Industrial control system anomaly detection method based on protocol field vector similarity

Abstract

The invention relates to an industrial control system anomaly detection method based on protocol field vector similarity, and the method comprises the following specific steps: continuously collecting protocol messages in an industrial control system, and carrying out the protocol analysis of the protocol messages; and training a triplet network prepared in advance by using the training data set to obtain a trained industrial control system anomaly detection model. Protocol messages in the industrial control system are collected in real time, and protocol analysis is carried out on the protocol messages. According to the triplet model training and industrial control anomaly detection method, the collected industrial control protocol data is processed to obtain the stacking vectors, and when the stacking vectors are sorted according to the time sequence, the correlation of the three continuous stacking vectors can just meet the optimization target rule of a triple loss function in a triplet network, so that the triplet model training and industrial control anomaly detection method is designed. The problem that an existing industrial control system anomaly detection method based on unsupervised learning is not high in detection precision is solved, and the industrial control system anomaly detection method based on protocol field vector similarity is provided.

Description

Technical Field

[0001] The present invention relates to the field of industrial control system security technology, and in particular to an industrial control system anomaly detection method based on protocol field vector similarity. Background Art

[0002] In today's highly automated industrial environment, the security and stability of industrial control systems (ICS) are of vital importance to ensuring production efficiency and preventing catastrophic accidents. Anomaly detection, as a key component of ICS security, can identify abnormal behavior of the system in real time, so that timely measures can be taken to prevent accidents.

[0003] Existing anomaly detection methods based on machine learning, such as support vector machines, decision trees, and neural networks, build models by learning data from normal operations and then identify abnormal behaviors. However, most of the existing methods are supervised learning methods. Although some studies have successfully used unsupervised learning algorithms for anomaly detection, their accuracy is poor. For industrial control systems with scarce abnormal data, studying more effective unsupervised learning anomaly detection algorithms has important practical significance and application value. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an industrial control system anomaly detection method based on protocol field vector similarity, by processing the collected industrial control protocol data to obtain stacked vectors, and utilizing the rule that when the stacked vectors are sorted in chronological order, the correlation of three consecutive stacked vectors can just meet the optimization target of the triplet loss function in the triplet network, and designing a triplet model training and industrial control anomaly detection method. The problem of low detection accuracy of the existing industrial control system anomaly detection method based on unsupervised learning is solved.

[0005] To achieve the above object, the present invention adopts the following technical solution: an industrial control system anomaly detection method based on protocol field vector similarity, comprising the following specific steps:

[0006] Step 1: In the data collection stage, when the industrial control system is operating normally, the protocol messages in the industrial control system are continuously collected and the protocol is parsed;

[0007] Step 2: For each industrial control protocol TCP data packet, parse to obtain a parsing result vector PV = [a1, a2, ..., a q ,], where q is the length of the current parsing result vector;

[0008] Step 3: For each parsing result vector, obtain its length q, fill it with 0 values ​​at the end, and the number of filled 0s is Nq, to ​​obtain the field vector v; where N is the length of each field vector;

[0009] Step 4: According to the method of step 1 to step 3, multiple field vectors are obtained to form an ordered field vector set S = {v i |i∈Z, 0<i≤P}; where Z is a set of positive integers, P is the total number of field vectors in the set, v i represents the i-th field vector;

[0010] Step 5: Divide the field vectors in the set S into groups of 3 in order to obtain multiple stacked vectors V. The i-th stacked vector is represented as V i =(v i , v i+1 , v i+2 );

[0011] Step 6: Multiple stacked vectors form an ordered stacked vector set S stack = {V i |i∈Z, 0<i≤P-2};

[0012] Step 7: Set S stack Each 3 stacked vectors in are combined, and the interval number of the stacked vector sequence number is 3, forming a single training sample X i =(V i , V i+3 , V i+6 ), where i represents the serial number of the sample;

[0013] Step 8: The purpose of vector stacking is to make each sample more completely represent the characteristics of the industrial control protocol:

