Industrial control equipment classification method based on asset fingerprint large model

Abstract

The invention relates to an industrial control equipment classification method based on an asset fingerprint large model, and the method comprises the steps: carrying out the bypass grabbing of equipment information and flow information in an industrial control system, carrying out the modeling, forming an equipment fingerprint, carrying out the training through an Llama3 model, and finally achieving the recognition and classification of equipment in the industrial control system. The method specifically comprises the following steps: establishing an equipment fingerprint database by utilizing equipment characteristics and flow characteristics in an industrial control network; selecting an appropriate basic large model lama-3-8b-bnb-4bit model, and inputting the equipment fingerprint database into the model for training to form an asset fingerprint large model; secondary capturing modeling is carried out on equipment information and flow information in an industrial control system, and an asset fingerprint large model is input to classify equipment in a network. The method can be different from a traditional equipment classification method, and equipment identification and classification are realized by utilizing the equipment fingerprint and asset fingerprint large model under the condition of not occupying the resources of an industrial control system.

Description

Technical Field

[0001] The invention belongs to the field of industrial control security, and in particular is a method for classifying industrial control equipment based on a large asset fingerprint model. Background Art

[0002] The wide-area interconnectedness of the oil and gas pipeline network exposes it to a wide range of attack surfaces and diverse attack modes. Attacks from the information domain to the physical domain have become a major risk source for safe production. The traditional production safety control strategy with functional safety as the core faces challenges, and it is urgent to solve the problem of comprehensive early warning and control of information security and functional safety of the industrial control system of the oil and gas pipeline network. The classification method of industrial control equipment is crucial to the safety of the industrial control system of the oil and gas pipeline network. It helps to accurately assess risks, formulate targeted security strategies, optimize equipment maintenance management, quickly respond to security incidents, ensure compliance, guide technology upgrades, and maximize cost-effectiveness.

[0003] At present, many scholars at home and abroad have paid attention to the research on industrial control equipment classification methods. However, the identification features of industrial equipment are often limited by the underlying network protocols and communication mechanisms, which increases the complexity of feature extraction and the difficulty of training data collection. At the same time, the accuracy of classification models varies greatly. It is necessary to study industrial fingerprint collection and classification models to solve the problem of equipment feature universality and improve the accuracy of industrial control equipment classification.

[0004] Classification of industrial control equipment in oil and gas pipeline networks is the basis for discovering equipment with abnormal operating status or illegal access. How to use on-site network traffic or process data to accurately model the status of industrial control equipment and classify the equipment is an urgent problem to be solved at this stage. Industrial control equipment fingerprints specific to industrial control systems are usually restricted by network protocols and communication methods, which makes fingerprint extraction and training data acquisition difficult, and the accuracy of classification models varies greatly. Summary of the invention

[0005] In view of the above technical deficiencies, the purpose of the present invention is to provide an industrial control equipment classification method based on an asset fingerprint large model. A training fingerprint library of industrial control equipment is established by capturing the traffic and information in the industrial control system, and the library is input into the Llama-3-8b-bnb-4bit model for training to form an asset fingerprint large model. Next, the traffic and information of the industrial control system are captured for a second time to form a test fingerprint library, which is input into the asset fingerprint large model to achieve equipment classification.

[0006] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0007] A method for classifying industrial control equipment based on a large asset fingerprint model comprises the following steps:

[0008] Capture the equipment information and flow information in the industrial control system and establish a training fingerprint library for the equipment in the industrial control system;

[0009] Select a basic large model and input the training fingerprint library into the model for training to obtain an asset fingerprint large model;

[0010] Perform secondary bypass detection on industrial control systems, capture new device information and flow information to establish a test fingerprint library for devices in industrial control systems;

[0011] The test fingerprint library is input into the asset fingerprint model. The model automatically identifies the device based on existing learning and realizes the classification of industrial control equipment.

[0012] The method of establishing a training fingerprint library for devices in an industrial control system comprises the following steps:

[0013] Feature extraction: extracts multiple features from the header of the network packet, and additionally adds payload entropy, protocol, and source and destination port categories;

[0014] Feature selection: Remove unnecessary features using a voting method based on feature importance;

[0015] Construct the final feature set: Use genetic algorithm to screen features from the features after feature selection, and use the remaining features to construct a training fingerprint library.

