Network traffic filtering method and management device based on auto-encoder and rule engine

Abstract

The invention discloses a network traffic filtering method and management device based on an auto-encoder and a rule engine, and relates to the technical field of industrial control system security, and the overall idea is to collect network traffic in an industrial control system, obtain a network data packet of an industrial control protocol and perform protocol analysis; the method comprises the following steps: extracting data of all sensors and actuators, then classifying, coding, disrupting and splicing the data to form a comprehensive matrix, training an auto-encoder model by using comprehensive matrix data in a normal operation state, converting the data of the sensors and the actuators at the current moment t into the comprehensive matrix, inputting the comprehensive matrix into the trained auto-encoder model, and finally, carrying out self-encoding on the data of the sensors and the actuators. And finally, further filtering the traffic by using a rule engine, and applying a rule set by a user to ensure that the traffic conforms to a security policy of the industrial control system. According to the method, the security and applicability of the system are ensured by setting and verifying the traffic filtering rule in combination with the anomaly detection capability of the auto-encoder and the flexible management of the rule engine.

Description

Technical Field

[0001] The present invention relates to the field of industrial control system security technology, and in particular to a network traffic filtering method and management device based on an autoencoder and a rule engine. Background Art

[0002] As a deep learning technology for unsupervised learning, autoencoders have achieved remarkable results in the field of anomaly detection. The core principle of autoencoders is to encode input data through a neural network, compress it to a low-dimensional representation (encoding), and then restore it to the original dimension (decoding) through a decoder. This encoding-decoding process can learn the intrinsic characteristics and patterns of the data, especially those that can effectively reconstruct the input data. In practical applications, autoencoders can capture the distribution and characteristics of normal data through training, so that the reconstruction error of normal data is small during the reconstruction process. When the input data contains abnormal data, the reconstruction error will increase significantly because the abnormal data does not conform to the normal pattern learned during training. Based on this feature, the autoencoder can identify abnormal data by detecting the reconstruction error. Specifically, when the reconstruction error exceeds a predetermined threshold, the data can be judged as abnormal, thereby achieving effective detection of abnormal data.

[0003] Industrial control systems (ICS) are key to modern industrial production and social infrastructure, and are related to production efficiency and public safety. However, due to various factors, ICS may experience anomalies, which, if not handled in a timely manner, will threaten equipment, production, and personnel safety. Therefore, anomaly detection is crucial for ICS. By real-time monitoring and analyzing data, anomaly detection technology can warn of potential risks and improve system reliability and operational efficiency. In ICS anomaly detection, traditional methods mainly rely on predefined rules and statistical analysis.

[0004] However, these methods have certain limitations. First, the formulation of rules relies on expert knowledge and historical data, which makes it difficult to cover all possible abnormal situations. Second, as the scale and complexity of industrial control systems increase, it is difficult to effectively deal with complex and changing abnormal patterns by relying solely on rules and statistical analysis.

[0005] Therefore, it is necessary to design a network traffic filtering method and management device based on an autoencoder and a rule engine to solve the above problems. Summary of the invention

[0006] The technical problem to be solved by the present invention is to solve the deficiencies in the prior art, design a network traffic filtering method and management device based on an autoencoder and a rule engine, and the purpose of the present invention is to provide an industrial control system network traffic filtering and management device based on an autoencoder and a rule engine, which combines the anomaly detection capability of the autoencoder and the flexible management of the rule engine, and ensures the security and applicability of the system by setting and verifying traffic filtering rules. By adding the demand matching function of the rules, the effectiveness of the rules can be further improved to ensure that they can meet the current network security needs. The limitations of traditional methods in anomaly detection are solved, the accuracy and reliability of detection are improved, and a strong guarantee is provided for the safe operation of industrial control systems.

[0007] The solution adopted by the present invention to solve the technical problem is:

[0008] A network traffic filtering method based on an autoencoder and a rule engine, applied to an industrial control system, comprises the following steps:

[0009] Step S1: Collect network traffic in the industrial control system, obtain network data packets of the industrial control protocol, capture data frames after preliminary parsing of the data packets, decode the captured data frames, and extract the real-time status values ​​of each sensor and actuator in the industrial control system at a specific time point t Where j represents the jth device in the current industrial control system;

[0010] Step S2: classify and sort the sensor data and actuator data according to the functions of the devices and the physical quantities monitored, and construct feature vectors based on the classification of the devices to represent the data of the same type of devices;

[0011] Step S3: Combine each feature vector into an integrated data matrix in a logical order from part to whole, denoted as the unit coding matrix Z;

[0012] Step S4: The unit code vectors in the unit code matrix Z are recorded as V1, V2, ..., Vi, and a hash algorithm is used to calculate a hash value for each unit code vector Vi to obtain H(Vi);

