Industrial control system attack detection method and system based on state awareness
Through a state perception-based method, the state information in the industrial control system is analyzed and utilized to generate accurate invariance rules, which solves the problem of difficulty in detecting hidden attacks in the prior art, and improves the sensitivity and accuracy of attack detection.
Patent Information
- Application Number
- CN202411646761.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-18
- Publication Date
- 2025-02-25
AI Technical Summary
The prior art is difficult to effectively detect hidden attacks in industrial control systems, mainly because traditional methods are based on global or static thresholds and cannot cover all possible system states, resulting in detection blind spots.
Using a state-aware method, by loading PLC program code, analyzing and identifying the state, state transition conditions of the ICS, and the dependencies between the perception, execution and configuration variables within each state, divide real-time data into state-specific subtracking. , using the association rule mining algorithm to analyze the data subtracks for each state, generate numerical instantiation of invariance templates, and enforce state-aware invariance rules in the runtime monitor.
By considering the context of system variables, more accurate invariance rules are generated, which improves detection sensitivity and accuracy of potential attack behaviors and reduces detection blind spots.
Smart Images
Figure CN119520087A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of industrial control system security, and in particular relates to an industrial control system attack detection method and system based on state perception. Background Art
[0002] Industrial control systems (ICS) are key components of modern industrial infrastructure, responsible for monitoring and controlling the complex processes of power grid systems. In ICS, programmable logic controllers (PLCs) are core components used to control industrial processes according to preset programs. As ICS are increasingly connected to the Internet and other communication networks, they face complex cyber attack threats. Existing security measures, such as invariance-based detection methods, can identify certain types of attacks, but often cannot effectively detect more covert attack behaviors because the definition of invariance is too broad. Because traditional methods define the boundaries of system behavior based on global or static thresholds, these boundaries may not cover all possible system states, resulting in detection blind spots. Summary of the invention
[0003] In order to solve the deficiencies in the prior art, the present invention provides an industrial control system attack detection method and system based on state perception to solve the technical problem of effectively detecting covert attacks.
[0004] In order to solve the above technical problems, the present invention adopts the following technical solutions.
[0005] The present invention first discloses an industrial control system attack detection method based on state perception, which includes the following steps:
[0006] Step 1: Load the PLC program code and analyze and identify the ICS states, state transition conditions, and dependencies between the sense, execute, and configure variables within each state.
[0007] Step 2: Divide the benign data trace of the collected ICS real-time data into multiple state-specific sub-traces based on the states, state transition conditions, and dependencies between the sensing, execution, and configuration variables within each state;
[0008] Step 3: Analyze and mine each state-specific data sub-trace using an association rule mining algorithm to numerically instantiate an invariant template that defines dependencies between variables within a state;
[0009] Step 4: When the PLC is running and receives a program variable update request from an external entity, the runtime monitor is triggered to enforce the state-aware invariance rules. When the program variable update request does not comply with the invariance rules, the request is rejected to determine that an attack or violation has been detected.
[0010] The present invention further includes the following preferred embodiments:
[0011] The runtime monitor is triggered only when the PLC receives a program variable update request from an external entity.
[0012] The invariant template includes a state identifier and a set of variables associated with the state.
[0013] The state transition condition includes a combination of at least one control flow graph and at least one data flow graph.
[0014] The association mining algorithm is used to set specific value ranges for variables in an invariant template.
[0015] The benign data tracking of the collected ICS real-time data is divided into a plurality of state-specific sub-tracks, further comprising:
[0016] Collect real-time data from various components of the ICS; the real-time data includes various sensor readings, actuator states, configuration parameters, and timestamp information; analyze the collected real-time data according to each state and its transition conditions; identify key points reflecting state transitions in the real-time data, and find data records that meet specific transition conditions; extract data fragments related to each state from the complete data trace, and divide all data points recorded between the start and end of the state into multiple sub-traces using the state transition points as demarcations, each sub-trace corresponding to a specific state; use each state-specific data sub-trace for quantification of an invariant template in subsequent steps.
[0017] The triggering of the runtime monitor to enforce state-aware invariance rules further comprises:
[0018] Check whether the requested variable update complies with the invariance rules of the current state, verify whether the data in the request falls within the predefined numerical range, and whether it is consistent with the current state of the PLC program; if the request complies with the invariance rules, the monitor allows the request to continue to execute the request and update the program variables of the PLC; if it does not comply with the invariance rules, the monitor rejects the request and records the event as a potential security violation; the monitor provides real-time feedback; if a potential attack or violation is detected, the monitor notifies the system administrator or automatically takes defensive measures.
