Intrusion detection method and device for distributed industrial control network, and medium

Abstract

The invention discloses an intrusion detection method and device for a distributed industrial control network, and a storage medium. The method comprises the following steps: a client performs feature engineering to obtain a training data set; configuring hyper-parameters; constructing an intrusion detection model; the server initializes model weight parameters; the server distributes the encrypted weight parameters; the client decrypts the weight parameters and carries out local iteration training to obtain the trained weight parameters; the client encrypts the weight parameters and sends the weight parameters to the server; the server aggregates the weight parameters to obtain updated weight parameters; verifying the updated weight parameters; judging whether the model training is finished according to a verification result; if not, repeating the model training and aggregation operation until the model training is finished; if so, the final weight parameter is encrypted and then is distributed to the client; and the client decodes the final weight parameter and updates a local intrusion detection model. According to the method, the data privacy can be effectively protected when the network intrusion behavior is detected.

Description

Technical Field

[0001] The present invention relates to the detection scope of intrusion attacks in a distributed industrial control network scenario, and more specifically to an intrusion detection method, device and medium for a distributed industrial control network. Background Art

[0002] At present, there are three main methods of intrusion detection technology in distributed industrial control network scenarios.

[0003] In the first method, a distributed information collection and centralized information analysis and processing model is used. This model mainly collects network behavior information, log information, etc. through information collection terminals deployed in each distributed industrial control network subnet, and uniformly summarizes them to a centralized information analysis and processing terminal for post-analysis and processing, and displays the analysis results by a unified terminal. The disadvantages of this method are very obvious: first, since each information collection terminal needs to uniformly summarize the collected information to the analysis and processing terminal, it is easy to cause excessive consumption of industrial control network bandwidth, thereby affecting normal business operations; second, in many distributed industrial control networks, the data in each industrial control subnet is often highly sensitive, and it is not allowed to let other industrial control subnets know at will to avoid serious data security accidents. However, this method requires each data collection terminal to uniformly summarize the data collected from each industrial control subnet to the analysis and processing terminal, which to a large extent means that the privacy of the data in each subnet cannot be guaranteed.

[0004] In the second method, the agent method is used to carry out distributed intrusion detection in industrial control networks, and each agent is implanted separately in the detection industrial control network. Since the agent has a certain intelligent processing capability, it can analyze, learn and detect autonomously. To a certain extent, it also uses some machine learning algorithms for intrusion attack detection, and then the analysis and detection results are unified and summarized to the center for result presentation. This method incorporates advanced processing technologies such as machine learning, which can improve the accuracy of intrusion attack detection in each industrial control subnet to a certain extent, but its shortcomings are also very prominent: that is, it is impossible to integrate and learn the behavioral characteristics of intrusion attack behaviors in each industrial control subnet under the premise of ensuring privacy and security, so when the attack behaviors of other industrial control subnets occur in this subnet, it is often difficult to detect them in time.

[0005] In the third method, the distributed intrusion detection learning algorithm based on MAS is shown in the attached figure. Figure 1As shown in the figure, it is not difficult to see from the architecture shown in the figure that the distributed intrusion detection technology based on MAS will set up multiple data flow collection probes (such as common intrusion detection systems) in each distributed industrial control subnet to collect industrial control network flow protocols or log data, and summarize the industrial control network data collected by multiple collection terminals to the corresponding algorithm analyzers for calculation and analysis processing. Finally, each algorithm analyzer will summarize the calculation and analysis results to the management terminal for result presentation or policy response. The advantage of this method is that it can integrate the attack characteristics of intrusion attack behaviors existing in different industrial control network subnets to a certain extent, and perform unified summary calculation and analysis in the algorithm analyzer. When the attack behaviors in different industrial control network subnets occur in other subnets, it can achieve the effect of timely detection. However, the limitations of this method are also obvious: first, it lacks protection for the privacy of attack behavior data in different industrial control network subnets under the jurisdiction of each algorithm analyzer; second, it cannot cover the attack behavior data in all industrial control network subnets, so that some intrusion attacks that occur in a certain industrial control network subnet are still difficult to detect accurately and promptly once they occur in other industrial control network subnets; finally, this method has the same shortcomings as the first method, that is, the detection of intrusion attack behaviors mainly relies on rule matching patterns. Although this detection method has a high detection rate for known attack behaviors, it cannot detect new unknown attack behaviors, which is still a major problem that it cannot solve.

