-based methods. However, a single detection method cannot meet the adaptive needs of industrial control networks under different states and threat conditions. For example, rule-based methods, while highly efficient, struggle to respond to unknown attacks; while machine learning-based methods, while highly accurate, consume large amounts of computing resources and struggle to respond in real time under resource-constrained conditions.

[0004] Therefore, there is an urgent need for an abnormal behavior detection and response method that can adaptively select and optimize detection algorithms based on the actual operating status and security threat level of industrial control networks, thereby improving the security and reliability of industrial control networks. This paper proposes an adaptive abnormal behavior detection and response method for industrial control networks. Based on a real-time state change monitoring index and a network attack threat index, it dynamically selects the appropriate detection algorithm type and adaptively optimizes its application set to achieve real-time detection and response to abnormal behavior in industrial control networks. Summary of the Invention

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A method for adaptively detecting and responding to abnormal behavior in an industrial control network comprises the following steps:

[0007] Collecting state change information of the industrial control network to obtain information set 1, and generating a state change monitoring index based on the information set 1;

[0008] Collecting network attack information of the industrial control network to obtain information set 2, and generating a network attack threat index based on the information set 2;

[0009] Based on the state change monitoring index and network attack threat index, different detection algorithms are dynamically selected to achieve real-time detection and response of abnormal behaviors.

[0010] When the type of detection algorithm is selected, the application set of the type of detection algorithm is adaptively optimized and applied.

[0011] In a preferred embodiment, the state change monitoring index is calculated based on the total traffic, response time and equipment load of the industrial control network in the information set 1, and reflects the state fluctuation degree of the industrial control network.

[0012] In a preferred embodiment, the network attack threat index is calculated based on abnormal traffic, port scanning behavior and unauthorized access times of the industrial control network in the second information set to quantify the attack threat level of the current network.

[0013] In a preferred embodiment, when making a judgment based on the state change monitoring index and the network attack threat index, fuzzy logic is used to judge the combination of the state change monitoring index and the network attack threat index to generate a corresponding detection algorithm selection signal.

[0014] There are three detection algorithm selection signals, corresponding to three types of detection algorithms, namely: rule-based detection algorithm, statistics-based detection algorithm, and machine learning-based detection algorithm.

[0015] In a preferred embodiment, the acquisition logic of the state change monitoring index is:

[0016] Assume that the total flow of the industrial control network is F(t), the response time is R(t), the equipment load is L(t), and t is the time point;

[0017] Calculate the flow difference sequence ΔF(t): ΔF(t) = F(t) - F(t-1);

[0018] In order to reflect the flow fluctuation amplitude, the absolute value of the difference sequence in the time window W is accumulated and summed to obtain the cumulative deviation value of the difference sequence: i represents each time point from tW to t, t represents the current time point, Cum F is the cumulative deviation value;

[0019] The natural logarithm of the cumulative deviation is used to enhance the sensitivity to abnormal flow fluctuations, and the flow fluctuation coefficient is defined as: S F =ln(Cum F +1); S F is the flow fluctuation coefficient;

[0020] The response time fluctuation is measured by the deviation rate method. The response time deviation rate sequence ΔR(t) is obtained by calculating the change rate and standard deviation of the response time within the window:

[0021] The absolute value of the response time deviation rate is summed within the time window W to obtain the cumulative value of response time fluctuation: Sum R is the cumulative value of response time fluctuation;

[0022] The response time fluctuation coefficient is defined as the ratio of the cumulative value of response time fluctuation to the mean square error of the response time in window W: S R is the response time fluctuation coefficient, σR is the mean square error of the response time in the window W;

[0023] The fluctuation of equipment load is measured by relative proportion, that is, the ratio of the load difference to the maximum load, and the differential proportion sequence ΔL(t) is defined as: ∈ is a preset non-zero constant;

[0024] In the time window W, calculate the variance σL of the equipment load difference ratio 2 To obtain the load fluctuation degree: is the average value of the load difference ratio within the window W, and then the equipment load fluctuation coefficient S is defined L is the variance of the equipment load differential ratio σL 2 The square root of

[0025] Calculate the equipment load fluctuation coefficient S L , flow fluctuation coefficient S F , and the geometric mean of the response time fluctuation coefficient S, to obtain the state change monitoring index.