[0019] The present invention also discloses a state-aware industrial control system attack detection system using the state-aware industrial control system attack detection method, comprising:
[0020] ICS state identification module, used to load PLC program code, analyze and identify the ICS state, state transition conditions, and dependencies between perception, execution, and configuration variables within each state;
[0021] a state-aware invariant generation module for partitioning a benign data trace of collected ICS real-time data into a plurality of state-specific sub-traces based on the states, state transition conditions, and dependencies between perception, execution, and configuration variables within each state;
[0022] an invariance quantification module for analyzing and mining each state-specific data sub-trace using an association rule mining algorithm to numerically instantiate an invariance template that defines dependencies between variables within a state;
[0023] The runtime monitoring module is used to trigger the runtime monitor to enforce state-aware invariance rules when the PLC is running and receives a program variable update request from an external entity. When the program variable update request does not comply with the invariance rule, the request is rejected to determine that an attack or violation has been detected.
[0024] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;
[0025] The storage medium is used to store instructions;
[0026] The processor is used to operate according to the instructions to execute the steps of the aforementioned industrial control system attack detection method based on state perception.
[0027] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the aforementioned industrial control system attack detection method based on state perception are implemented.
[0028] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides an industrial control system attack detection method and system based on state perception, which not only considers the values of system variables, but also considers the context of changes in these variable values, that is, the system state they are in, and generates more accurate invariance rules by analyzing and utilizing the state information in the industrial control system. These rules can more effectively define the expected behavior of system variables under different operating states, thereby improving the detection sensitivity and accuracy of potential attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] Figure 1 It is an architectural diagram of the industrial control system attack detection method based on state perception in the present invention.
[0030] Figure 2It is an ICS architecture diagram of the integrated monitoring component in the present invention.
[0031] Figure 3 It is a workflow diagram of the monitoring component in the present invention. DETAILED DESCRIPTION
[0032] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.
[0033] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.
[0034] State-aware industrial control system (ICS) attack detection methods have become a key technology for dealing with industrial network security issues. In view of the shortcomings of the prior art, the present invention proposes a state-aware industrial control system attack detection method and system, which accurately defines the expected behavior of ICS variables in different states, not only considers the value of the system variables, but also considers the context of the variable value change, that is, the system state they are in, so that hidden attacks that may be ignored by traditional methods can be detected. Using program analysis and data mining technology, according to the state model of the PLC program and the data tracking during system runtime, attack detection rules that meet the behavioral constraints of each state variable are generated for the ICS.
[0035] The present invention is based on the collaborative work of multiple key steps, including static analysis for extracting state information, data tracking analysis for generating invariance templates, association rule mining for quantifying specific numerical limits of invariance, and a runtime monitor for real-time monitoring and execution of detection rules, with the aim of optimizing detection performance and ensuring the efficiency and accuracy of the method. Figure 1 As shown, the industrial control system attack detection method based on state perception disclosed in the present invention includes the following steps:
[0036] Step 1: Load the PLC program code and analyze to identify the ICS states, state transition conditions, and dependencies between the sense, execute, and configure variables within each state.
[0037] The step 1 specifically includes:
[0038] Step 1.1: Use a text editor or a dedicated PLC code analysis tool to load the PLC program code, which is written in a specific programming language such as ladder diagram, function block diagram or structured text.
[0039] Step 1.2: Perform grammatical analysis on the PLC program code and decompose the code into recognizable symbols and structures. For example, a parser generator (such as ANTLR or YACC) is used to build a parser, which recognizes the grammatical rules of the PLC programming language and builds an abstract syntax tree (AST). The AST represents the hierarchy and relationship of the code in a tree structure, where nodes represent entities in the code, such as variable declarations, logical operations, and control structures.
[0040] Once the AST is built, the tree is further analyzed to identify states and transition conditions. States are usually defined by certain logical blocks in the program, such as using loops, conditional branches, or state machine logic. By analyzing these logical blocks, the start and end of the state, as well as potential transition conditions between states, are determined.
[0041] After identifying the states, the sensor, actuator, and configuration variables within each state are analyzed, including checking variable declarations, data flows, and the use of variables in the state logic. Data flow analysis and control flow analysis techniques are used to determine the dependencies between variables in order to identify which variables affect other variables and how the variables respond to state transitions. For example, the state transition condition includes a combination of at least one control flow graph and at least one data flow graph.