[0014] Step 9: Multiple training samples form a training data set D = {X i |i∈Z, 0<i≤C}; where C is the total number of samples in the training data set;

[0015] Step 10: In the model training phase, the training data set is used to train the prepared triplet network; the triplet network consists of three convolutional neural networks that share model parameters and a triplet loss function; the dimension of the input data of each convolutional neural network is c×h×w, where c represents the number of channels of the input data. According to the description in step 5, c is the number of field vectors in the stacked vector, c=3; h represents the length of the input data, which is fixed to 1; w represents the width of the input data, w=N, where N is the length of each field vector;

[0016] Step 11: Train the triplet network using triplet loss, which defines negative samples, positive samples, and anchor points.

[0017] Step 12: The mathematical expression of the triplet loss function L is as follows:

[0018] L(a,p,n)=max(0,d(a,p)-d(a,n)+α),

[0019] Where a represents the anchor point, p represents the positive sample, and n represents the negative sample; d(x, y) is the distance between samples x and y; α is a hyperparameter that represents the minimum interval between positive and negative samples; the mathematical expression of d(x, y) is as follows:

[0020]

[0021] where x and y are n-dimensional feature vectors; i Indicates taking the i-th value of vector x, y i It means taking the i-th value of vector y;

[0022] Step 13: Take training samples X=(V a , V b , V c ), where a, b, c are the subscripts of the stacked vectors in the sample, and their relationship is as shown in step 7;

[0023] Step 14: Since all stacked vectors are sorted in time order, V c With V b The correlation is greater than V c With V a ; Therefore, according to the rules described in step 11, V a , V b , V c They correspond to negative samples, positive samples and anchor points in the triplet network respectively;

[0024] Step 15: V a , V b , V c Input the triplet network respectively, where the convolutional neural network outputs three n-dimensional feature vectors n, p, a;

[0025] Step 16: Calculate the loss value L(a, p, n) of the feature vector n, p, a by the triple loss function in step 12;

[0026] Step 17: Use the stochastic gradient descent method to update the parameters of the current model to obtain the updated parameters θ of the convolutional neural network model. new :

[0027]

[0028] Where η is the learning rate;

[0029] Step 18: Repeat steps 10 to 17 until the loss L(a, p, n) is less than the set threshold, or the number of iterations reaches the maximum set number; the trained anomaly detection model M is obtained;

[0030] Step 19: In the anomaly detection stage, protocol messages in the industrial control system are collected and processed in real time according to the methods of steps 1 to 4;

[0031] Step 20: Follow the methods from step 5 to step 7 to perform the field vector S t Processing is performed to obtain the detection sample X at time t t =(V t , V t+3 , V t+6 );

[0032] Step 21: Input the test sample into the trained anomaly detection model. If the loss value output by the model is greater than T, it means that the current industrial control system is abnormal, otherwise it is normal; where T is the anomaly detection threshold.

[0033] In a preferred embodiment, the parsing result vector in step 2 is composed of different protocol fields.

[0034] In a preferred embodiment, in step 19, if it is in the initial stage of anomaly detection, firstly, 9 field vectors are collected to form a field vector set S at time t. t ; If it is in the initial stage of non-anomaly detection, first set the previous field vector set S t-1 The first field vector in is removed, and then the field vector at the current time t is added to the end of the set to obtain the field vector set S t .

[0035] Compared with the prior art, the present invention has the following beneficial effects: the present invention processes the collected industrial control protocol data to obtain stacked vectors, and utilizes the rule that when the stacked vectors are sorted in chronological order, the correlation of three consecutive stacked vectors can just meet the optimization target of the triplet loss function in the triplet network, and designs a triplet model training and industrial control anomaly detection method. The problem of low detection accuracy of the existing industrial control system anomaly detection method based on unsupervised learning is solved, and an industrial control system anomaly detection method based on protocol field vector similarity is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of an industrial control system anomaly detection method based on protocol field vector similarity is provided for the application.