[0026] In a preferred embodiment, the logic for obtaining the network attack threat index is:

[0027] Assume that abnormal traffic is A(t), the number of port scanning behaviors is S(t), the number of unauthorized accesses is U(t), and t is the time point;

[0028] In the time window W, calculate the index and ExpSum of abnormal traffic A :

[0029]

[0030] The index of abnormal traffic and ExpSum A The ratio is processed with the average flow of window W to reflect the threat level of abnormal flow and obtain the abnormal flow fluctuation coefficient I A :

[0031] represents the average flow in window W;

[0032] In the window W, the logarithm of the number of times each port scan is performed is taken and accumulated to obtain the cumulative port scan value LogSum S :

[0033] Calculate the port scanning behavior fluctuation coefficient I S : represents the average number of scanning behaviors in window W;

[0034] Calculate the cumulative unauthorized access value SqiareSum U :

[0035] Calculate the unauthorized access fluctuation coefficient I U : represents the average number of unauthorized accesses in window W;

[0036] Calculate the unauthorized access fluctuation coefficient I U , Abnormal flow fluctuation coefficient I A , and the port scanning behavior fluctuation coefficient I S The geometric mean of is used to obtain the network attack threat index.

[0037] In a preferred embodiment, fuzzy logic judgment refers to:

[0038] The state change monitoring index and the network attack threat index are obtained separately and used as input variables. The type of detection algorithm used to detect abnormal behavior is used as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the adaptability of the three types of detection algorithms under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to determine the type of detection algorithm used to detect abnormal behavior.

[0039] In a preferred embodiment, the type of the selected detection algorithm is used as the target algorithm, the target algorithm is pre-set with a basic set, and the optimized application set is obtained by the following steps:

[0040] Set an initial baseline threshold Nbase and an optimized threshold Y. The baseline threshold Nbase means that the rules selected from the base set must meet a priority of at least Nbase. Nbase and Y are both percentages and must meet the following requirements:

[0041] Y = Nbase + αk*w1*SZ + βk*w2*IZ; SZ is the state change monitoring index, IZ is the network attack threat index, w1 and w2 are preset proportional coefficients, αk and βk are preset adjustment coefficients corresponding to the type number k of the detection algorithm. The basic set is then screened according to the optimized threshold Y to obtain the optimized application set.

[0042] Technical effects and advantages of the present invention:

[0043] This method dynamically selects the appropriate detection algorithm based on the real-time status and threat level of the industrial control network. This allows the network to employ high-precision detection methods in high-risk environments and less resource-intensive methods in low-risk environments. This adaptive adjustment effectively improves detection accuracy while ensuring that the industrial control network can rapidly respond to various abnormal behaviors.

[0044] By adaptively selecting and optimizing the application set of detection algorithms, the present invention rationally allocates detection resources under different network states and security threat conditions. It can only start high-consumption detection algorithms when necessary, and use lightweight algorithms when the network state is relatively stable, significantly reducing computing resources and energy consumption, and improving the resource utilization efficiency of industrial control networks. The present invention can accurately monitor and respond to various abnormal behaviors (such as abnormal traffic, port scanning, unauthorized access, etc.) in industrial control networks, effectively preventing potential network attacks and abnormal situations. By dynamically adjusting the detection strategy, the industrial control network is more flexible in responding to sudden security threats, which helps to ensure the security of the industrial control network and the continuity of operation.