[0042] Step 1.3: Integrate the above information to build a complete model that describes the PLC program states, state transitions, and the interdependencies of state internal variables in detail, providing a basis for generating state-aware invariance rules and runtime monitoring in subsequent steps.
[0043] Step 2: Divide the benign data trace of the collected ICS real-time data into multiple state-specific sub-traces based on the states, state transition conditions, and dependencies between the sensing, execution, and configuration variables within each state.
[0044] The step 2 specifically includes:
[0045] Step 2.1: Collect real-time data from various components of the ICS (such as sensors, actuators, and PLCs). The real-time data includes various sensor readings, actuator status, configuration parameters, and timestamp information.
[0046] Step 2.2: Analyze the collected real-time data based on each state and its transition conditions identified in step 1. As shown in the following algorithm, first, it converts the PLC program into an abstract syntax tree (AST), and then extracts function blocks and case blocks from it. Each case block represents a state in the FSM. For each case block, the algorithm builds a control flow graph and a data flow graph and merges them into a program dependency graph (PDG). The PDG contains control and data dependencies that define the transition conditions between states. The algorithm analyzes the PDG to identify the variables and conditions that lead to state transitions and uses these conditions as transition edges between states in the FSM. Through this process, the algorithm is able to identify state transition key points in the PLC program. These key points are the conditions for state transitions, which usually involve specific variable values or conditional statements, which determine when to move from one state to another. Finally, the algorithm builds an FSM that contains states and state transition conditions based on the logic extracted from the PLC program. This FSM is used in the subsequent steps to generate and quantify state-aware invariant rules. The key points reflecting state transitions in the real-time data are identified through the FSM, and data records that meet specific transition conditions are found. For example, if a state transition is triggered by a specific sensor reading, look for changes in that reading in the data.
[0047] The state transition conditions extracted from the PDG generated by the FSM construction algorithm define an invariant template; the invariant template includes a state identifier and a set of variables associated with the state, and the conditions that these variables should satisfy. The invariant template defines the relationship between the variables in the state, for example, the value of a certain variable must be within a specific range, or a combination of certain variables must satisfy a specific logical condition.
[0048] Step 2.3: Extract the data fragments related to each state from the complete data trace. Specifically, all data points recorded between the start and end of the state. Using the state transition points as demarcations, the data is divided into multiple sub-traces, each corresponding to a specific state. In addition, to improve the accuracy of the division, signal processing techniques are applied to filter out noise and outliers, and time synchronization techniques are used to ensure the continuity and consistency of the data trace.
[0049] Step 2.4: Each state-specific data sub-trace is used for quantification of the invariance template in the subsequent steps to determine the expected behavior and bounds of the system variables in each state.
[0050] Step 3: Each state-specific data sub-trace is analyzed and mined using an association rule mining algorithm to numerically instantiate an invariant template that defines the dependencies between variables within a state.
[0051] The core task of this step is to use data mining technology, especially association rule learning algorithm, to mine specific value ranges and patterns from the data sub-tracks corresponding to each state, so as to instantiate the invariant template. The invariant template is generated based on the identification of the state in step 2. It defines the relationship that should be followed between the variables in the state, but the numerical limits of these templates have not yet been specified. For example, the invariant template includes a state identifier and a set of variables associated with the state.
[0052] The step 3 specifically includes:
[0053] Step 3.1: Prepare state-specific data sub-traces. Each data sub-trace is divided according to different states of the PLC program. Each sub-trace contains sensor readings, actuator states, and configuration parameters in a specific state.
[0054] Step 3.2: Apply an association rule learning algorithm to analyze the data sub-trace for each state. The association rule learning algorithm identifies frequent patterns in the data, i.e., combinations of variable values that co-occur in the data, and generates association rules based on the frequent patterns. The association rules are used to describe the dependencies between variables, i.e., how changes in the value of one variable affect the value of another variable.
[0055] Step 3.3: Evaluate the statistical significance of the association rules to determine whether the confidence and support of the association rules satisfy the invariance rules. The confidence refers to the conditional probability of the value of one variable given the value of another variable; the support refers to the frequency of these variable value combinations in the data. Once the association rules are verified, they are used to numerically instantiate the invariance template. Specifically, specific numerical ranges are defined for each variable in the template, which reflect the actual behavior patterns of the variables under specific conditions.
[0056] Step 3.4: Apply the generated numerical instantiation invariant rules to real-time monitoring and attack detection in subsequent steps. The invariant rules accurately describe the behavior patterns that system variables should follow in each state, providing a basis for detecting potential attack behaviors that deviate from these patterns.