[0037] Figure 2A triplet model structure diagram of an industrial control system anomaly detection method based on protocol field vector similarity provided for the application. DETAILED DESCRIPTION

[0038] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0039] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0040] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0041] The basic idea of ​​the present invention is that, in the data collection stage, the protocol messages in the industrial control system are continuously collected, the protocol messages are parsed, and the parsed data are padded according to the length of the parsed data to obtain multiple field vectors, which constitute a field vector set, and the field vectors in the set are divided into groups of 3 in order to obtain multiple stacked vectors. According to the rules of the triplet network, each 3 stacked vectors constitute a single training sample, and multiple training samples constitute a training data set. In the model training stage, the training data set is used to train the triplet network prepared in advance to obtain a trained industrial control system anomaly detection model. In the anomaly detection stage, the protocol messages in the industrial control system are collected in real time, the protocol messages are parsed, and the parsed data are padded according to the length of the parsed data to obtain multiple field vectors. According to the division rules of the data collection stage, every 9 field vectors constitute 3 stacked vectors to form a detection sample, and the detection sample is input into the trained anomaly detection model. If the output of the anomaly detection model is greater than the threshold T, it means that the current industrial control system is abnormal. The present invention processes the collected industrial control protocol data to obtain stacked vectors, and utilizes the rule that when the stacked vectors are sorted in chronological order, the correlation of three consecutive stacked vectors can just meet the optimization target of the triplet loss function in the triplet network, and designs a triplet model training and industrial control anomaly detection method. The problem of low detection accuracy of the existing industrial control system anomaly detection method based on unsupervised learning is solved, and an industrial control system anomaly detection method based on protocol field vector similarity is provided.

[0042] like Figure 1-2As shown, the present invention provides an industrial control system anomaly detection method based on protocol field vector similarity, comprising the following steps:

[0043] (1) In the data collection stage, when the industrial control system is operating normally, the protocol messages in the industrial control system are continuously collected and the protocol is parsed.

[0044] (2) For each industrial control protocol TCP data packet, a parsing result vector PV = [a1, a2, ..., a q ,], where q is the length of the current parsing result vector. The parsing result vector is composed of different protocol fields, for example, the protocol fields of the Modbus TCP protocol include address, function code, data, exception code, and checksum.

[0045] (3) For each parsing result vector, obtain its length q, fill it with 0 values ​​at the end, and the number of filled 0s is Nq, to ​​obtain a field vector V. N is the length of each field vector.

[0046] (4) According to the method of step (1) to step (3), multiple field vectors are obtained to form an ordered field vector set S = {v i |i∈Z, 0<i≤P}. Where Z is a set of positive integers, P is the total number of field vectors in the set, v i Represents the i-th field vector.

[0047] (5) The field vectors in the set S are divided into groups of 3 in order to obtain multiple stacked vectors V. The i-th stacked vector is represented as V i =(v i , v i+1 , v i+2 ).

[0048] (6) Multiple stacked vectors form an ordered stacked vector set S stack = {V i |i∈Z, 0<i≤P-2}.

[0049] (7) Set S stack Each 3 stacked vectors in are combined, and the interval number of the stacked vector sequence number is 3, forming a single training sample X i =(V i , V i+3 , V i+6 ). Where i represents the serial number of the sample.

[0050] (8) The purpose of vector stacking is to make each sample more completely represent the characteristics of the industrial control protocol, and the purpose of setting the interval number of the stacked vector sequence number to 3 is to prevent the field vectors between each sample from intersecting.

[0051] (9) Multiple training samples constitute the training data set D = {X i |i∈Z, 0<i≤C}. Where C is the total number of samples in the training data set.