[0006] Therefore, it is necessary to improve the intrusion detection technology in the current distributed industrial control network scenario. Summary of the invention

[0007] The object of the present invention is to provide an intrusion detection method, device and medium for a distributed industrial control network to solve at least one of the above-mentioned problems existing in the prior art.

[0008] In order to achieve the above technical objectives, the technical solution adopted by the present invention is as follows:

[0009] According to one aspect of the present invention, there is provided an intrusion detection method for a distributed industrial control network, comprising the following steps:

[0010] Step S1: generating a data set for describing the intrusion behavior of the industrial control network and the network behavior of the normal industrial control network on multiple industrial control network clients;

[0011] Step S2: configuring hyper parameters on the plurality of industrial control network clients and servers respectively;

[0012] Step S3: constructing an initial local intrusion detection model with the same structure on a plurality of the industrial control network clients, and constructing an initial central intrusion detection model with the same structure on the server side;

[0013] Step S4: selecting some clients from the plurality of industrial control network clients to participate in model iterative training according to the hyperparameters, and configuring initial weight parameters of the central intrusion detection model;

[0014] Step S5: the server encrypts the initial weight parameters and sends them all to the selected industrial control network client;

[0015] Step S6: The selected industrial control network client receives the initial weight parameters and decrypts the weight parameters, imports the initial local intrusion detection model, performs local iterative training based on the data set in step S1 and the hyperparameters in step S3, and obtains the model weight parameters after local training;

[0016] Step S7: the industrial control network client encrypts the model weight parameters obtained through training and sends them to the server;

[0017] Step S8: the server decrypts and aggregates the model weight parameters obtained through training to obtain updated weight parameters;

[0018] Step S9: the server performs verification using the updated weight parameters;

[0019] Step S10: judging whether the current model training is finished according to the verification result;

[0020] Step S11: If the training is not completed, the updated weight parameters are sent to the industrial control network client selected again, and steps S5 to S10 are repeated until the model training is completed;

[0021] Step S12: When the training is completed, the server encrypts the final weight parameters and distributes them to the multiple industrial control network clients;

[0022] Step S13: The plurality of industrial control network clients decode the final weight parameters from the server and update the local intrusion detection model to detect intrusion behavior.

[0023] According to an embodiment of the present invention, in step S1, generating a data set for describing the intrusion behavior of the industrial control network and the network behavior of the normal industrial control network on multiple industrial control network clients includes:

[0024] On each of the industrial control network clients, the work of collecting industrial control protocol content and data features is carried out respectively, the industrial control network protocol content and data features in the industrial control network are extracted, and data annotation is carried out on each industrial control protocol content and data feature to generate a data set for describing the industrial control network intrusion behavior and the normal network behavior of the industrial control network.

[0025] According to one embodiment of the present invention, in step S2, the hyperparameters include: global training rounds, local training rounds, training batches in each round, learning rate, the number K of clients selected to participate in model parameter training in each global round, and the λ value used to update the model parameters.

[0026] According to one embodiment of the present invention, in step S3, the initial central intrusion detection model is used to verify the updated weight parameters in step S9.

[0027] According to an embodiment of the present invention, in step S4, selecting some clients from the plurality of industrial control network clients to participate in model iterative training according to the hyperparameters includes:

[0028] K clients are selected based on the number K of clients participating in the model parameter training selected in each global round in the hyperparameter, where the value of K is less than the number N of all industrial control network clients.

[0029] According to an embodiment of the present invention, in step S4, the client is selected by random selection.

[0030] According to one embodiment of the present invention, in step S5, the weight parameter is encrypted using differential privacy technology.

[0031] According to one embodiment of the present invention, in step S6, the number of local iterative training is determined based on the local training rounds in the hyperparameters.

[0032] According to one embodiment of the present invention, in step S7, the model weight parameters are encrypted using differential privacy technology.

[0033] According to an embodiment of the present invention, in step S8, the aggregation process adopts the aggregation model shown in the following formula (1):

[0034]

[0035] Where: G t+1 represents the weight parameter updated in the t+1th round, represents the weight parameter of the i-th industrial control network client obtained in the t+1 round of training, Gt represents the weight parameter updated in the t (t≥1) round, represents the weight parameter of the i-th (i≥1) industrial control network client obtained in the t-th round of training, and K represents the number of clients participating in the training.