[0045] The detection response method of the present invention can automatically adjust the detection algorithm according to the actual operating status of the network to adapt to different industrial control environment requirements. Whether it is a sudden surge in traffic or long-term load changes, it can intelligently adapt to different situations to ensure the detection effect, and is particularly suitable for the complex and changeable environmental requirements of industrial control industrial networks. Through the joint judgment of the state change monitoring index and the network attack threat index, the present invention can reduce unnecessary false alarms, thereby improving the accuracy of detection. Different types of detection algorithms are enabled in appropriate situations, avoiding the false alarm phenomenon that is easy to occur with a single algorithm in a complex environment, making the detection effect more reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0047] Figure 1 This is a schematic diagram of a method for adaptively detecting and responding to abnormal behavior in an industrial control network according to the present invention. DETAILED DESCRIPTION

[0048] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0049] Reference Figure 1 The following examples were obtained:

[0050] Example 1: A method for adaptively detecting and responding to abnormal behavior in an industrial control network, comprising the following steps:

[0051] The state change information of the industrial control network is collected to obtain information set one, and a state change monitoring index is generated based on the information set one; the network attack information of the industrial control network is collected to obtain information set two, and a network attack threat index is generated based on the information set two; based on the state change monitoring index and the network attack threat index, judgment is made and different detection algorithms are dynamically selected to achieve real-time detection and response of abnormal behaviors; when the type of detection algorithm is selected, the application set of the detection algorithm of this type is adaptively optimized and applied.

[0052] By collecting state change information and network attack information from the industrial control network, a state change monitoring index and a network attack threat index are generated, respectively. These accurately reflect the real-time state fluctuations and attack threat levels of the industrial control network. This dual index provides a multi-dimensional quantification of network operation, helping to accurately assess network health and potential security threats. This method leverages the combined results of the state change monitoring index and the network attack threat index to dynamically select different detection algorithms, enabling adaptive detection of anomalous behavior. Automatically switching detection algorithms based on real-time status helps apply the most appropriate detection strategy for different risk scenarios, ensuring detection accuracy while optimizing system resource utilization.

[0053] After selecting a detection algorithm, the system adaptively optimizes its application set based on the current state. Specifically, for rule-based, statistical, or machine learning-based detection algorithms, the system automatically filters and adjusts the applicable rule subsets, statistical parameters, or feature sets. This adaptive optimization enhances the flexibility and sensitivity of the detection algorithm, enabling it to promptly adapt to environmental changes and ensure continued effectiveness in diverse scenarios. Through this approach, the security assurance mechanism for industrial control networks becomes more intelligent and automated, capable of responding to complex security threats without additional human intervention. Real-time detection and response mechanisms can effectively reduce the impact of potential anomalies and attacks on industrial control systems, improve system stability and continuous operation, and ultimately reduce security risks and the probability of accidents.

[0054] The state change monitoring index is calculated using the total industrial control network traffic, response time, and device load in information set 1, reflecting the degree of state fluctuation in the industrial control network. The state change monitoring index can promptly reflect information such as load fluctuations, changes in response speed, and traffic fluctuations in the network. Any abnormal fluctuations (such as sudden traffic surges or response delays) can be captured promptly by this index, helping operators quickly identify potential performance bottlenecks or equipment failures. This index provides basic data for abnormal behavior detection. When the state change monitoring index is high, it indicates significant network state fluctuations, and the detection algorithm may need to be adjusted to increase sensitivity. Conversely, when the index is low, the network is relatively stable, and a detection method with lower resource consumption can be selected. This optimizes resource utilization and improves detection efficiency and accuracy.

[0055] The Network Attack Threat Index (CTI) is calculated based on abnormal traffic, port scanning, and unauthorized access within the industrial control network from Information Set 2, quantifying the current network's attack threat level. The CTI can detect signs of malicious behavior within the industrial control network. For example, abnormal traffic may indicate an attack, frequent port scanning may indicate network probing, and unauthorized access may indicate an attacker's attempted intrusion. The combination of these indicators helps more comprehensively identify potential threats. When the CTI is high, a stricter detection algorithm is adaptively selected to increase sensitivity to attack behavior. When the CTI is low, a lower sensitivity mode is selected to conserve resources. Dynamic adjustment of the protection level ensures a balance between security and resource utilization within the industrial control network.