[0052] (10) In the model training phase, the training data set is used to train the triplet network prepared in advance. The structure of the triplet network is as follows: Figure 2 As shown in the figure, it consists of three convolutional neural networks that share model parameters and a triplet loss function. The dimension of the input data of each convolutional neural network is c×h×w, where c represents the number of channels of the input data. According to the description of step (5), c is the number of field vectors in the stacked vector, c=3. h represents the length of the input data, which is fixed to 1. w represents the width of the input data, w=N, where N is the length of each field vector.

[0053] (11) The present invention uses triplet loss to train the triplet network. The loss function defines negative samples (nagative), positive samples (postitive) and anchors (anchor). Its optimization goal is to make the negative samples as far away from the anchor as possible and the positive samples as close to the anchor as possible.

[0054] (12) The mathematical expression of the triplet loss function L is as follows:

[0055] L(a,p,n)=max(0,d(a,p)-d(a,n)+α),

[0056] Where a represents the anchor point, p represents the positive sample, and n represents the negative sample. d(x, y) is the distance between samples x and y. α is a hyperparameter that represents the minimum interval between positive and negative samples. The mathematical expression of d(x, y) is as follows:

[0057]

[0058] where x and y are n-dimensional feature vectors. i Indicates taking the i-th value of vector x, y i It means taking the i-th value of vector y.

[0059] (13) Take training samples X=(V a , V b , V c ), where a, b, c are the subscripts of the stacked vectors in the sample, and their relationship is shown in step (7).

[0060] (14) Since all stacked vectors are sorted in time order, V c With V b The correlation is greater than V c With Va Therefore, according to the rule described in step (11), V a , V b , V c They correspond to negative samples, positive samples and anchor points in the triplet network respectively.

[0061] (15) V a , V b , V c The three convolutional neural networks are input into the triplet network respectively, and the convolutional neural network outputs three n-dimensional feature vectors n, p, and a.

[0062] (16) Calculate the loss value L(a, p, n) of the feature vector n, p, a using the triple loss function in step (12).

[0063] (17) Use the stochastic gradient descent method to update the parameters of the current model to obtain the updated parameters θ of the convolutional neural network model new :

[0064]

[0065] Wherein η is the learning rate, which is 0.001 in this embodiment.

[0066] (18) Repeat steps (10) to (17) until the loss L(a, p, n) is less than the set threshold, or the number of iterations reaches the maximum set number. The trained anomaly detection model M is obtained.

[0067] (19) In the anomaly detection stage, the protocol messages in the industrial control system are collected and processed in real time according to the methods of steps (1) to (4). If it is in the initial stage of anomaly detection, first collect 9 field vectors to form the field vector set S at time t t If it is in the initial stage of non-anomaly detection, first set the previous field vector set S t-1 The first field vector in is removed, and then the field vector at the current time t is added to the end of the set to obtain the field vector set S t .

[0068] (20) According to the method of steps (5) to (7), the field vector S t Processing is performed to obtain the detection sample X at time t t =(V t , V t+3 , V t+6 ).

[0069] (21) Input the detection sample into the trained anomaly detection model. If the loss value output by the model is greater than T, it means that the current industrial control system is abnormal, otherwise it is normal. Where T is the anomaly detection threshold.