[0036] According to one embodiment of the present invention, the verification in step S9 includes importing the updated weight parameters into the constructed central intrusion detection model, and performing learning algorithm verification based on a portion of the verification data set stored locally on the server.

[0037] According to one embodiment of the present invention, step S9 further includes recording the model validation loss value during validation.

[0038] According to one embodiment of the present invention, in step S10, it is determined whether the current model training is completed based on the following conditions:

[0039] (1) determining whether the cumulative number of rounds of the current global training is equal to the number of rounds of global training set in the hyperparameter, if so, indicating that the global training is finished; or

[0040] (2) Determine whether the loss value of the current central intrusion detection model training no longer decreases significantly, and use the early stopping mechanism to automatically make this judgment. If the early stopping mechanism is triggered, it means that the current global training is finished.

[0041] According to one embodiment of the present invention, the early stopping mechanism is provided by the Tensorflow framework.

[0042] According to one embodiment of the present invention, condition (1) is used by default to determine whether the current model training is completed.

[0043] According to another aspect of the present invention, there is provided a method for implementing the above-mentioned intrusion detection method for a distributed industrial control network, comprising the following steps:

[0044] Step S01: Each industrial control network client receives the final weight parameter from the server, decodes the final weight parameter, and imports it into the local intrusion detection model to update the local intrusion detection model;

[0045] Step S02: extracting the industrial control network industrial control protocol content and data features to extract the industrial control network industrial control protocol content and data feature data;

[0046] Step S03: using the updated local intrusion detection model to detect the extracted industrial control protocol content and data feature data;

[0047] Step S04: Determine whether to collect the test results;

[0048] Step S05: when collecting the test results, regularly feeding back the collected test results to the corresponding industrial control network client;

[0049] Step S06: Without collecting the detection results, automatically generate a processing log according to the detection results, and automatically generate an interception strategy as needed to intercept the corresponding intrusion attack behavior.

[0050] According to another aspect of the present invention, a computer device is provided, which includes a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the intrusion detection method for a distributed industrial control network as described above.

[0051] According to another aspect of the present invention, a storage medium is provided, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the intrusion detection method for a distributed industrial control network as described above.

[0052] Due to the adoption of the above technical solution, the intrusion detection method, device and storage medium for distributed industrial control networks provided by the present invention have at least one of the following beneficial effects compared with the prior art:

[0053] (1) This method can fully utilize the deep learning algorithm without sharing the network behavior data of each industrial control network subnet in the distributed industrial control network, and completely learn the intrusion attack behavior data in each industrial control network subnet under the premise of encrypting the data, thereby providing an intelligent detection method for accurately detecting distributed intrusion attacks;

[0054] (2) The trained detection model is finally deployed in each subnet of the industrial control network, which fully ensures that the data in the subnet will not be leaked, while accurately detecting the learned attack behaviors, with a detection accuracy of about 98%;

[0055] (3) The present invention provides a means for iteratively upgrading the detection model, so that the trained detection model can be continuously optimized and upgraded in the future, so that the detection accuracy of the industrial control network intrusion attack behavior in the distributed industrial control network scenario can be further improved;

[0056] (4) The solution of the present invention greatly reduces human intervention and effectively reduces labor costs. At the same time, it greatly improves the detection accuracy of unknown attack behaviors and reduces the security risks of industrial control networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present invention, but do not constitute a limitation of the present invention. In the accompanying drawings:

[0058] Figure 1 is a schematic diagram of the architecture of a third intrusion detection method according to the prior art;

[0059] Figure 2 is an overall flow chart of an intrusion detection method for a distributed industrial control network according to an embodiment of the present invention;

[0060] Figure 3 A schematic flow chart of an intrusion detection method for a distributed industrial control network according to an embodiment of the present invention when it is implemented;

[0061] Figure 4 The figure is a general architecture diagram for implementing the intrusion detection method for distributed industrial control networks according to the present invention. DETAILED DESCRIPTION

[0062] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0063] In addition, reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0064] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as the general understanding of those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and will not be interpreted with an idealized or overly formal meaning unless specifically defined as in the embodiments of this application.