[0016] The feature extraction is specifically as follows:

[0017] The importance scores of all features of each device are calculated using a variety of different algorithms, and features with scores greater than the threshold are retained as features useful to the device through a weighted sum voting method. The mathematical representation is:

[0018]

[0019] in, f i The total score of the feature, f i For each feature, Algorithms is the set of all algorithms used, Score the feature importance for each algorithm.

[0020] The method of selecting a basic large model and inputting the training fingerprint library into the model for training is specifically as follows:

[0021] The llama-3-8b-bnb-4bit model is selected as the Llama3 model for industrial control equipment classification;

[0022] Select AdamW optimizer to optimize the llama-3-8b-bnb-4bit model;

[0023] Use the cosine annealing algorithm to fine-tune the optimized model;

[0024] Set a training round number prediction function based on the sample size, and obtain the optimal range of model training rounds based on this function.

[0025] The AdamW optimizer is specifically:

[0026]

[0027] Among them, θ t,i is the i-th parameter at time step t, η is the learning rate, is the bias-corrected first-order momentum estimate, is the bias-corrected second-order momentum estimate, ω t,i is the weight decay coefficient, and ε is a constant.

[0028] The cosine annealing algorithm is specifically:

[0029]

[0030] Among them, η t is the learning rate at time step t, η max and η min are the minimum and maximum values ​​of the learning rate, T cur is the current training cycle number, T max is the number of training cycles contained in a complete cosine cycle.

[0031] The training round number prediction function based on sample size is specifically:

[0032]

[0033] Among them, α represents the adjustment constant of the fine-tuning round number function, β represents the linear coefficient of the fine-tuning round number function, and x represents the sample size of the training set.

[0034] An industrial control equipment classification system based on asset fingerprint large model, including:

[0035] The training fingerprint library construction module is used to capture the equipment information and flow information in the industrial control system and establish the training fingerprint library of the equipment in the industrial control system;

[0036] The large model training module is used to select a basic large model and input the training fingerprint library into the model for training to obtain an asset fingerprint large model;

[0037] The test fingerprint library construction module is used to perform secondary bypass detection on the industrial control system, capture new device information and flow information to establish a test fingerprint library for the equipment in the industrial control system;

[0038] The equipment classification module is used to input the test fingerprint library into the asset fingerprint model. The model automatically identifies the equipment based on existing learning and realizes the classification of industrial control equipment.

[0039] An industrial control equipment classification device based on an asset fingerprint large model comprises a memory and a processor; the memory is used to store a computer program; the processor is used to implement the industrial control equipment classification method based on an asset fingerprint large model when executing the computer program.

[0040] A computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the industrial control equipment classification method based on the asset fingerprint large model is implemented.

[0041] The present invention has the following beneficial effects and advantages:

[0042] 1. The present invention applies the asset fingerprint large model formed by fine-tuning the Llama3 model to the classification of industrial control equipment, providing a new perspective for the field of industrial system equipment classification.

[0043] 2. The present invention is different from existing supervised and unsupervised machine learning algorithms. It is trained by the Llama-3-8b-bnb-4bit basic large language model, and the obtained asset fingerprint large model helps to improve the accuracy of identifying and classifying devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is an example diagram of the process of generating a training fingerprint library;

[0045] Figure 2 This is an example of Llama3 large language model training;

[0046] Figure 3 This is a flow chart of the main steps of this method. DETAILED DESCRIPTION

[0047] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0048] The present invention proposes an industrial control equipment classification method based on an asset fingerprint large model. The method is based on bypass capture of equipment information and flow information in the industrial control system and modeling to form equipment fingerprints, and then uses the llama-3-8b-bnb-4bit model for training, ultimately realizing the identification and classification of equipment in the industrial control system.

[0049] The present invention provides an effective device identification and classification method in an industrial control system.