[0057] Among them, the invariance template is a preliminary structure or framework that defines the relationship between variables within the ICS state. It is an abstract representation used to capture and express the conditions and constraints that variables should meet in a specific state. The template usually contains a state identifier and a set of variables associated with the state, but without specific numerical boundaries. The invariance rule is a concrete and quantified invariance template that details the specific numerical range and behavior of the variables in a specific state. The invariance rule is a specific rule that can be directly applied to monitor and detect ICS states to identify and respond to potential attacks or abnormal behaviors. The invariance template needs to be converted into specific invariance rules through a quantification process. This process involves analyzing the runtime data of the ICS (state-specific data sub-tracks) and using data mining techniques (such as association rule learning) to determine the specific numerical ranges of the variables in the template.
[0058] Step 4: When the PLC is running and receives a program variable update request from an external entity, the runtime monitor is triggered to enforce the state-aware invariance rules. When the program variable update request does not comply with the invariance rules, the request is rejected to determine that an attack or violation has been detected.
[0059] A real-time monitoring system is implemented during PLC operation, which is called a runtime monitor (SMONITOR). Figure 2 As shown, the main task of the monitor is to ensure that the state-aware invariance rules are enforced during PLC operation and is only activated when an external variable update request is detected. Step 4 specifically includes:
[0060] Step 4.1: Design and implement a runtime monitor (SMONITOR) and integrate SMONITOR into the PLC's runtime environment. The monitor SMONITOR is programmed to understand and apply the previously generated state-aware invariance rules.
[0061] Step 4.2: Listen for all variable update requests from external entities. These requests originate from operator interfaces, remote servers, or any system component that communicates with the PLC. When the PLC receives an external variable update request, SMONITOR is triggered. Once triggered, see Figure 3 As shown, the monitor will do the following:
[0062] (1) Check whether the requested variable update complies with the invariance rules of the current state, verify whether the data in the request falls within the predefined value range, and whether it is consistent with the current state of the PLC program. First, the current state of the ICS is determined by real-time monitoring of the PLC variable values. Then, the corresponding invariance rules are loaded according to the state. These rules describe in detail the expected behavior and allowed value range of each variable in this state. When an external entity initiates a variable update request, the runtime monitor intercepts the request and compares it with the invariance rules of the current state. The comparison process includes verifying whether the variable value in the request falls within the specified range and whether the dependency relationship between variables is satisfied.
[0063] (2) If the request complies with the invariance rules, the monitor allows the request to continue executing the request and update the PLC program variables. If the invariance rules are not met, the monitor rejects the request and records the event as a potential safety violation.
[0064] (3) The monitor provides real-time feedback to ensure the security and stability of the system. If a potential attack or violation is detected, the monitor notifies the system administrator or automatically takes defensive measures.
[0065] Furthermore, to ensure efficient operation of the monitor with minimal impact on the performance of the PLC, in a preferred embodiment, the algorithm is optimized to reduce computational delays and ensure that the operation of the monitor does not interfere with the normal operation of the PLC.
[0066] Step 4.3: Configure the monitor to periodically update its rule base to adapt to system changes or new security threats.
[0067] The invention has been trained and tested in a variety of industrial environments and operating conditions, which enables it to have in-depth ICS operation knowledge and attack pattern recognition capabilities. The invention can generate a large number of attack detection rules that follow the target ICS state constraints, greatly improving the effectiveness and coverage of attack detection. The state-aware approach is not limited to a specific industrial control system or PLC brand and can be easily extended to a variety of industrial environments and control systems.
[0068] By monitoring the system status in real time and executing state-aware rules, suspicious behavior can be responded to more quickly, reducing the time from detection to response. The present invention further automatically triggers an alarm and takes defensive measures when a potential attack is detected, thereby improving the overall security of the industrial control system.
[0069] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides an industrial control system attack detection method and system based on state perception, which not only considers the values of system variables, but also considers the context of changes in these variable values, that is, the system state they are in, and generates more accurate invariance rules by analyzing and utilizing the state information in the industrial control system. These rules can more effectively define the expected behavior of system variables under different operating states, thereby improving the detection sensitivity and accuracy of potential attack behaviors.