[0065] Figure 2 The overall flow chart of an intrusion detection method for a distributed industrial control network according to an embodiment of the present invention is shown. The method generally includes the following steps:

[0066] Step S1: generating a data set for describing the intrusion behavior of the industrial control network and the network behavior of the normal industrial control network on multiple industrial control network clients;

[0067] Step S2: configuring hyper parameters on multiple industrial control network clients and servers respectively;

[0068] Step S3: constructing an initial local intrusion detection model with the same structure on multiple industrial control network clients, and constructing an initial central intrusion detection model with the same structure on the server side;

[0069] Step S4: selecting some clients from a plurality of industrial control network clients to participate in model iterative training according to the hyperparameters, and configuring initial weight parameters of the central intrusion detection model;

[0070] Step S5: The server encrypts the initial weight parameters and sends them all to the selected industrial control network client;

[0071] Step S6: The selected industrial control network client receives the initial weight parameters and decrypts the weight parameters, imports the initial local intrusion detection model, conducts local iterative training based on the data set and hyperparameters in step S1, and obtains the model weight parameters after local training;

[0072] Step S7: The industrial control network client encrypts the trained model weight parameters and sends them to the server;

[0073] Step S8: The server decrypts and aggregates the model weight parameters obtained through training to obtain updated weight parameters;

[0074] Step S9: The server performs verification using the updated weight parameters;

[0075] Step S10: judging whether the current model training is finished according to the verification result;

[0076] Step S11: If the training is not completed, the updated weight parameters are sent to the industrial control network client selected again, and steps S5 to S10 are repeated until the model training is completed;

[0077] Step S12: When the training is completed, the server encrypts the final weight parameters and distributes them to multiple industrial control network clients;

[0078] Step S13: multiple industrial control network clients decode the final weight parameters from the server and update the local intrusion detection model to detect intrusion behavior.

[0079] In the method of the present invention, a client-server architecture is adopted (specifically in Figure 4 Introduced in , multiple clients with the same data structure collaborate to train a shared intrusion detection model with the help of a server. During the training and model update process, model training and evaluation are distributed and performed in each client, and no party can obtain the dataset of other parties. Therefore, each client can easily use its own local test dataset to test the performance of the local model. The following is a detailed description of each step of the method.

[0080] In step S1, a data set for describing the intrusion behavior of the industrial control network and the network behavior of the normal industrial control network is generated on multiple industrial control network clients. Specifically, the architecture may include N industrial control network clients, and each industrial control network client performs the extraction work of collecting industrial control protocol content and data features, extracts the industrial control network protocol content and data features in the industrial control network, and performs data annotation work on each industrial control protocol content and data feature, and the data annotation work requires manual participation. The above-mentioned processed data set will be used as training data for local model training and will not be shared with other clients or servers.

[0081] In step S2, hyperparameters are configured on multiple industrial control network clients and servers respectively. The hyperparameters may include the number of global training rounds global_epochs on the server side, the number of local training rounds local_epochs on the industrial control network client side, the number of data processing batches batch_size in each round, the learning rate lr, the lambda value used to update the model parameters, the number of clients K selected to participate in the model parameter training in each global round, etc.

[0082] In step S3, an initial local intrusion detection model with the same structure is constructed on multiple industrial control network clients, and an initial central intrusion detection model with the same structure is constructed on the server side. Among them, the local intrusion detection model on each industrial control network client is used for local training and network intrusion detection, and the central intrusion detection model is used to verify the updated weight parameters after aggregation. When constructing the initial local intrusion detection model and the initial central intrusion detection model, it can be implemented based on the machine learning model framework known in the art, such as but not limited to TensorFlow Federated (TFF), FederatedAI Technology (FATE) and coMind. The training data can also be preprocessed accordingly according to the type of the selected framework.

[0083] In step S4, some of the clients in the multiple industrial control network clients are selected to participate in the model iteration training according to the hyperparameters, and the initial weight parameters of the central intrusion detection model are configured. K clients can be selected according to the number K of clients participating in the model parameter training selected in each global round in the hyperparameters, where the value of K is less than the number N of all industrial control network clients. The client is selected randomly.