[0056] When making judgments based on the state change monitoring index and the network attack threat index, fuzzy logic is used to judge the combination of the state change monitoring index and the network attack threat index to generate a corresponding detection algorithm selection signal.

[0057] There are three detection algorithm selection signals, corresponding to three types of detection algorithms, namely: rule-based detection algorithm, statistics-based detection algorithm, and machine learning-based detection algorithm.

[0058] Rule-based detection algorithms detect known anomalous behavior using predefined rules or characteristic patterns. These rules are typically based on historical attack patterns, attack signatures, and network protocols. For example, abnormal data traffic or frequent access requests on specific ports can trigger an alert. These algorithms offer the advantages of rapid response, ease of implementation, and low resource consumption. They are suitable for identifying known attacks or anomalous activity that follows specific patterns. Application scenarios: These algorithms are suitable for environments with relatively fixed attack patterns and limited system resources, such as basic network intrusion detection systems (IDS).

[0059] Statistical anomaly detection algorithm: Based on statistical methods, anomalies are identified by analyzing the statistical characteristics of normal behavior (such as mean, variance, distribution, etc.). The system will collect baseline data and establish a baseline model under normal conditions. Once the real-time data deviates from this baseline range, it will be marked as an anomaly. For example, traffic-based statistical monitoring can detect abnormal behavior of traffic surges. Advantages: It can detect more subtle abnormal fluctuations, is not limited to fixed patterns, and is more flexible. Disadvantages: When the system status changes frequently or the network noise is large, the false alarm rate may be high. Application scenarios: Suitable for systems that need to detect subtle anomalies or dynamic changes, such as detecting a surge in network traffic.

[0060] Behavioral detection algorithm based on machine learning: Use machine learning models to detect anomalies by learning normal behavior patterns. Common models include support vector machines (SVM), neural networks, decision trees, clustering algorithms, etc. Machine learning algorithms can adapt to dynamic environments and can detect unknown threats. For example, by using unsupervised learning algorithms (such as K-means clustering), network activities that are different from the past can be identified, thereby detecting unknown attacks. Advantages: high flexibility, able to detect unknown attacks, suitable for complex environments. Disadvantages: large computing resource consumption, the model training process may be more complicated, and high hardware requirements. Application scenarios: suitable for environments with large dynamic changes and the need to detect complex attack patterns, such as behavioral monitoring and advanced threat detection of industrial control networks.

[0061] The logic for obtaining the status change monitoring index is:

[0062] Assume that the total flow of the industrial control network is F(t), the response time is R(t), the equipment load is L(t), and t is the time point;

[0063] Calculate the flow difference sequence ΔF(t): ΔF(t) = F(t) - F(t-1); This reflects the flow change between time points t and t-1;

[0064] In order to reflect the flow fluctuation amplitude, the absolute value of the difference sequence in the time window W is accumulated and summed to obtain the cumulative deviation value of the difference sequence: i represents each time point from tW to t, t represents the current time point, Cum F is the cumulative deviation value;

[0065] The natural logarithm of the cumulative deviation is used to enhance the sensitivity to abnormal flow fluctuations, and the flow fluctuation coefficient is defined as: S F =ln(Cum F +1); S F is the flow fluctuation coefficient; the natural logarithm is used to increase the sensitivity of flow fluctuations so as to capture flow anomalies more accurately.

[0066] The response time fluctuation is measured by the deviation rate method. The response time deviation rate sequence ΔR(t) is obtained by calculating the change rate and standard deviation of the response time within the window: The relative response time change between the two time points was calculated, using denominator smoothing to prevent zero-value problems.