[0070] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a state-aware industrial control system attack detection system based on the aforementioned state-aware industrial control system attack detection method. The system includes:
[0071] ICS state identification module, used to load PLC program code, analyze and identify the ICS state, state transition conditions, and dependencies between perception, execution, and configuration variables within each state;
[0072] a state-aware invariant generation module for partitioning a benign data trace of collected ICS real-time data into a plurality of state-specific sub-traces based on the states, state transition conditions, and dependencies between perception, execution, and configuration variables within each state;
[0073] an invariance quantification module for analyzing and mining each state-specific data sub-trace using an association rule mining algorithm to numerically instantiate an invariance template that defines dependencies between variables within a state;
[0074] The runtime monitoring module is used to trigger the runtime monitor to enforce state-aware invariance rules when the PLC is running and receives a program variable update request from an external entity. When the program variable update request does not comply with the invariance rule, the request is rejected to determine that an attack or violation has been detected.
[0075] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned state-awareness-based industrial control system attack detection method. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned state-awareness-based industrial control system attack detection method.
[0076] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.
[0077] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.
[0078] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.
[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.
Claims
1. A state-aware industrial control system attack detection method, characterized in that: The following steps are involved: Step 1: Load the PLC program code and analyze and identify the ICS states, state transition conditions, and dependencies between the sense, execute, and configure variables within each state. Step 2: Divide the benign data trace of the collected ICS real-time data into multiple state-specific sub-traces based on the states, state transition conditions, and dependencies between the sensing, execution, and configuration variables within each state; Step 3: Analyze and mine each state-specific data sub-trace using an association rule mining algorithm to numerically instantiate an invariant template that defines dependencies between variables within a state; Step 4: When the PLC is running and receives a program variable update request from an external entity, the runtime monitor is triggered to enforce the state-aware invariance rules. When the program variable update request does not comply with the invariance rules, the request is rejected to determine that an attack or violation has been detected.
2. The state-aware industrial control system attack detection method according to claim 1 is characterized in that: The runtime monitor is triggered only when the PLC receives a program variable update request from an external entity.
3. The state-aware industrial control system attack detection method according to claim 2 is characterized in that: The invariant template includes a state identifier and a set of variables associated with the state.
4. The state-aware industrial control system attack detection method according to claim 3 is characterized in that: The state transition condition includes a combination of at least one control flow graph and at least one data flow graph.
5. The state-aware industrial control system attack detection method according to claim 4 is characterized in that: The association mining algorithm is used to set specific value ranges for variables in an invariant template.
6. The state-aware industrial control system attack detection method according to claim 5 is characterized in that: The benign data tracking of the collected ICS real-time data is divided into a plurality of state-specific sub-tracks, further comprising: Collect real-time data from various components of the ICS; the real-time data includes various sensor readings, actuator states, configuration parameters, and timestamp information; analyze the collected real-time data according to each state and its transition conditions; identify key points reflecting state transitions in the real-time data, and find data records that meet specific transition conditions; extract data fragments related to each state from the complete data trace, and divide all data points recorded between the start and end of the state into multiple sub-traces using the state transition points as demarcations, each sub-trace corresponding to a specific state; use each state-specific data sub-trace for quantification of an invariant template in subsequent steps.
7. The state-aware industrial control system attack detection method according to claim 6 is characterized in that: The triggering of the runtime monitor to enforce state-aware invariance rules further comprises: Check whether the requested variable update complies with the invariance rules of the current state, verify whether the data in the request falls within the predefined numerical range, and whether it is consistent with the current state of the PLC program; if the request complies with the invariance rules, the monitor allows the request to continue to execute the request and update the program variables of the PLC; if it does not comply with the invariance rules, the monitor rejects the request and records the event as a potential security violation; the monitor provides real-time feedback; if a potential attack or violation is detected, the monitor notifies the system administrator or automatically takes defensive measures.
8. An industrial control system attack detection system based on state perception, characterized in that: include: ICS state identification module, used to load PLC program code, analyze and identify the ICS state, state transition conditions, and dependencies between perception, execution, and configuration variables within each state; a state-aware invariant generation module for partitioning a benign data trace of collected ICS real-time data into a plurality of state-specific sub-traces based on the states, state transition conditions, and dependencies between perception, execution, and configuration variables within each state; an invariance quantification module for analyzing and mining each state-specific data sub-trace using an association rule mining algorithm to numerically instantiate an invariance template that defines dependencies between variables within a state; The runtime monitoring module is used to trigger the runtime monitor to enforce state-aware invariance rules when the PLC is running and receives a program variable update request from an external entity. When the program variable update request does not comply with the invariance rule, the request is rejected to determine that an attack or violation has been detected.
9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the industrial control system attack detection method based on state awareness according to any one of claims 1-7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the state-aware industrial control system attack detection method described in any one of claims 1 to 7 are implemented.