[0084] In step S5, the server encrypts the weight parameters and sends them all to the selected industrial control network client. In this step, the weight parameters can be encrypted using differential privacy technology. Specifically, the model weight parameters can be converted into binary, and the binary string of the model parameters obtained after the conversion is randomly perturbed bit by bit, and then the binary string is transmitted to the industrial control network client. Since the transmission is a perturbed binary string, even if data leakage occurs during this transmission process, the attacker cannot restore the true model parameters, let alone conduct a reverse reasoning attack. After receiving the binary string, the client can restore the real data through corresponding decoding, correction schemes and regression statistical methods. By using differential privacy technology to encrypt the weight parameters, the privacy threats that exist in the transmission process of the weight parameters can be resolved.

[0085] In step S6, the selected industrial control network client receives the initial weight parameters and decodes the weight parameters, imports the initial local intrusion detection model, and conducts local iterative training based on the data set and hyperparameters in step S1 to obtain the model weight parameters after local training. The selected K industrial control network clients respectively train the intrusion detection model locally based on their respective training data to obtain their respective model weight parameters. The number of local iterative training is determined based on the local training rounds local_epochs or the loss value in the hyperparameters. When the number of local iterative training reaches the local training rounds local_epochs or its loss value reaches below the target value, the local training ends.

[0086] In step S7, the K industrial control network clients encrypt the trained model weight parameters and send them to the server. Similar to step S5, in this step, the weight parameters can also be encrypted using differential privacy technology to enhance their security. Moreover, this localized differential privacy mechanism has the advantage of being lightweight and is more suitable for localized and marginalized scenarios.

[0087] In step S8, the server decrypts and aggregates the model weight parameters obtained by training each client to obtain updated weight parameters. Specifically, the aggregation process can adopt the aggregation model shown in the following formula (1):

[0088]

[0089] Where: G t+1 represents the weight parameter updated in the t+1th round, represents the weight parameter of the i-th industrial control network client obtained in the t+1 round of training, G t represents the weight parameter updated in the tth (t≥1) round, represents the weight parameter obtained by the i-th (i≥1) industrial control network client in the t-th round of training, and K represents the number of clients participating in the training. Aggregating the model weight parameters obtained by training using the server can improve communication efficiency and reduce training rounds. The above-mentioned aggregation model adopted by the present invention reduces communication rounds and can tolerate a certain degree of update loss.

[0090] In step S9, the server uses the updated weight parameters to conduct verification. For example, the server can import the updated weight parameters into the constructed central intrusion detection model, and conduct learning algorithm verification based on a part of the verification data set stored locally on the server. At the same time, the model verification loss value loss can also be recorded. The loss value loss can be determined based on the loss function, which indicates the probability of an error in the model prediction obtained after the current training is completed. The smaller the value, the more accurate the model.

[0091] In step S10, determine whether the current model training is finished according to the verification result. Specifically, the following conditions can be used to determine whether the current model training is finished: (1) determine whether the cumulative number of rounds of the current global training is equal to the global training rounds global_epochs set in the hyperparameters. If it is equal, it means that the global training is finished; or (2) determine whether the loss value loss of the current central intrusion detection model training is no longer significantly reduced. The early stopping mechanism can be used to automatically determine this. If the early stopping mechanism is triggered, it means that the current global training is finished. The early stopping mechanism can be provided by the Tensorflow framework. By default, condition (1) is used to determine whether the current model training is finished.

[0092] In step S11, if the training is not completed, the updated weight parameters are sent to the industrial control network client selected again, and the above steps S5 to S10 are repeated until the model training is completed.

[0093] In step S12, when the training is completed, the server encrypts the final weight parameters and distributes them to multiple industrial control network clients. Similar to step S5, in this step, differential privacy technology can also be used to encrypt the final weight parameters to enhance their security.

[0094] In step S13, a plurality of industrial control network clients decode the final weight parameters from the server and update the local intrusion detection model for detecting network intrusion behavior.

[0095] Figure 3 The schematic flow chart of the implementation of the intrusion detection method for a distributed industrial control network according to an embodiment of the present invention is shown. The method is deployed and implemented by the client and mainly includes the following steps:

[0096] In step S01, each industrial control network client receives the final weight parameter from the server, decodes the final weight parameter, and imports it into the local intrusion detection model to update the local intrusion detection model;

[0097] In step S02, industrial control network industrial control protocol content and data feature extraction is performed to extract industrial control network industrial control protocol content and data feature data;

[0098] In step S03, the extracted industrial control protocol content and data feature data are detected using the updated local intrusion detection model;

[0099] In step S04, it is determined whether to collect the detection results;

[0100] In step S05, when the detection results are collected, the collected detection results are regularly fed back to the corresponding industrial control network client;

[0101] In step S06, without collecting the detection results, a processing log is automatically generated according to the detection results, and an interception strategy is automatically generated as needed to intercept the corresponding intrusion attack behavior.