[0013] Step S5: Use a hash algorithm to sort all unit code vectors Vi according to their hash values ​​H(Vi), and the sorted result is the shuffled unit code matrix;

[0014] Step S6: Repeat steps S4 and S5 multiple times, and form a new random unit code matrix after each shuffling;

[0015] Step S7: performing channel splicing on the obtained random unit coding matrix to form a three-dimensional matrix E;

[0016] Step S8: Based on the sensor and actuator data collected at each time t, the data collection and processing steps described in steps S1 to S7 are used to obtain the comprehensive matrix Et at the corresponding time;

[0017] Step S9: associate a sample label yt with each comprehensive matrix Et, which indicates the operating status of the industrial control system at time t. If the operation is normal, yt = 1, otherwise yt = 0;

[0018] Step S10: Repeat the above steps to collect and process data at multiple times, obtain a series of comprehensive matrices and corresponding sample labels, and construct a training data set D;

[0019] Step S11: select and construct an autoencoder model, and iteratively train the autoencoder model;

[0020] Step S12: Setting a rule management device;

[0021] Step S13: Input the comprehensive matrix Et into the trained autoencoder model. If the model output is 1, it means that the system operates normally, otherwise it is abnormal.

[0022] Step S14: Use the rule engine to further filter the network traffic and apply the rules set by the user to ensure that the traffic complies with the security policy of the industrial control system.

[0023] As a preferred implementation of the present invention, the autoencoder model in step S11 consists of two parts: an encoder and a decoder. The encoder maps the input data to a low-dimensional representation, and the decoder reconstructs the input data from the low-dimensional representation.

[0024] As a preferred implementation of the present invention, the input data is the comprehensive matrix Et in the training data set D.

[0025] As a preferred embodiment of the present invention, the mean square error (MSE) is used as the loss function in the iterative training process of the autoencoder model generated in step S11:

[0026]

[0027] Among them, Et is the original input comprehensive matrix, Reconstructed synthesis matrix for the autoencoder.

[0028] As a preferred embodiment of the present invention, the back propagation algorithm is used to calculate the gradient of the loss function during the iterative training of the autoencoder model generated in step S11, and the model parameters are adjusted to minimize the loss:

[0029]

[0030] Among them, θ is the model parameter and η is the learning rate.

[0031] As a preferred implementation of the present invention, the physical quantity monitored in step S2 includes the voltage, current or power of the monitoring device.

[0032] As a preferred implementation of the present invention, the standard hash function SHA-256 is used to generate a hash value during the hash calculation in step S4.

[0033] As a preferred implementation of the present invention, the rule management device in step S12 includes:

[0034] Rule setting module, which sets and modifies traffic filtering rules by using regular expressions;

[0035] The rule verification module performs syntax checks on the set rules to ensure the correctness of the rules;

[0036] The demand matching module uses machine learning models to analyze rules to ensure that the rules meet current network security requirements. It also analyzes historical data and attack patterns to determine whether the rules can effectively detect and prevent known attacks.

[0037] Beneficial effects: The present invention provides an industrial control system network traffic filtering and management device based on an autoencoder and a rule engine. By automatically learning data features and flexibly managing traffic filtering rules, the system's anomaly detection accuracy and reliability are significantly improved, the system is adaptable to a variety of industrial control protocols, and has high real-time monitoring and early warning capabilities, thereby enhancing the system's stability and security while maintaining low model complexity and high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A flowchart of a network traffic filtering method based on an autoencoder and a rule engine proposed by the present invention;

[0039] Figure 2 This is a structural diagram of the network traffic management device based on the autoencoder and rule engine proposed by the present invention. DETAILED DESCRIPTION

[0040] The specific implementation of the present invention is described below in conjunction with the accompanying drawings and embodiments:

[0041] It should be noted that the structures, colors, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification so that people familiar with this technology can understand and read them, and are not used to limit the conditions under which the present invention can be implemented. Any structural modification, change in proportional relationship or adjustment of size should still fall within the scope of the technical content disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0042] The overall idea of ​​the present invention is to first collect network traffic in the industrial control system and obtain network data packets of industrial control protocols such as IEC102 and IEC104. Then, these data packets are parsed to extract the data of all sensors and actuators at time t, and then they are classified, encoded, shuffled and spliced ​​according to device type and measurement or control physical quantity category to form a comprehensive matrix. The comprehensive matrix data under normal operation is used to train the autoencoder model.