[0067] The absolute value of the response time deviation rate is summed within the time window W to obtain the cumulative value of response time fluctuation: Sum R is the cumulative value of response time fluctuation;

[0068] The response time fluctuation coefficient is defined as the ratio of the cumulative value of response time fluctuation to the mean square error of the response time in window W: S R is the response time fluctuation coefficient, σR is the mean square error of the response time within the window W; the fluctuation is balanced by the cumulative deviation and the standard deviation, and the mean square error calculates the uniformity of the response time, which is reflected in the fluctuation within the window.

[0069] The fluctuation of equipment load is measured by relative proportion, that is, the ratio of the load difference to the maximum load, and the differential proportion sequence ΔL(t) is defined as: ∈ is a preset non-zero constant; the relative change of the equipment load is calculated with the maximum value as the benchmark, and ∈ is a very small positive number set to prevent the denominator from being zero.

[0070] In the time window W, calculate the variance σL of the equipment load difference ratio 2 To obtain the load fluctuation degree: is the average value of the load difference ratio within the window W, and then the equipment load fluctuation coefficient S is defined L is the variance of the equipment load differential ratio σL 2 The square root of the variance is used to quantify the load fluctuation.

[0071] Calculate the equipment load fluctuation coefficient S L , flow fluctuation coefficient S F , and the geometric mean of the response time fluctuation coefficient S, the state change monitoring index is obtained. The geometric mean maintains the balanced contribution of each parameter to the overall fluctuation, reflecting the overall state fluctuation degree of the industrial control network.

[0072] The logic for obtaining the network attack threat index is as follows:

[0073] Assume that abnormal traffic is A(t), the number of port scanning behaviors is S(t), the number of unauthorized accesses is U(t), and t is the time point;

[0074] In the time window W, calculate the index and ExpSum of abnormal trafficA :

[0075] The exponential function is used to amplify the impact of abnormal traffic on the threat index, so as to more sensitively capture the increase of abnormal traffic.

[0076] The index of abnormal traffic and ExpSum A The ratio is processed with the average flow of window W to reflect the threat level of abnormal flow and obtain the abnormal flow fluctuation coefficient I A , which is used to quantify abnormal traffic fluctuations in the industrial control network and reflect the activity level of abnormal traffic in the current network.

[0077] represents the average flow in window W;

[0078] In the window W, the logarithm of the number of times each port scan is performed is taken and accumulated to obtain the cumulative port scan value LogSum S : Smoothes spikes in port scans using logarithmic processing to reduce the impact of extreme values.

[0079] Calculate the port scanning behavior fluctuation coefficient I S , which indicates the frequency of port scanning in industrial control networks. By observing the frequency of port scanning, we can quantify its threat. represents the average number of scanning behaviors in window W;

[0080] Calculate the cumulative unauthorized access value SqiareSum U : The impact of the number of unauthorized accesses is magnified by the squaring operation, so that the anomalies of frequent unauthorized accesses can be captured more clearly.

[0081] Calculate the unauthorized access fluctuation coefficient I U , used to measure the frequency of unauthorized access in industrial control networks to reflect the severity of security threats, represents the average number of unauthorized accesses in window W;

[0082] Calculate the unauthorized access fluctuation coefficient I U , Abnormal flow fluctuation coefficient I A , and the port scanning behavior fluctuation coefficient I S The geometric mean of the three behaviors is used to obtain the network attack threat index. The network attack threat index combines the fluctuation coefficients of abnormal traffic, port scanning, and unauthorized access, and integrates this information in a geometric mean manner to quantify the overall attack threat level of the current network.

[0083] Fuzzy logic judgment refers to:

[0084] The state change monitoring index and the network attack threat index are obtained separately and used as input variables. The type of detection algorithm used to detect abnormal behavior is used as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the adaptability of the three types of detection algorithms under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to determine the type of detection algorithm used to detect abnormal behavior.