[0102] Figure 4 An exemplary architecture diagram of an intrusion detection method for a distributed industrial control network according to the present invention is shown. In the method of the present invention, a client-server architecture is adopted, which mainly includes a server 100 and multiple clients 200, and the server 100 and the multiple clients 200 are connected and communicated through a network 300. The server 100 and the multiple clients 200 have the same structure.

[0103] The server 100 is used to aggregate the trained model parameters provided by each client 200, update the model, and verify whether the aggregated model parameters meet the requirements. Each client 200 iteratively trains the local model based on local data to obtain model parameters that meet the local model requirements.

[0104] The network 300 may include one or more wired or wireless networks. For example, the network may include a cellular network (e.g., a long term evolution (LTE) network, a code division multiple access (CDMA) network, a 3G network, a 4G network, a 5G network, another type of next generation network, etc.). The network may also include a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber-optic-based network, a cloud computing network, etc., and / or a combination of these or other types of networks.

[0105] Multiple clients 200 with the same data structure collaboratively train a shared intrusion detection model with the help of the server 100. During the training and model update process, model training and evaluation are distributedly performed in each client, and no party can obtain the data set of other parties. Therefore, each client can easily use its own local test data set to test the performance of the local model.

[0106] The present invention also provides a computer device, which includes a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the intrusion detection method for a distributed industrial control network as described in the above embodiment.

[0107] The present invention also provides a storage medium, which stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the intrusion detection method for a distributed industrial control network as described in the above embodiment.

[0108] The terms "memory", "storage medium" refer to non-transitory devices that store computer-readable data, programming instructions, or both. Unless otherwise specifically stated, the terms "memory", "storage medium" are intended to include single device embodiments, embodiments where multiple storage devices together or collectively store a set of data or instructions, and individual sectors within these devices. The term "processor" refers to a hardware component of an electronic device that is configured to execute programming instructions. Unless otherwise specifically stated, the singular term "processor" is intended to include single processing device embodiments and embodiments where multiple processing devices together or collectively execute a process.

[0109] The preferred embodiments of the present invention are described in detail above. However, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, a variety of simple modifications can be made to the technical solution of the present invention, and these simple modifications all belong to the protection scope of the present invention.

[0110] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not further describe various possible combinations.

[0111] In addition, various embodiments of the present invention may be arbitrarily combined, and as long as they do not violate the concept of the present invention, they should also be regarded as the contents disclosed by the present invention.

Claims

1. An intrusion detection method for a distributed industrial control network, characterized in that: The following steps are involved: Step S1: generating a data set for describing the intrusion behavior of the industrial control network and the network behavior of the normal industrial control network on multiple industrial control network clients; Step S2: configuring hyper parameters on the plurality of industrial control network clients and servers respectively; Step S3: constructing an initial local intrusion detection model with the same structure on a plurality of the industrial control network clients, and constructing an initial central intrusion detection model with the same structure on the server side; Step S4: selecting some clients from the plurality of industrial control network clients to participate in model iterative training according to the hyperparameters, and configuring initial weight parameters of the central intrusion detection model; Step S5: the server encrypts the initial weight parameters and sends them all to the selected industrial control network client; Step S6: The selected industrial control network client receives the initial weight parameters and decrypts the weight parameters, imports the initial local intrusion detection model, performs local iterative training based on the data set in step S1 and the hyperparameters in step S3, and obtains the model weight parameters after local training; Step S7: the industrial control network client encrypts the model weight parameters obtained through training and sends them to the server; Step S8: the server decrypts and aggregates the model weight parameters obtained through training to obtain updated weight parameters; Step S9: the server performs verification using the updated weight parameters; Step S10: judging whether the current model training is finished according to the verification result; Step S11: If the training is not completed, the updated weight parameters are sent to the industrial control network client selected again, and steps S5 to S10 are repeated until the model training is completed; Step S12: When the training is completed, the server encrypts the final weight parameters and distributes them to the multiple industrial control network clients; Step S13: The plurality of industrial control network clients decode the final weight parameters from the server and update the local intrusion detection model to detect intrusion behavior.