[0043] The autoencoder reconstructs the input data by learning the low-dimensional representation of the data. The reconstruction error is used as the loss function during the training process, and the model parameters are adjusted through the back-propagation algorithm. At the same time, a network traffic management device based on the autoencoder and the rule engine is designed, which includes the rule setting, rule verification and demand matching modules and implements the corresponding rule setting, rule verification and demand matching functions to ensure the correctness and applicability of the rules.

[0044] The sensor and actuator data at the current time t are converted into a comprehensive matrix and input into the trained autoencoder model. The reconstruction error is calculated. If the reconstruction error exceeds the predetermined threshold, it indicates that the traffic is abnormal and filtering is performed; otherwise, the traffic is allowed to pass.

[0045] Finally, the traffic is further filtered using a rules engine, applying user-defined rules to ensure that the traffic complies with the security policy of the industrial control system.

[0046] In summary, the present invention combines the anomaly detection capability of the autoencoder with the flexible management of the rule engine to ensure the security and applicability of the system by setting and verifying traffic filtering rules. By adding the demand matching function of the rules, the effectiveness of the rules can be further improved to ensure that they can meet the current network security needs.

[0047] like Figure 1 As shown, the network traffic filtering method based on the autoencoder and the rule engine of the present invention comprises the following steps:

[0048] Step S1: Collect network traffic in the industrial control system, obtain network data packets of industrial control protocols such as IEC102 and IEC104, initially parse the data packets and capture the data frames, decode the captured data frames, and extract the real-time status values ​​of each sensor and actuator in the industrial control system at a specific time point t. Where j represents the jth device in the current industrial control system;

[0049] Step S2: classify and sort the sensor data and actuator data according to the function of the device and the physical quantity monitored (such as the voltage, current or power of the monitored device), and construct a feature vector based on the classification of the device to represent the data of the same type of device;

[0050] Step S3: Combine each feature vector into an integrated data matrix in a logical order from part to whole, denoted as the unit coding matrix Z;

[0051] Step S4: The unit code vectors in the unit code matrix Z are recorded as V1, V2, ..., Vi, and a hash algorithm is used to generate a hash value using the standard hash function SHA-256. The hash value is calculated for each unit code vector Vi to obtain H(Vi);

[0052] Step S5: Use a hash algorithm to sort all unit code vectors Vi in sequence according to their hash values ​​H(Vi). The sorted result is the shuffled unit code matrix. For example, if the order of the sorted hash values ​​is H(V3), H(V1), H(V5), ..., then the sorted unit code matrix is ​​V3, V1, V5, ...;

[0053] Step S6: Repeat steps S4 and S5 multiple times, and form a new random unit code matrix after each shuffling;

[0054] Step S7: After completing multiple shuffles, the obtained random unit coding matrix is ​​channel-joined to form a three-dimensional matrix E;

[0055] Step S8: Based on the sensor and actuator data collected at each time t, the data collection and processing steps described in steps S1 to S7 are used to obtain the comprehensive matrix Et at the corresponding time;

[0056] Step S9: Associate a sample label yt with each comprehensive matrix Et, where yt represents the operating status label of the industrial control system at time t. It represents the operating status of the industrial control system at time t, yt = 1 when the operation is normal, otherwise yt = 0;

[0057] Step S10: Repeat the above steps to collect and process data at multiple times, obtain a series of comprehensive matrices and corresponding sample labels, and construct a training data set D;

[0058] Step S11: Select and build an autoencoder model, and then iteratively train the autoencoder model. The autoencoder consists of two parts: the encoder and the decoder. The encoder maps the input data to a low-dimensional representation, and the decoder reconstructs the input data from the low-dimensional representation.

[0059] The comprehensive matrix Et in the training data set D is used as input data;

[0060] Step S12: Setting a rule management device;

[0061] Step S13: Input the comprehensive matrix Et into the trained autoencoder model. If the model output is 1, it means that the system operates normally, otherwise it is abnormal.

[0062] Step S14: Use the rule engine to further filter the network traffic and apply the rules set by the user to ensure that the traffic complies with the security policy of the industrial control system.

[0063] In summary, steps S1 to S10 are data preprocessing processes. In the real-time monitoring stage, the network traffic at the current time t is collected, and the protocol is parsed to obtain the data of the sensor and actuator. According to steps S1 to S8, Zt is converted into a comprehensive matrix Et, and then input into the trained autoencoder model. If the model output is 1, it means that the system is running normally, otherwise it is abnormal.