[0085] The input variables are the state change monitoring index and the network attack threat index. These two indices represent the degree of network state fluctuation and the security threat level, respectively. The numerical ranges of these two indices are divided into fuzzy sets (such as "low," "medium," and "high"). For example, the state change monitoring index can be divided into three levels: low, medium, and high to reflect different levels of network stability. The network attack threat index can also be divided into three levels: low, medium, and high to indicate the severity of the attack risk. By converting the numerical values ​​into fuzzy sets, the specific numerical values ​​are quantified into fuzzy language descriptions to handle uncertainty and dynamic changes.

[0086] Output variable: Detection algorithm type. This output variable indicates the type of detection algorithm the system should select. Rule-based detection algorithms are suitable for scenarios with low state fluctuations and low threat indices, and are used to quickly and efficiently identify known abnormal patterns. Statistics-based detection algorithms are suitable for scenarios with high state fluctuations but low threat indices, and are used to detect subtle abnormal fluctuations. Machine learning-based detection algorithms are suitable for scenarios with high state fluctuations and high threat indices, and are used to detect complex, unknown threats.

[0087] Fuzzification: The selection of the three types of detection algorithms is converted into fuzzy sets. For example, the fitness is divided into "suitable", "general" and "unsuitable" levels, so that the appropriate algorithm can be selected according to the specific situation during the reasoning process.

[0088] Fuzzy rule definition: Based on the combination of the state change monitoring index and the network attack threat index, a series of fuzzy rules are formulated to determine the appropriate detection algorithm type. For example:

[0089] If the state change monitoring index is "low" and the network attack threat index is "low", the "rule-based detection algorithm" is suitable.

[0090] If the state change monitoring index is "high" and the network attack threat index is "low", the "statistics-based detection algorithm" is suitable.

[0091] If the state change monitoring index is "high" and the network attack threat index is "high", the "machine learning-based detection algorithm" is suitable.

[0092] Rule combination: Through different index combinations, a rule library is established to cover various possible input scenarios.

[0093] Reasoning process: Substitute the fuzzified input variables (state change monitoring index and network attack threat index) into the fuzzy rule base, and use the fuzzy reasoning process to derive the appropriate detection algorithm type.

[0094] Reasoning mechanism: Using fuzzy reasoning mechanisms such as "maximum-minimum reasoning" or "weighted average reasoning", the fuzzy rules that meet the conditions are comprehensively calculated, and finally a detection algorithm type with a higher degree of adaptability is output.

[0095] For example, if the state change monitoring index is "high" and the network attack threat index is "medium," reasoning based on the fuzzy rule base might indicate that a "statistics-based detection algorithm" is most appropriate for the current situation. The resulting detection algorithm type is then clarified and converted from a fuzzy set into a specific detection algorithm type, which is then selected as the final result.

[0096] Ultimately, fuzzy logic is used to determine the most appropriate detection algorithm for the current situation. Based on real-time changes in status and threat index, fuzzy logic can be rerun at any time to dynamically select the appropriate detection algorithm, effectively responding to abnormal behavior.

[0097] The type of the selected detection algorithm is the target algorithm. The target algorithm is preset with a basic set. The optimized application set is obtained through the following steps:

[0098] Set an initial baseline threshold Nbase, which is the basic reference value for application set screening to ensure that the filtered rules meet at least certain baseline requirements. The optimized threshold is Y, which is used to determine the optimized application set. The baseline threshold Nbase refers to the priority of the rules filtered from the basic set that must meet at least Nbase. Nbase and Y are both percentages and meet the following requirements:

[0099] Y = Nbase + αk*w1*SZ + βk*w2*IZ; SZ is the state change monitoring index, IZ is the network attack threat index, w1 and w2 are preset scaling coefficients, specifically: The scaling coefficients for the state change monitoring index and the network attack threat index, respectively, reflect the relative importance of these two indices in the adjustment process. αk and βk are preset adjustment coefficients corresponding to the detection algorithm type k, used to adjust the adaptability of different detection algorithms. Different algorithms may have different adjustment coefficients to suit different scenarios. The base set is then filtered based on the optimized threshold Y to obtain the optimized application set. This formula combines the state change monitoring index and the network attack threat index, balancing their impact through the adjustment coefficient and scaling coefficient to calculate the threshold Y for the optimized application set. When the state fluctuates or the threat index is high, a more stringent application set is selected to improve detection sensitivity and accuracy.