2. The method according to claim 1, characterized in that In step S1, a data set for describing the intrusion behavior of the industrial control network and the network behavior of the normal industrial control network is generated on multiple industrial control network clients, including: On each of the industrial control network clients, the work of collecting industrial control protocol content and data features is carried out respectively, the industrial control network protocol content and data features in the industrial control network are extracted, and data annotation is carried out on each industrial control protocol content and data feature to generate a data set for describing the industrial control network intrusion behavior and the normal network behavior of the industrial control network.

3. The method according to claim 1, characterized in that In step S2, the hyperparameters include: global training rounds, local training rounds, training batches per round, learning rate, the number K of clients selected to participate in model parameter training in each global round, and the lambda value used to update the model parameters.

4. The method according to claim 1, characterized in that: In step S3, the initial central intrusion detection model is used to verify the updated weight parameters in step S9.

5. The method according to claim 1, characterized in that In step S4, selecting some clients from the plurality of industrial control network clients to participate in model iterative training according to the hyperparameters includes: K clients are selected based on the number K of clients participating in the model parameter training selected in each global round in the hyperparameter, where the value of K is less than the number N of all industrial control network clients.

6. The method according to claim 5, characterized in that In step S4, the client is selected randomly.

7. The method according to claim 1, characterized in that In step S5, the weight parameters are encrypted using differential privacy technology.

8. The method according to claim 3, characterized in that In step S6, the number of local iterative training is determined based on the local training rounds in the hyperparameters.

9. The method according to claim 7, characterized in that: In step S7, the model weight parameters are encrypted using differential privacy technology.

10. The method according to claim 3, characterized in that: In step S8, the aggregation process adopts the aggregation model shown in the following formula (1): Where: G t+1 represents the weight parameter updated in the t+1th round, represents the weight parameter of the i-th industrial control network client obtained in the t+1 round of training, Gt represents the weight parameter updated in the t (t≥1) round, represents the weight parameter of the i-th (i≥1) industrial control network client obtained in the t-th round of training, and K represents the number of clients participating in the training.

11. The method according to claim 3, characterized in that The verification in step S9 includes importing the updated weight parameters into the constructed central intrusion detection model, and performing learning algorithm verification based on a part of the verification data set stored locally on the server.

12. The method according to claim 3, characterized in that Step S9 also includes recording the model validation loss value during validation.

13. The method according to claim 12, characterized in that In step S10, it is determined whether the current model training is completed based on the following conditions: (1) Determine whether the cumulative number of rounds of the current global training is equal to the global training rounds set in the hyperparameters, if so, it indicates that the global training is finished; or (2) Determine whether the loss value of the current central intrusion detection model training no longer decreases significantly, and use the early stopping mechanism to automatically make this judgment. If the early stopping mechanism is triggered, it means that the current global training is finished.

14. The method according to claim 13, characterized in that The early stopping mechanism is provided by the Tensorflow framework.

15. The method according to claim 13, characterized in that By default, condition (1) is used to determine whether the current model training is completed.

16. A method for implementing the intrusion detection method for a distributed industrial control network as claimed in any one of claims 1 to 15, characterized in that: The following steps are involved: Step S01: Each industrial control network client receives the final weight parameter from the server, decodes the final weight parameter, and imports it into the local intrusion detection model to update the local intrusion detection model; Step S02: extracting the industrial control network industrial control protocol content and data features to extract the industrial control network industrial control protocol content and data feature data; Step S03: using the updated local intrusion detection model to detect the extracted industrial control protocol content and data feature data; Step S04: Determine whether to collect the test results; Step S05: when collecting the test results, regularly feeding back the collected test results to the corresponding industrial control network client; Step S06: Without collecting the detection results, automatically generate a processing log according to the detection results, and automatically generate an interception strategy as needed to intercept the corresponding intrusion attack behavior.

17. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the intrusion detection method for a distributed industrial control network as described in any one of claims 1 to 15.

18. A storage medium, characterized in that: The storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the intrusion detection method for a distributed industrial control network as described in any one of claims 1 to 15.

Images