[0064] The mean square error (MSE) is used as the loss function during the iterative training of the autoencoder model generated in step S11:

[0065]

[0066] Among them, Et is the original input comprehensive matrix, The comprehensive matrix reconstructed for the autoencoder;

[0067] The back propagation algorithm is used to calculate the gradient of the loss function during the iterative training of the autoencoder model generated in step S11, and the model parameters are adjusted to minimize the loss:

[0068]

[0069] Among them, θ is the model parameter so that the model can fit the data more accurately and make predictions, and η is the learning rate used to control the step size of the model to update the parameters in each iteration;

[0070] The rule management device provided in step S12 includes:

[0071] A rule setting module 101 implements a rule setting function by setting and modifying traffic filtering rules using regular expressions;

[0072] The rule verification module 102 performs a grammar check on the set rules to ensure the correctness of the rules and implement the rule verification function;

[0073] The demand matching module 103 uses a machine learning model to analyze the rules to ensure that the rules meet the current network security requirements. Through historical data and attack pattern analysis, it determines whether the rules can effectively detect and prevent known attacks to achieve the demand matching function.

[0074] The preferred embodiments of the present invention are described in detail above in conjunction with the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention.

[0075] Many other changes and modifications may be made without departing from the concept and scope of the present invention.It should be understood that the present invention is not limited to the specific embodiments, and the scope of the present invention is defined by the appended claims.

Claims

1. A network traffic filtering method based on an autoencoder and a rule engine, characterized in that: Applied to industrial control systems, including the following steps: Step S1: Collect network traffic in the industrial control system, obtain network data packets of the industrial control protocol, capture data frames after preliminary parsing of the data packets, decode the captured data frames, and extract the real-time status values ​​of each sensor and actuator in the industrial control system at a specific time point t Where j represents the jth device in the current industrial control system; Step S2: classify and sort the sensor data and actuator data according to the functions of the devices and the physical quantities monitored, and construct feature vectors based on the classification of the devices to represent the data of the same type of devices; Step S3: Combine each feature vector into an integrated data matrix in a logical order from part to whole, denoted as the unit coding matrix Z; Step S4: The unit code vectors in the unit code matrix Z are recorded as V1, V2, ..., Vi, and a hash algorithm is used to calculate a hash value for each unit code vector Vi to obtain H(Vi); Step S5: Use a hash algorithm to sort all unit code vectors Vi according to their hash values ​​H(Vi), and the sorted result is the shuffled unit code matrix; Step S6: Repeat steps S4 and S5 multiple times, and form a new random unit code matrix after each shuffling; Step S7: performing channel splicing on the obtained random unit coding matrix to form a three-dimensional matrix E; Step S8: Based on the sensor and actuator data collected at each time t, the data collection and processing steps described in steps S1 to S7 are used to obtain the comprehensive matrix Et at the corresponding time; Step S9: associate a sample label yt with each comprehensive matrix Et, which indicates the operating status of the industrial control system at time t. If the operation is normal, yt = 1, otherwise yt = 0; Step S10: Repeat the above steps to collect and process data at multiple times, obtain a series of comprehensive matrices and corresponding sample labels, and construct a training data set ZZD; Step S11: Select and build an autoencoder model, and iteratively train the autoencoder model using a training data set D; Step S12: Setting a rule management device; Step S13: Input the comprehensive matrix Et into the trained autoencoder model. If the model output is 1, it means that the system is running normally, otherwise it is abnormal. Step S14: Use the rule engine to further filter the network traffic and apply the rules set by the user to ensure that the traffic complies with the security policy of the industrial control system.

2. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 1, characterized in that: In step S11, the autoencoder model consists of two parts: an encoder and a decoder. The encoder maps the input data to a low-dimensional representation, and the decoder reconstructs the input data from the low-dimensional representation.

3. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 2, characterized in that: The input data is the comprehensive matrix Et in the training data set D.

4. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 3, characterized in that: The mean square error (MSE) is used as the loss function during the iterative training of the autoencoder model generated in step S11: Among them, Et is the original input comprehensive matrix, Reconstructed synthesis matrix for the autoencoder.

5. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 4, characterized in that: The back propagation algorithm is used to calculate the gradient of the loss function during the iterative training of the autoencoder model generated in step S11, and the model parameters are adjusted to minimize the loss: Among them, θ is the model parameter and η is the learning rate.

6. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 1, characterized in that: The physical quantity monitored in step S2 includes the voltage, current or power of the monitoring device.

7. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 1, characterized in that: The hash value is generated by using the standard hash function SHA-256 during the hash calculation in step S4.

8. A network traffic filtering method based on an autoencoder and a rule engine as claimed in claim 1, characterized in that: The rule management device in step S12 includes: Rule setting module, which sets and modifies traffic filtering rules by using regular expressions; The rule verification module performs syntax checks on the set rules to ensure the correctness of the rules; The demand matching module uses machine learning models to analyze rules to ensure that the rules meet current network security requirements. It also analyzes historical data and attack patterns to determine whether the rules can effectively detect and prevent known attacks.

Images