[0100] For example, a target algorithm has a pre-set base set: a rule set in a rule-based detection algorithm, a statistical parameter set in a statistics-based detection algorithm, and a feature set in a machine learning-based detection algorithm. The base threshold, Nbase, refers to the minimum priority that must be met by the rules selected from the base set. Priority here can be understood as the degree of impact on the anomaly. Specifically, priority reflects the importance or urgency of each rule in detecting abnormal behavior, and is generally associated with the degree to which the abnormal behavior addressed by the rule affects system stability or security.

[0101] To illustrate this more concretely, let's take the rule set in a rule-based detection algorithm as an example:

[0102] In a rule-based detection algorithm, a set of rules is predefined, where each rule is used to detect a specific type of anomaly. For example, a rule set may contain the following detection rules:

[0103] Rule 1: Detects frequent unauthorized access attempts; Rule 2: Detects sudden increases in abnormal traffic; Rule 3: Detects the frequency of port scanning; Rule 4: Detects prolonged periods of high load; Rule 5: Detects repeated abnormal response times. Each rule has a priority, which indicates the potential impact of the abnormality it corresponds to on the system. For example, Rule 1 might have a higher priority because unauthorized access attempts could be a direct signal of an attacker's intrusion attempt, posing a significant threat to system security. Rule 2 might have a slightly lower, but still high, priority because an abnormal increase in traffic could indicate a traffic anomaly and have a significant impact on system performance. Rule 5 might have a relatively low priority because abnormal response times might only be a performance issue, with little impact on security.

[0104] The baseline threshold, Nbase, is used to filter out rules in the rule set with a priority greater than or equal to Nbase. For example, if Nbase = 70%, only rules that meet at least 70% of the priority levels are selected for inclusion in the detection application set. By setting the baseline threshold, Nbase, the present invention can dynamically adjust the rule set to address different risks and needs. When the industrial control network is at high risk, Nbase can be lowered to include more rules and expand the detection scope. When the industrial control network is stable, Nbase can be increased to reduce interference from lower-priority rules, thereby saving resources.