[0050] like Figure 3 As shown, the specific steps include:

[0051] like Figure 1 As shown in the figure, in step 1, we conduct a comprehensive security scan of industrial control equipment connected to the public network. We extract 111 features from the header of the network data packet, and add payload entropy, protocol (from the TCP-IP layer), and source and destination port categories, and then use a voting method based on feature importance to eliminate unnecessary features. This method uses six different techniques: information value, evidence weight, variable importance in random forests, recursive feature elimination, variable importance of additional tree classifiers, chi-square best variables, and L1-based feature selection to calculate the importance score of all features of each device, and use the final score to determine the effective features that will be retained in the feature set. With this information, we can accurately annotate each fingerprint vector in the fingerprint vector library to ensure that each vector accurately reflects the characteristics and source of its corresponding device.

[0052] Step 2: Use genetic algorithm to select the most appropriate feature set from the remaining 52 features to preprocess the attribute values ​​in the fingerprint vector of industrial control equipment, including standardization, noise removal, and other data cleaning work, in order to improve the quality and usability of the data. The preprocessed data will be used to form a training fingerprint library.

[0053] like Figure 2As shown, step three, training of the asset fingerprint large model. First, the selected basic large language model must be safe and compliant. Considering that the equipment classification task should meet the requirements of data security and privacy compliance, consider selecting an open source basic large language model that supports local deployment for fine-tuning. Secondly, the basic large language model generally performs well in processing natural language related tasks, but its learning ability for discrete and pure digital sample features in industrial control equipment classification tasks is average. By preprocessing the training samples, the discrete and pure digital sample features in the industrial control equipment classification task are converted into samples commonly used in natural language processing tasks, so that the fine-tuned model can better complete the industrial control equipment classification task. Finally, the training process of the large language model often requires huge computing resources and must be supported by expensive hardware. Even in the fine-tuning process, due to the differences in the pre-models and the differences in the fine-tuning methods, the hardware resources required for fine-tuning and the training speed may differ by several times or even dozens of times. How to reduce the demand for hardware resources and increase the training speed while meeting the classification accuracy is also an aspect that must be considered. This patent refers to public information and evaluation data from authoritative institutions, and selects gemma-7b-bnb-4bit, llama-3-8b-bnb-4bit, and Phi-3-mini-4k-instruct for fine-tuning and testing. The reasons for selection are: 1) All three models are open source basic large language models that can be fine-tuned and deployed locally without networking, meeting the requirements of security and compliance; 2) All samples can be fine-tuned through questions and answers to complete the task of industrial control equipment classification; 3) All can be fine-tuned through Unsloth, and the GPU resources required after using Unsloth do not exceed 8GB. At the same time, compared with not using Unsloth acceleration, the fine-tuning speed of Unsloth is about doubled. Due to the particularity of the task of industrial control equipment classification, the detection accuracy of various basic large language models for abnormal devices is basically 0 before fine-tuning; after fine-tuning, the detection capabilities of different models for abnormal devices are also very different. After experiments, we selected the basic large language model that was fine-tuned to complete the task of industrial control equipment classification - the llama-3-8b-bnb-4bit model. Its advantage is that it is fine-tuned in exactly the same way. The fine-tuned llama-3-8b-bnb-4bit model has the highest accuracy for equipment classification.

[0054] Step 4. After step 3, we will get a large asset fingerprint model. The model has learned the hardware characteristics of existing devices and the traffic characteristics in the network. It can identify and classify devices based on similar inputs, such as whether the original device is faulty or hacked, and whether the newly added device meets the characteristics of a secure device, and then identify whether the newly added device is secure.

[0055] Step 5. After obtaining the asset fingerprint model, we will conduct a comprehensive security scan of the industrial control equipment of the target network. We will analyze the communication traffic of these devices obtained in the scan and extract unique fingerprint vectors from them. Establish an initial industrial control equipment fingerprint database to provide basic data support for subsequent identification classification and equipment monitoring. Then further obtain the manufacturer information of each industrial control device, including detailed data such as device model and version number. With this information, we can accurately annotate each fingerprint vector in the fingerprint vector library to ensure that each vector can accurately reflect the characteristics and source of its corresponding device.

[0056] Step 6: Preprocess the attribute values ​​in the industrial control equipment fingerprint vector, including standardization, noise removal, and other data cleaning work, in order to improve the quality and usability of the data. The preprocessed data will be used to form a test fingerprint library.

[0057] Step 7: Input the test fingerprint library into the asset fingerprint model. The model will automatically identify the device features in the test fingerprint library to classify the devices.