[0070] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting anomalies in industrial control systems based on protocol field vector similarity, characterized in that: The specific steps include: Step 1: In the data collection stage, when the industrial control system is operating normally, the protocol messages in the industrial control system are continuously collected and the protocol is parsed; Step 2: For each industrial control protocol TCP data packet, parse and obtain a parsing result vector PV = [a1, a2, ..., a q ,], where q is the length of the current parsing result vector; Step 3: For each parsing result vector, obtain its length q, fill it with 0 values ​​at the end, and the number of filled 0s is Nq, to ​​obtain the field vector v; where N is the length of each field vector; Step 4: According to the methods of Steps 1 to 3, obtain multiple field vectors, and form an ordered set of field vectors S = {v i | i ∈ Z, 0 < i ≤ P}; where Z is the set of positive integers, P is the total number of field vectors in the set, and v i represents the i-th field vector; Step 5: Divide the field vectors in the set S into groups of 3 in order to obtain multiple stacked vectors V. The i-th stacked vector is represented as V i =(v i ,v i+1 ,v i+2 ); Step 6: Multiple stacked vectors form an ordered stacked vector set S stack = {V i |i∈Z,0 <i≤P-2}; Step 7: Set S stack Each 3 stacked vectors in are combined, and the interval number of the stacked vector sequence number is 3, forming a single training sample X i =(V i ,V i+3 ,V i+6 ), where i represents the serial number of the sample; Step 8: The purpose of vector stacking is to make each sample more completely represent the characteristics of the industrial control protocol; Step 9: A plurality of training samples constitute a training data set D = {X i | i ∈ Z, 0 < i ≤ C}; where C is the total number of samples in the training data set; Step 10: In the model training phase, the training data set is used to train the prepared triplet network; the triplet network consists of three convolutional neural networks that share model parameters and a triplet loss function; the dimension of the input data of each convolutional neural network is c×h×w, where c represents the number of channels of the input data. According to the description in step 5, c is the number of field vectors in the stacked vector, c=3; h represents the length of the input data, which is fixed to 1; w represents the width of the input data, w=N, where N is the length of each field vector; Step 11: Train the triplet network using triplet loss, which defines negative samples, positive samples, and anchor points. Step 12: The mathematical expression of the triplet loss function L is as follows: L(a,p,n)=max(0,d(a,p)-d(a,n)+α), Where a represents the anchor point, p represents the positive sample, and n represents the negative sample; d(x,y) is the distance between samples x and y; α is a hyperparameter that represents the minimum interval between positive and negative samples; the mathematical expression of d(x,y) is as follows: where x and y are n-dimensional feature vectors; i Indicates taking the i-th value of vector x, y i It means taking the i-th value of vector y; Step 13: Take training samples X=(V a ,V b ,V c ), where a, b, c are the subscripts of the stacked vectors in the sample, and their relationship is as shown in step 7; Step 14: Since all stacked vectors are sorted in time order, V c With V b The correlation is greater than V c With V a ; Therefore, according to the rules described in step 11, V a ,V b ,V c They correspond to negative samples, positive samples and anchor points in the triplet network respectively; Step 15: V a ,V b ,V c Input the triplet network respectively, where the convolutional neural network outputs three n-dimensional feature vectors n, p, a; Step 16: Calculate the loss value L(a, p, n) of the feature vector n, p, a using the triple loss function in step 12; Step 17: Use the stochastic gradient descent method to update the parameters of the current model to obtain the updated parameters θ of the convolutional neural network model. new : Where η is the learning rate; Step 18: Repeat steps 10 to 17 until the loss L(a, p, n) is less than the set threshold, or the number of iterations reaches the maximum set number; the trained anomaly detection model M is obtained; Step 19: In the anomaly detection stage, protocol messages in the industrial control system are collected and processed in real time according to the methods of steps 1 to 4; Step 20: Follow the methods from step 5 to step 7 to perform the field vector S t Processing is performed to obtain the detection sample X at time t t =(V t ,V t+3 ,V t+6 ); Step 21: Input the test sample into the trained anomaly detection model. If the loss value output by the model is greater than T, it means that the current industrial control system is abnormal, otherwise it is normal; where T is the anomaly detection threshold.

2. According to claim 1, a method for detecting anomalies in an industrial control system based on protocol field vector similarity is characterized in that: The parsing result vector in step 2 is composed of different protocol fields.

3. The method for detecting anomalies in an industrial control system based on protocol field vector similarity according to claim 1 is characterized in that: In step 19, if it is in the initial stage of anomaly detection, firstly, 9 field vectors are collected to form a field vector set S at time t. t ; If it is in the initial stage of non-anomaly detection, first set the previous field vector set S t-1 The first field vector in is removed, and then the field vector at the current time t is added to the end of the set to obtain the field vector set S t .

Images