[0105] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0106] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0107] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0108] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0109] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for detecting and responding to abnormal behavior in an industrial control network, characterized in that: The following steps are involved: Collecting state change information of the industrial control network to obtain information set 1, and generating a state change monitoring index based on the information set 1; Collecting network attack information of the industrial control network to obtain information set 2, and generating a network attack threat index based on the information set 2; Based on the state change monitoring index and network attack threat index, different detection algorithms are dynamically selected to achieve real-time detection and response of abnormal behaviors. When the type of detection algorithm is selected, the application set of the type of detection algorithm is adaptively optimized and applied; The state change monitoring index is calculated based on the total traffic, response time and equipment load of the industrial control network in information set 1, reflecting the state fluctuation degree of the industrial control network; The logic for obtaining the status change monitoring index is: Assume that the total flow of the industrial control network is F(t), the response time is R(t), the equipment load is L(t), and t is the time point; Calculate the flow difference sequence ΔF(t): ΔF(t)=F(t)-F(t-1); In order to reflect the flow fluctuation amplitude, the absolute value of the difference sequence in the time window W is accumulated and summed to obtain the cumulative deviation value of the difference sequence: ; i represents each time point from tW to t, t represents the current time point, is the cumulative deviation value; The natural logarithm of the cumulative deviation is used to enhance the sensitivity to abnormal flow fluctuations, and the flow fluctuation coefficient is defined as: ; is the flow fluctuation coefficient; The response time fluctuation is measured by the deviation rate method. The response time deviation rate sequence is obtained by calculating the change rate and standard deviation of the response time within the window. : ; The absolute value of the response time deviation rate is summed within the time window W to obtain the cumulative value of response time fluctuation: ; is the cumulative value of response time fluctuation; The response time fluctuation coefficient is defined as the ratio of the cumulative value of response time fluctuation to the mean square error of the response time in window W: ; is the response time fluctuation coefficient, is the mean square error of response time within window W; The fluctuation of equipment load is measured by relative proportion, that is, the ratio of the load difference to the maximum load, and the differential proportion sequence ΔL(t) is defined as: ; is a preset non-zero constant; Calculate the variance of the equipment load differential ratio within the time window W To obtain the load fluctuation degree: ; is the average value of the load difference ratio within the window W, and then defines the equipment load fluctuation coefficient is the variance of the device load differential ratio The square root of Calculate equipment load fluctuation coefficient , flow fluctuation coefficient , and the response time fluctuation coefficient The geometric mean of is used to obtain the state change monitoring index; The network attack threat index is calculated based on abnormal traffic, port scanning behavior, and unauthorized access times of the industrial control network in Information Set 2, and quantifies the current network attack threat level. The logic for obtaining the network attack threat index is as follows: Assume that abnormal traffic is A(t), the number of port scanning behaviors is S(t), the number of unauthorized accesses is U(t), and t is the time point; In the time window W, calculate the index and : ； The index of abnormal traffic and The ratio is processed with the average flow of window W to reflect the threat level of abnormal flow and obtain the abnormal flow fluctuation coefficient : ; ; represents the average flow in window W; In the window W, the logarithm of the number of times each port scan is performed is taken and accumulated to obtain the cumulative port scan value : ; Calculate port scanning behavior fluctuation coefficient : ; represents the average number of scanning behaviors in window W; Calculate the cumulative unauthorized access value : ; Calculate the unauthorized access fluctuation coefficient : ; represents the average number of unauthorized accesses in window W; Calculate the unauthorized access fluctuation coefficient , Abnormal flow fluctuation coefficient , and the port scanning behavior fluctuation coefficient The geometric mean of is used to obtain the network attack threat index.

2. The method for detecting and responding to abnormal behavior in an industrial control network according to claim 1, wherein: When making judgments based on the state change monitoring index and the network attack threat index, fuzzy logic is used to judge the combination of the state change monitoring index and the network attack threat index to generate a corresponding detection algorithm selection signal.

3. The method for detecting and responding to abnormal behavior in an industrial control network according to claim 2, wherein: There are three detection algorithm selection signals, corresponding to three types of detection algorithms, namely: rule-based detection algorithm, statistics-based detection algorithm, and machine learning-based detection algorithm.

4. The method for detecting and responding to abnormal behavior in an industrial control network according to claim 1, wherein: Fuzzy logic judgment refers to: The state change monitoring index and the network attack threat index are obtained separately and used as input variables. The type of detection algorithm used to detect abnormal behavior is used as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the adaptability of the three types of detection algorithms under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to determine the type of detection algorithm used to detect abnormal behavior.

5. The method for detecting and responding to abnormal behavior in an industrial control network according to claim 4, wherein: The type of the selected detection algorithm is the target algorithm. The target algorithm is preset with a basic set. The optimized application set is obtained through the following steps: Set an initial baseline threshold Nbase and an optimized threshold Y. The baseline threshold Nbase means that the rules selected from the base set must meet a priority of at least Nbase. Nbase and Y are both percentages and must meet the following requirements: ; is the state change monitoring index, is the cyber attack threat index, 、 are the preset proportional coefficients, and They are all preset adjustment coefficients corresponding to the type number k of the detection algorithm. Then, the basic set is screened according to the optimized threshold Y to obtain the optimized application set.

Images