[0058] Step 8: Repeat steps 5, 6 and 7 to periodically or continuously identify devices in the industrial control network and classify the devices.

[0059] Through this step, we will finally achieve the identification and classification of devices in the industrial control network.

Claims

1. A method for classifying industrial control equipment based on a large asset fingerprint model, characterized in that: The following steps are involved: Capture the equipment information and flow information in the industrial control system and establish a training fingerprint library for the equipment in the industrial control system; Select a basic large model and input the training fingerprint library into the model for training to obtain an asset fingerprint large model; Perform secondary bypass detection on industrial control systems, capture new device information and flow information to establish a test fingerprint library for devices in industrial control systems; The test fingerprint library is input into the asset fingerprint model. The model automatically identifies the device based on existing learning and realizes the classification of industrial control equipment.

2. According to claim 1, a method for classifying industrial control equipment based on asset fingerprint large model is characterized in that: The method of establishing a training fingerprint library for devices in an industrial control system comprises the following steps: Feature extraction: extracts multiple features from the header of the network packet, and additionally adds payload entropy, protocol, and source and destination port categories; Feature selection: Remove unnecessary features using a voting method based on feature importance; Construct the final feature set: Use genetic algorithm to screen features from the features after feature selection, and use the remaining features to construct a training fingerprint library.

3. The method for classifying industrial control equipment based on the asset fingerprint large model according to claim 2 is characterized in that: The feature extraction is specifically as follows: The importance scores of all features of each device are calculated using a variety of different algorithms, and features with scores greater than the threshold are retained as features useful to the device through a weighted sum voting method. The mathematical representation is: in, f i The total score of the feature, f i For each feature, Algorithms is the set of all algorithms used, Score the feature importance for each algorithm.

4. The method for classifying industrial control equipment based on the asset fingerprint large model according to claim 1 is characterized in that: The method of selecting a basic large model and inputting the training fingerprint library into the model for training is specifically as follows: The llama-3-8b-bnb-4bit model is selected as the Llama3 model for industrial control equipment classification; Select AdamW optimizer to optimize the l lama-3-8b-bnb-4bit model; Use the cosine annealing algorithm to fine-tune the optimized model; Set a training round number prediction function based on the sample size, and obtain the optimal range of model training rounds based on this function.

5. The method for classifying industrial control equipment based on the asset fingerprint large model according to claim 4 is characterized in that: The AdamW optimizer is specifically: Among them, θ t,i is the i-th parameter at time step t, η is the learning rate, is the bias-corrected first-order momentum estimate, is the bias-corrected second-order momentum estimate, ω t,i is the weight decay coefficient, and ε is a constant.

6. The method for classifying industrial control equipment based on the asset fingerprint large model according to claim 4 is characterized in that: The cosine annealing algorithm is specifically: Among them, η t is the learning rate at time step t, η max and η min are the minimum and maximum values ​​of the learning rate, T cur is the current training cycle number, T max is the number of training cycles contained in a complete cosine cycle.

7. The method for classifying industrial control equipment based on the asset fingerprint large model according to claim 4 is characterized in that: The training round number prediction function based on sample size is specifically: Among them, α represents the adjustment constant of the fine-tuning round number function, β represents the linear coefficient of the fine-tuning round number function, and x represents the sample size of the training set.

8. An industrial control equipment classification system based on asset fingerprint large model, characterized in that: include: The training fingerprint library construction module is used to capture the equipment information and flow information in the industrial control system and establish the training fingerprint library of the equipment in the industrial control system; The large model training module is used to select a basic large model and input the training fingerprint library into the model for training to obtain an asset fingerprint large model; The test fingerprint library construction module is used to perform secondary bypass detection on the industrial control system, capture new device information and flow information to establish a test fingerprint library for the equipment in the industrial control system; The equipment classification module is used to input the test fingerprint library into the asset fingerprint model. The model automatically identifies the equipment based on existing learning and realizes the classification of industrial control equipment.

9. An industrial control equipment classification device based on asset fingerprint large model, characterized in that: It comprises a memory and a processor; the memory is used to store a computer program; the processor is used to implement an industrial control equipment classification method based on an asset fingerprint large model as described in any one of claims 1-7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the industrial control equipment classification method based on the asset fingerprint large model as described in any one of claims 1 to 7 is implemented.

Images